5 Commits

Include renames

Author	SHA1	Message	Date
sneak	a8e7c119ae	fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668) ... Out of the box the wallet sent the user's addresses to Blockscout and each recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on Etherscan", now gate those requests. Both are off in a new install and offered unticked on Welcome and in Settings. While one is off, the screens that relied on it say so in a plain line. Each gated request reads its setting from storage before it asks and when the answer lands, and drops a late answer. An open popup takes another page's change and draws its screens again. While "Use Blockscout" is off, no address keeps an untracked token, and no screen names a token from Blockscout's report. ENS lookups ask only the RPC endpoint. Model: opus-5-5	2026-10-26 11:14:48 +00:00
clawbot	e517219038	fix: a balance refresh that returns after a network switch writes nothing (closes #577) ... The popup's doRefreshAndRender() and the background's backgroundRefresh() each note the network a refresh starts on and write its balances only if that network is still the active one when the requests return. Otherwise nothing is written and lastBalanceRefresh stays as the switch left it. The background checks inside updateState(). The popup refreshes a copy of its wallets and copies the results onto `state` from inside its save, under the lock, only if both its own network and the stored record's still match, so a switch the background makes is caught too. saveState() takes an optional function, run there on the stored record before the page's state is compared, that may change `state` or return false to cancel the write. Model: opus-5-5	2026-10-20 22:59:51 +02:00
clawbot	ff05bd50f7	fix: only the user switches the wallet's network (closes #408) ... A connected site's wallet_switchEthereumChain request for the other supported network now opens a prompt in its own window, through the existing approval machinery, naming the site and both networks. The network, endpoints, balances and caches change, and chainChanged is sent, only when the user approves it; rejecting or closing the prompt answers 4001. One such prompt per site at a time; a request for the active network needs none. The approval window no longer shows the connection prompt while it waits for the approval's description, since both prompts answer on the same port. Model: opus-5-5	2026-10-08 07:30:16 +02:00
clawbot	1144fdb71b	harden: key remembered site permissions by full origin (closes #402) ... allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 18:09:04 +02:00
clawbot	bd0a626e7b	harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324) ... Five defects, one of which destroyed every wallet, came from src/background reading and writing the module-level state singleton the MV3 worker never populates, which silently served DEFAULT_STATE. Each point fix created the next defect. The background now has its own per-call getState() and a queued read-modify-write updateState(); the singleton is unreachable from it, and an unpopulated read throws instead of serving defaults. The prohibition is enforced by the build, not by review: build.js asserts over esbuild's own metafile that no forbidden module is an input of a background bundle, so every specifier syntax esbuild resolves is covered, and both halves of the table are checked for rot -- a stale key, a stale module, an empty list, or an unlisted entry point under src/background/ all fail the build. The ESLint rule remains as fast local feedback and reads the same shared table. Known bounds are documented where the table lives. Also closes #320: getProvider() now requires a validated network id, so a cold worker no longer prepares a non-mainnet dApp transaction for mainnet and gets refused by the wallet's own verifier. backgroundRefresh() no longer mutates address objects across a network round trip, the broadcast path takes its endpoint and chain id from one snapshot, and eight test storage stubs now structured-clone on get as the real chrome.storage.local does. closes #320	2026-08-23 17:57:30 +02:00