3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	1144fdb71b	harden: key remembered site permissions by full origin (closes #402) ... allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 18:09:04 +02:00
clawbot	bd0a626e7b	harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324) ... Five defects, one of which destroyed every wallet, came from src/background reading and writing the module-level state singleton the MV3 worker never populates, which silently served DEFAULT_STATE. Each point fix created the next defect. The background now has its own per-call getState() and a queued read-modify-write updateState(); the singleton is unreachable from it, and an unpopulated read throws instead of serving defaults. The prohibition is enforced by the build, not by review: build.js asserts over esbuild's own metafile that no forbidden module is an input of a background bundle, so every specifier syntax esbuild resolves is covered, and both halves of the table are checked for rot -- a stale key, a stale module, an empty list, or an unlisted entry point under src/background/ all fail the build. The ESLint rule remains as fast local feedback and reads the same shared table. Known bounds are documented where the table lives. Also closes #320: getProvider() now requires a validated network id, so a cold worker no longer prepares a non-mainnet dApp transaction for mainnet and gets refused by the wallet's own verifier. backgroundRefresh() no longer mutates address objects across a network round trip, the broadcast path takes its endpoint and chain id from one snapshot, and eight test storage stubs now structured-clone on get as the real chrome.storage.local does. closes #320	2026-08-23 17:57:30 +02:00
clawbot	cef6aaab11	fix: merge state per field instead of overwriting the whole blob (closes #304) ... saveState() is now a read-modify-write that merges only the fields this page changed, diffed against a deep-cloned per-page baseline. wallets, allowedSites, deniedSites and networkEndpoints merge structurally by identity, so membership comes from fresh storage except for this page's own adds and deletes. Fixes a second extension page silently deleting a wallet, the background balance refresh clobbering a concurrent add or resurrecting a delete, and a stale page resurrecting a revoked site permission. Colliding wallet identities keep both records and log rather than silently dropping an encryptedSecret. Concurrent writers of the same leaf remain last-writer-wins by design.	2026-08-20 16:41:19 +02:00