5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	ad6aa7b20d	fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311) ... Stored state had no version and no structural validation, so a corrupt blob produced a completely blank popup with no message and no recovery control, and made every dApp RPC call from every page answer a generic -32603. There was no reset or wipe control anywhere in the UI. saveState() now stamps a schema version and loadState() validates the shape. A version it does not understand, or a wallets array it cannot parse, lands on a recovery screen that names the problem, offers the stored record verbatim for export, and offers a destructive reset behind a typed confirmation. Unversioned but valid state -- which every existing install has -- migrates in place and keeps working; it is never shown a wipe prompt. A dApp call against unusable state answers -32007, which EIP-1474 leaves unassigned, rather than -32603. networkById() refuses an unknown id loudly instead of returning mainnet, and networkId is validated so a corrupt value cannot be used as an object key. Fields the gate does not refuse are floored by type, container and entries both: a malformed trackedTokens or tokenBalances entry is dropped rather than dereferenced. Verified by an independent sweep of 1152 corrupt blobs producing no blank popup, with the same harness showing 9 blanks against the previous revision.	2026-08-23 20:04:00 +02:00
clawbot	bd0a626e7b	harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324) ... Five defects, one of which destroyed every wallet, came from src/background reading and writing the module-level state singleton the MV3 worker never populates, which silently served DEFAULT_STATE. Each point fix created the next defect. The background now has its own per-call getState() and a queued read-modify-write updateState(); the singleton is unreachable from it, and an unpopulated read throws instead of serving defaults. The prohibition is enforced by the build, not by review: build.js asserts over esbuild's own metafile that no forbidden module is an input of a background bundle, so every specifier syntax esbuild resolves is covered, and both halves of the table are checked for rot -- a stale key, a stale module, an empty list, or an unlisted entry point under src/background/ all fail the build. The ESLint rule remains as fast local feedback and reads the same shared table. Known bounds are documented where the table lives. Also closes #320: getProvider() now requires a validated network id, so a cold worker no longer prepares a non-mainnet dApp transaction for mainnet and gets refused by the wallet's own verifier. backgroundRefresh() no longer mutates address objects across a network round trip, the broadcast path takes its endpoint and chain id from one snapshot, and eight test storage stubs now structured-clone on get as the real chrome.storage.local does. closes #320	2026-08-23 17:57:30 +02:00
clawbot	a08ba6a66d	fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224) ... The persisted view stack was restored verbatim. RESTORABLE_VIEWS stopped the popup opening ONTO a view it will not re-render, but nothing kept such a view out of the stack, so Back could land on a screen whose content was deliberately never restored. No secret leaks -- those views are blank precisely because nothing is restored into them; this is a navigation defect. loadState() now truncates the stored stack at the first entry outside RESTORABLE_VIEWS, dropping it and everything above it. Truncating rather than splicing keeps the result a prefix of what was stored, so every surviving entry keeps the Back target it had; splicing would silently re-point the entry above the hole at a different screen. Filtering on load rather than on save is what makes it retroactive for stacks already in storage, and leaves the live in-session stack whole, which it should be. The general case where Back lands on a blank screen even for restorable views, because goBack() re-renders nothing, is separate and tracked at #268.	2026-08-12 12:07:48 +02:00
clawbot	74c137dadf	fix: add a Settings toggle for known-symbol spoof verification (closes #176)	2026-08-11 15:38:05 +02:00
clawbot	9b957ffd69	fix: derive hasWallet from the wallet list on load (closes #195)	2026-08-11 14:51:22 +02:00