6 Commits

Include renames

Author	SHA1	Message	Date
clawbot	5af89a1b63	test: drive ConfirmTx in the e2e suite, gate assertion included (closes #238) ... ConfirmTx -- the screen that decides what gets signed -- had no automated coverage of its own behaviour. The arithmetic underneath was well tested; the wiring was not, so a mutant making the spend gate read the displayed fee estimate instead of the reserve would have reintroduced the #154 overspend with the suite still green. Nine end-to-end tests now drive it for both the native and ERC-20 paths, covering the pending, funded, over-balance and estimate-failed states, and asserting that the gate reads the reserve rather than the estimate. Swapping the two makes the suite fail. The view height is asserted constant across every state transition rather than merely printed. Reaching the screen needs a funded balance and a gas estimate, so the route interception gains fixtures for both. Testing the estimate-failed state means provoking the console error the code is supposed to emit, which the harness otherwise fails a run on; an expectation mechanism consumes exactly one matching record, is scoped to the declaring test, and fails that test if nothing matched, so it cannot mask an unrelated error.	2026-08-12 11:35:20 +02:00
clawbot	c6a1f97247	fix: explain a rejected dust threshold instead of silently snapping back (closes #233) ... The dust-threshold field was the only validated input in Settings that rejected without saying anything: the value silently changed back to the stored one with no explanation. It now flashes "Please enter a whole number of gwei, zero or greater." alongside the existing resync, matching the idiom the RPC URL field already uses. The parse moves to its own module and accepts plain decimal digits only, zero or greater. Hex and exponent notation are refused rather than accepted: Number() reads "0x10" as 16 and "1e3" as 1000, neither of which the previous parseInt produced, and storing a number the user did not type is the same silent substitution this change exists to remove. The message must fit one line of the reserved flash area -- a wrapped message pushes the settings view down, which the No Layout Shift policy forbids. That is pinned by an end-to-end test measuring the rendered line height and the position of the elements below it, in a single round trip because the flash clears after two seconds.	2026-08-12 11:29:09 +02:00
clawbot	937f699fb1	feat: remove an address from an HD wallet, behind a confirmation (closes #162) ... Address rows on Home gain an [x] control, on wallets that derive addresses from an extended key and hold more than one, opening a DeleteAddress confirmation screen. Removal cannot destroy anything: the key material stays. Derivation indices are not renumbered, so the next "+" derives the next unused index rather than resurrecting the removed one. The confirmation states the real route back -- delete the whole wallet in Settings, which asks for the password and destroys the stored recovery phrase, then import it again -- and notes that the scan which follows only finds addresses with on-chain activity. The copy varies by wallet type, since an xprv wallet has no recovery phrase. Removing an address that holds a balance is allowed, with a warning naming no figure; the funds are at the address on-chain and stay there either way. Selection and active address move only when the removed address was the one selected, and site permissions are dropped for it alone. The state transition shares its address comparison, permission cleanup and active-changed broadcast with the wallet-level removal.	2026-08-12 11:16:29 +02:00
clawbot	bf1dbec87c	fix: run libsodium on WebAssembly under the extension CSP (closes #182)	2026-08-12 10:30:15 +02:00
clawbot	3e5d6323ce	feat: password-gated recovery phrase display for HD wallets (closes #161)	2026-08-11 15:25:17 +02:00
clawbot	e8ad8325c8	test: containerized Chrome end-to-end harness that drives the real popup (closes #181) ... Runs the real popup in a pinned containerized Chrome and fails on any uncaught page error or console.error. Also fixes the two defects it caught: the missing showView import in addToken.js and the missing addressDotHtml import in transactionDetail.js. closes #150 closes #151	2026-08-10 15:49:32 +02:00