5 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	a1f082d686	docs: a release procedure from a green main to tagged, packaged artifacts (closes #387) ... Add docs/RELEASE.md, linked from README.md's Release Artifacts section, giving the release procedure as a numbered list: confirm main is green in CI, confirm the one version in package.json and the two manifests matches the intended tag, make package from a clean checkout, verify SHA256SUMS, create the annotated tag vX.Y.Z, then distribute per browser. Each step names who performs it, marks the owner-only ones, and states the check that it worked. Every repo command cited (make setup, make check, make package) exists on next; tagging and verification use standard git and coreutils, and the CRX pack line is README's own. The per-browser distribution step is written as pending the owner's choice on issue 386, with the Firefox and Chrome options named but none presented as settled. Docs only: no code or test changes. Model: opus-4-8	2026-09-21 22:00:18 +02:00
clawbot	33fa25adca	harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399) ... The two per-field ceilings in approvalVerify.js were checked independently, but the fee a validator is paid is gasLimit × fee per gas: a gas limit and a fee each under their own ceiling still multiply to thousands of ETH, which a gas-consuming contract really collects. assertWithinCeilings now also bounds that product against MAX_TOTAL_FEE (1 ETH), so both callers — populating the dApp transaction and verifying the signed artifact — refuse it with a full sentence naming the fee and the limit. The wallet's own send in confirmTx.js pinned no fee fields, so ethers filled them from the node with no bound; it now populates the transaction and runs the same check before signing, showing the same error in the confirmation screen's reserved errors box so nothing on screen moves. Model: opus-4-8	2026-09-21 21:45:34 +02:00
clawbot	2da790fbe9	fix: say a second wallet's password is separate when one is chosen (closes #374) ... The add-wallet screen offered only "Choose a password" while each wallet keeps its own encrypted secret, so a second wallet silently accepted a password different from the first with nothing marking it as separate. A note now appears on that screen when the profile already holds a wallet, saying each wallet has its own password and this one need not match any already in use. It is shown only then — the first wallet has no other password to differ from — and is decided on screen entry, so it does not move the password fields. It promises no recovery or reset, staying consistent with the no-password-reset design. Model: opus-4-8	2026-09-21 21:11:09 +02:00
clawbot	9ac7df0128	harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351) ... The 12-word BIP-39 test phrase survived in every release bundle as dead text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only use of it folds away in a release build, so it could not be tree-shaken. Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold it to null, so no distributed bundle carries it. script/verify-build now fails a release build if the phrase appears in any emitted file, so the fold cannot silently regress; test-verify-build covers both the release failure and the debug allowance. tests/extensionId.test.js now scans the content of every tracked file for a PEM private-key header instead of matching filename extensions alone, so a key committed under an unexpected name is caught. Model: opus-4-8	2026-09-21 18:29:39 +02:00
clawbot	99292b9188	fix: honour a transaction response only for a transaction approval (closes #262) ... The liveness fix this issue describes — settle 4001 on release when the window a retry would use is gone — already landed with #271. This completes the rest. AUTISTMASK_TX_RESPONSE now refuses any approval that is not a transaction approval, so a reject can no longer retire a sign or connection approval, and a signed artifact never runs the broadcast path against one — which before only failed closed by throwing deeper in. Tests pin the site-connection port's approve, reject and disconnect paths against a transaction approval broadcasting behind them: each is declined and the dApp still receives its broadcast result. Model: opus-4-8	2026-09-21 09:54:40 +02:00