3 Commits

Include renames

Author	SHA1	Message	Date
sneak	60d2b24cd1	security: announce a fresh EIP-6963 provider UUID per page load (closes #398) ... The provider UUID was generated once, stored in extension storage, and announced verbatim to every page on every load and across restarts, so any site — connected or not — could read a stable cross-site, cross-session identifier for the install: a supercookie contradicting the "no tracking" promise. EIP-6963 wants a fresh UUIDv4 per announcement instead. inpage.js now announces a per-load crypto.randomUUID() and persists nothing; the eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script message are removed. That key was a standalone top-level storage entry, never part of the versioned autistmask profile, so stateSchema.js and the persisted-field harness are untouched and no existing profile is affected. A jest test asserts two loads announce different UUIDv4s and that one load reuses a single UUID across re-announcements. Model: opus-4-8	2026-09-21 23:35:57 +00:00
clawbot	4b7a678a9b	refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)	2026-08-17 09:06:13 +02:00
clawbot	52c7c1b060	test: containerized Firefox end-to-end harness (closes #184) ... Drives the real popup in a real Firefox with dist/firefox/ installed as an unpacked MV2 temporary add-on via geckodriver. make test-e2e-firefox, outside make check like the Chrome suite. Zero npm dependencies: plain fetch and child_process against geckodriver's HTTP API. Base image, Firefox tarball and geckodriver are each pinned by digest and verified at build time. Error capture reads the privileged console service through Marionette's chrome context, not WebDriver BiDi. BiDi delivers nothing at all for extension pages, so a BiDi-based harness would observe zero events and report success -- the vacuous-check shape this repo has shipped twice. Both the driver and the README say so where someone would be tempted to simplify. Demonstrated to discriminate: a background page that throws at the top of the file, a missing import, and an async throw where every UI assertion still passes each fail the run. Three limits are measured and documented rather than papered over: capture is poll-based so an error is attributed to a step, not a moment; the console ring buffer holds 250 messages and evicts the oldest, measured against a clean-run peak of 4; and the drained window ends roughly 1.5s after the last step, with observed jitter rather than a hard boundary. Content-script capture is marked unverified because --network none leaves no page to inject into, and that same choice inverts coverage of network-dependent code.	2026-08-12 12:20:14 +02:00