4 Commits

Include renames

Author	SHA1	Message	Date
sneak	e557f21bb0	harden: key remembered site permissions by full origin (closes #402) ... allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 15:43:58 +00:00
clawbot	add11e57de	security: announce a fresh EIP-6963 provider UUID per page load (closes #398) ... The provider UUID was generated once, kept in extension storage and announced to every page on every load, so any site could read it as a stable identifier for the install across sites and browser restarts. inpage.js now generates one UUID per page load, shared by every announcement in that load, and stores nothing. The eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script message are removed. The key was never part of the versioned autistmask profile, so the state schema is untouched. Two inpage.js message listeners lose the leftover name onUuid. The test posts each load the same stored UUID the way the old content script did, and asserts that no load announces it and that two loads announce different UUIDs. Model: opus-5-5	2026-10-03 16:26:39 +02:00
clawbot	4b7a678a9b	refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)	2026-08-17 09:06:13 +02:00
clawbot	52c7c1b060	test: containerized Firefox end-to-end harness (closes #184) ... Drives the real popup in a real Firefox with dist/firefox/ installed as an unpacked MV2 temporary add-on via geckodriver. make test-e2e-firefox, outside make check like the Chrome suite. Zero npm dependencies: plain fetch and child_process against geckodriver's HTTP API. Base image, Firefox tarball and geckodriver are each pinned by digest and verified at build time. Error capture reads the privileged console service through Marionette's chrome context, not WebDriver BiDi. BiDi delivers nothing at all for extension pages, so a BiDi-based harness would observe zero events and report success -- the vacuous-check shape this repo has shipped twice. Both the driver and the README say so where someone would be tempted to simplify. Demonstrated to discriminate: a background page that throws at the top of the file, a missing import, and an async throw where every UI assertion still passes each fail the run. Three limits are measured and documented rather than papered over: capture is poll-based so an error is attributed to a step, not a moment; the console ring buffer holds 250 messages and evicts the oldest, measured against a clean-run peak of 4; and the drained window ends roughly 1.5s after the last step, with observed jitter rather than a hard boundary. Content-script capture is marked unverified because --network none leaves no page to inject into, and that same choice inverts coverage of network-dependent code.	2026-08-12 12:20:14 +02:00