Implement personal_sign and eth_signTypedData_v4 message signing

Replace stub error handlers with full approval flow for personal_sign, eth_sign, eth_signTypedData_v4, and eth_signTypedData. Uses toolbar popup only (no fallback window) and keeps sign approvals pending across popup close/reopen cycles so the user can respond via the toolbar icon.
2026-02-27 14:55:11 +07:00
86 changed files with 1714 additions and 245306 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,4 @@
 .git
 node_modules
 .DS_Store
 dist
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -6,4 +6,4 @@ jobs:
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .
--- a/.gitignore
+++ b/.gitignore
@@ -25,4 +25,3 @@ dist/
 # Yarn
 .yarn-integrity
 package-lock.json
--- a/10
+++ b/10
@@ -1,15 +1,13 @@
 # node:22-slim (22.x LTS), 2026-02-24
 FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 RUN corepack enable && corepack prepare yarn@1.22.22 --activate
 WORKDIR /app
 # script/bootstrap installs all prerequisites (make via apt here; node
 # is already in the base image, yarn comes via corepack) and runs
 # yarn install --frozen-lockfile. Dependency manifests are copied first
 # so the bootstrap layer is cached until they change.
 COPY script/ script/
 COPY package.json yarn.lock ./
-RUN script/bootstrap
+RUN yarn install --frozen-lockfile
 COPY . .
--- a/107
+++ b/107
@@ -672,110 +672,3 @@ may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
 <https://www.gnu.org/licenses/why-not-lgpl.html>.
 ===========================================================================
 THIRD-PARTY FILES
 ===========================================================================
 The following files are not original to this project and are distributed
 under their own licenses. They are NOT covered by the GPL-3.0 license above.
 ---------------------------------------------------------------------------
 File: src/shared/phishingBlocklist.json
 Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
 Copyright: Copyright (c) 2018 kumavis
 License: Don't Be a Dick Public License (DBAD), Version 1.2
 ---------------------------------------------------------------------------
 DON'T BE A DICK PUBLIC LICENSE
 Version 1.2, February 2021
 Copyright (C) 2018 kumavis
 Everyone is permitted to copy and distribute verbatim or modified
 copies of this license document.
 DON'T BE A DICK PUBLIC LICENSE
 TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 1. Do whatever you like with the original work, just don't be a dick.
     Being a dick includes - but is not limited to - the following instances:
     1a. Outright copyright infringement - Don't just copy the original
         work/works and change the name.
     1b. Selling the unmodified original with no work done what-so-ever,
         that's REALLY being a dick.
     1c. Modifying the original work to contain hidden harmful content.
         That would make you a PROPER dick.
 2. If you become rich through modifications, related works/services, or
    supporting the original work, share the love. Only a dick would make
    loads off this work and not buy the original work's creator(s) a pint.
 3. Code is provided with no warranty. Using somebody else's code and
    bitching when it goes wrong makes you a DONKEY dick. Fix the problem
    yourself. A non-dick would submit the fix back or submit a bug report.
 4. If you use code, calling it your own would make you a ROYAL dick.
    Alternatively, even just a comment giving attribution to where you found
    the code would be OK.
 ---------------------------------------------------------------------------
 File: src/shared/scamlist.js (address data from MyEtherWallet ethereum-lists)
 Source: https://github.com/MyEtherWallet/ethereum-lists (addresses-darklist.json)
 Copyright: Copyright (c) 2020 MyEtherWallet
 License: MIT License
 ---------------------------------------------------------------------------
 MIT License
 Copyright (c) 2020 MyEtherWallet
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ---------------------------------------------------------------------------
 File: src/shared/scamlist.js (address data from EtherScamDB)
 Source: https://github.com/MrLuit/EtherScamDB (scams.yaml)
 Copyright: Copyright (c) 2018 Luit Hollander
 License: MIT License
 ---------------------------------------------------------------------------
 MIT License
 Copyright (c) 2018 Luit Hollander
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
--- a/63
+++ b/63
@@ -1,60 +1,29 @@
-.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
+.PHONY: install test lint fmt fmt-check check docker hooks build clean dev
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
 # of README.md).
 bootstrap:
 	@script/bootstrap
 setup:
 	@script/setup
 install:
 	@yarn install
 test:
-	@script/test
+	@echo "Running tests..."
-
+	@timeout 30 yarn run test 2>&1
 # Browser end-to-end suite. Requires docker; not part of check.
 test-e2e:
 	@script/test-e2e
 lint:
-	@script/lint
+	@echo "Linting..."
 	@yarn run lint 2>&1
 fmt:
-	@script/fmt
+	@echo "Formatting..."
 	@yarn run fmt 2>&1
 fmt-check:
-	@script/fmt-check
+	@echo "Checking formatting..."
