3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	2da790fbe9	fix: say a second wallet's password is separate when one is chosen (closes #374) ... The add-wallet screen offered only "Choose a password" while each wallet keeps its own encrypted secret, so a second wallet silently accepted a password different from the first with nothing marking it as separate. A note now appears on that screen when the profile already holds a wallet, saying each wallet has its own password and this one need not match any already in use. It is shown only then — the first wallet has no other password to differ from — and is decided on screen entry, so it does not move the password fields. It promises no recovery or reset, staying consistent with the no-password-reset design. Model: opus-4-8	2026-09-21 21:11:09 +02:00
clawbot	9ac7df0128	harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351) ... The 12-word BIP-39 test phrase survived in every release bundle as dead text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only use of it folds away in a release build, so it could not be tree-shaken. Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold it to null, so no distributed bundle carries it. script/verify-build now fails a release build if the phrase appears in any emitted file, so the fold cannot silently regress; test-verify-build covers both the release failure and the debug allowance. tests/extensionId.test.js now scans the content of every tracked file for a PEM private-key header instead of matching filename extensions alone, so a key committed under an unexpected name is caught. Model: opus-4-8	2026-09-21 18:29:39 +02:00
clawbot	99292b9188	fix: honour a transaction response only for a transaction approval (closes #262) ... The liveness fix this issue describes — settle 4001 on release when the window a retry would use is gone — already landed with #271. This completes the rest. AUTISTMASK_TX_RESPONSE now refuses any approval that is not a transaction approval, so a reject can no longer retire a sign or connection approval, and a signed artifact never runs the broadcast path against one — which before only failed closed by throwing deeper in. Tests pin the site-connection port's approve, reject and disconnect paths against a transaction approval broadcasting behind them: each is declined and the dApp still receives its broadcast result. Model: opus-4-8	2026-09-21 09:54:40 +02:00