4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	6a86b726d2	fix: a change made while an earlier save is running is stored (closes #448) ... saveStateOnce() took its baseline from the page's state after the write, so a change made while the save waited on storage counted as already stored and the save queued after it wrote nothing. A setting changed during the read was lost, and so was a wallet added, a site revoked or an endpoint changed during the write. The save now copies the page's fields when it starts, writes from that copy, and keeps the copy as the baseline, so anything changed after the copy is still a difference for the next save. Model: opus-5-5	2026-10-05 04:43:06 +02:00
clawbot	1144fdb71b	harden: key remembered site permissions by full origin (closes #402) ... allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 18:09:04 +02:00
clawbot	bd0a626e7b	harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324) ... Five defects, one of which destroyed every wallet, came from src/background reading and writing the module-level state singleton the MV3 worker never populates, which silently served DEFAULT_STATE. Each point fix created the next defect. The background now has its own per-call getState() and a queued read-modify-write updateState(); the singleton is unreachable from it, and an unpopulated read throws instead of serving defaults. The prohibition is enforced by the build, not by review: build.js asserts over esbuild's own metafile that no forbidden module is an input of a background bundle, so every specifier syntax esbuild resolves is covered, and both halves of the table are checked for rot -- a stale key, a stale module, an empty list, or an unlisted entry point under src/background/ all fail the build. The ESLint rule remains as fast local feedback and reads the same shared table. Known bounds are documented where the table lives. Also closes #320: getProvider() now requires a validated network id, so a cold worker no longer prepares a non-mainnet dApp transaction for mainnet and gets refused by the wallet's own verifier. backgroundRefresh() no longer mutates address objects across a network round trip, the broadcast path takes its endpoint and chain id from one snapshot, and eight test storage stubs now structured-clone on get as the real chrome.storage.local does. closes #320	2026-08-23 17:57:30 +02:00
clawbot	cef6aaab11	fix: merge state per field instead of overwriting the whole blob (closes #304) ... saveState() is now a read-modify-write that merges only the fields this page changed, diffed against a deep-cloned per-page baseline. wallets, allowedSites, deniedSites and networkEndpoints merge structurally by identity, so membership comes from fresh storage except for this page's own adds and deletes. Fixes a second extension page silently deleting a wallet, the background balance refresh clobbering a concurrent add or resurrecting a delete, and a stale page resurrecting a revoked site permission. Colliding wallet identities keep both records and log rather than silently dropping an encryptedSecret. Concurrent writers of the same leaf remain last-writer-wins by design.	2026-08-20 16:41:19 +02:00