 	@yarn run fmt-check 2>&1
-check:
+check: test lint fmt-check
 	@script/check
 docker:
 	@script/docker
 hooks:
 	@script/install-precommit
 build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
 	@script/verify-build
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
 # distribute the artifacts this produces.
 build-debug:
 	@echo "Building extension (DEBUG)..."
 	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
 	@AUTISTMASK_DEBUG=1 script/verify-build
 # Assert the compiled DEBUG state of the bundles already in dist/. Runs at
 # the end of build and build-debug; separate target for re-running it alone.
 verify-build:
 	@script/verify-build
 clean:
 	@rm -rf dist/
@@ -62,3 +31,15 @@ clean:
 dev:
 	@echo "Building in watch mode..."
 	@yarn run build --watch 2>&1
 docker:
 	@docker build -t autistmask .
 hooks:
 	@echo "Installing pre-commit hook..."
 	@mkdir -p .git/hooks
 	@echo '#!/usr/bin/env bash' > .git/hooks/pre-commit
 	@echo 'set -euo pipefail' >> .git/hooks/pre-commit
 	@echo 'make check' >> .git/hooks/pre-commit
 	@chmod +x .git/hooks/pre-commit
 	@echo "Pre-commit hook installed."
--- a/README.md
+++ b/README.md
@@ -6,26 +6,6 @@ Chrome and Firefox. It manages HD wallets derived from BIP-39 seed phrases and
 supports sending and receiving ETH and ERC-20 tokens, as well as web3 site
 connection and authentication via the EIP-1193 provider API.
 The most popular browser-based EVM wallet has a cute mascot, but sucks now. It
 has tracking, ads, preferred placement for swaps, tx broadcast fuckery,
 intercepts tx status links to their own site instead of going to Etherscan, etc.
 None of the common alternatives work on Firefox.
 Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
 Everything you need, nothing you don't. We import as few libraries as possible,
 don't implement any crypto, and don't send user-specific data anywhere but a
 (user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
 extension contacts three user-configurable services: the configured RPC node for
 blockchain interactions, a public CoinDesk API (no API key) for realtime price
 information, and a Blockscout block-explorer API for transaction history and
 token balances. It also fetches a community-maintained phishing domain blocklist
 periodically and performs best-effort Etherscan address label lookups during
 transaction confirmation.
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
 list exists to detect symbol spoofing attacks and improve UX.
 ## Getting Started
 ```bash
@@ -42,127 +22,11 @@ Load the extension:
 - **Firefox**: Navigate to `about:debugging#/runtime/this-firefox`, click "Load
  Temporary Add-on", and select `dist/firefox/manifest.json`.
 ### Debug Builds
 `make build` always produces a release build: the build-time `DEBUG` constant is
 `false`, so wallet creation uses real entropy and the red banner is off. To
 produce a debug build instead, set `AUTISTMASK_DEBUG=1` in the environment:
 ```bash
 make build-debug          # or: AUTISTMASK_DEBUG=1 make build
 ```
 Only the exact value `1` enables it; any other value (including unset, empty, or
 `true`) yields a release build, so a typo cannot accidentally ship the debug
 behavior. The build prints which mode it used. See the
 [DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
 distribute a debug build** — every wallet it creates gets the same publicly
 known test recovery phrase.
 Both builds end by running `script/verify-build`, which reads the compiled
 `DEBUG` state back out of the emitted bundles and fails the build if it is not
 the one that was asked for. The test suite cannot check this: it loads
 `src/shared/constants.js` outside a bundle, so it only ever sees the fallback
 value. The assertion is on the artifacts because that is where the property
 lives.
 ## Entrypoints
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 - `script/bootstrap` — install all dependencies (pinned node via nvm if needed,
  yarn via corepack, `yarn install --frozen-lockfile`)
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
  git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
 - `script/test-e2e` — run the browser end-to-end suite (docker required; see
  [End-to-End Tests](#end-to-end-tests))
 - `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
 - `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
  `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
  off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
  `make build` and `make build-debug`; fails loudly rather than passing if it
  cannot determine a bundle's state. Not part of `make check`, which does not
  depend on build artifacts existing.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 ## End-to-End Tests
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
 `mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
 docker is required and the suite fails loudly rather than skipping if it is
 unavailable). The suite lives in `tests/e2e/` and is driven by
 `playwright-core`, whose version must stay matched to the container's Playwright
 version — the browsers ship inside the image.
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
 the UI, the Add Token screen and the transaction detail screen for an ERC-20
 transfer. All outbound network is intercepted at the browser level and served
 from fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
 offline; unrecognised outbound requests are reported as failures rather than
 silently allowed.
 That reporting has one bound worth knowing. Observation ends when the browser
 context is torn down, and nothing can watch traffic after that, so the run keeps
 collecting for a fixed grace period after the last test returns
 (`TRAILING_WATCH_MS` in `tests/e2e/run.js`, currently 1500ms) and then closes
 the context. A request whose _first_ dispatch falls after that window is never
 seen at all and cannot fail the run. In practice a request a test fires without
 awaiting reaches the route handler about 10ms later, and anything on a repeating
 timer gets observed on an earlier tick during the ~20s suite — but a one-shot
 call deliberately deferred past the window will escape.
 That interception covers the MV3 background service worker as well as the popup
 page, which it does not by default — `script/test-e2e` sets
 `PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
 experimental, the harness does not take it on trust. At launch it waits for the
 background worker's **own** startup request — the phishing blocklist fetch that
 `src/background/index.js` issues unconditionally — to arrive in the route
 handler, and aborts the entire suite if none does within 30 seconds
 (`tests/e2e/harness.js`). The check is passive on purpose: a synthetic probe
 fetched from inside the worker via `worker.evaluate()` was tried first and
 rejected, because evaluating in an extension service worker that early kills the
 worker outright, destroying the thing being measured. Observing traffic the
 extension already generates perturbs nothing. Losing the race fails closed — the
 suite refuses to run rather than passing quietly.
 As defence in depth, Chrome is also started with
 `--host-resolver-rules=MAP * ~NOTFOUND`, so a request that ever did slip past
 the route handler could not resolve a host at all. That only bounds the damage;
 detecting escaping traffic remains the canary's job. To see what is actually
 being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
 printed, tagged `[sw]` or `[page]`.
 **Any uncaught page error or `console.error` fails the run.** That is the point:
 a `ReferenceError` from a used-but-not-imported identifier is invisible to
 `make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
 and this suite exists because exactly that class of bug shipped twice.
 `make test-e2e` is deliberately **not** part of `make check` or `make test`.
 `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser suite does not
 fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot pick it up
 either. It is also not wired into the Gitea workflow yet — docker-in-docker in
 CI is a separate question. Run it locally before changing anything under
 `src/popup/views/`.
 ## Rationale
-Common popular EVM wallets have become bloated with swap UIs, portfolio
+MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
-dashboards, analytics, tracking, and advertisements. It is no longer a simple
+tracking, and advertisements. It is no longer a simple wallet. Most alternatives
-wallet. Most alternatives only support Chromium browsers, leaving Firefox users
+(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
 without a usable option.
 AutistMask exists to provide the absolute minimum viable Ethereum wallet
@@ -182,70 +46,47 @@ separate output directories.
 ```
 src/
-  background/         — service worker / background script
+  background/       — service worker / background script
-    index.js          — RPC routing, approval flows, message signing
+    index.js        — extension lifecycle, message routing
-  content/            — content script injected into web pages
+    wallet.js       — wallet management (create, import, derive via ethers.js)
-    index.js          — relay between inpage provider and background
+    provider.js     — EIP-1193 JSON-RPC provider implementation
-    inpage.js         — the window.ethereum provider object (EIP-1193)
+  popup/            — popup UI (the main wallet interface)
  popup/              — popup UI (the main wallet interface)
    index.html
-    index.js          — entry point, view routing, state restore
+    index.js
-    styles/main.css   — Tailwind source
+    styles/         — CSS (Tailwind)
-    views/            — one JS module per screen (home, send, approval, etc.)
+  content/          — content script injected into web pages
-  shared/             — modules used by both popup and background
+    index.js        — injects the provider into page context
-    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
+    inpage.js       — the window.ethereum provider object
-    constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
+  shared/           — shared utilities
-    ens.js            — ENS forward/reverse resolution
+    vault.js        — encrypted storage via libsodium
-    prices.js         — ETH/USD and token/USD via CoinDesk API
+    constants.js    — chain IDs, default RPC endpoints, ERC-20 ABI
    scamlist.js       — known fraud contract addresses
    state.js          — persisted state (extension storage)
    tokenList.js      — top ERC-20 tokens by market cap (hardcoded)
    transactions.js   — tx history fetching + anti-poisoning filters
    uniswap.js        — Uniswap Universal Router calldata decoder
    vault.js          — password-based encryption via libsodium
    wallet.js         — mnemonic generation, HD derivation, signing
 manifest/
-  chrome.json         — Manifest V3 for Chrome
+  chrome.json       — Manifest V3 for Chrome
-  firefox.json        — Manifest V2 for Firefox
+  firefox.json      — Manifest V2/V3 for Firefox
 ```
 ### UI Design Philosophy
-The UI is inspired by _Universal Paperclips_. It's deliberately minimal,
+The UI follows a "Universal Paperclips" aesthetic — a deliberately spartan,
-monochrome, fast, and includes once-popular usability affordances that seem to
+almost brutalist approach. The guiding principle is that an unskilled,
-have fallen out of fashion in modern UI design. Clickable things look clickable.
+non-technical person should be able to figure out how to use it without any
-Things don't flash or spin or move around unnecessarily. This is a tool for
+crypto knowledge.
 getting work done, not a toy.
 This is designed for a normal audience. Basic familiarity with cryptocurrency
 terms is required, but you need not be a programmer or software engineer to use
 this wallet.
 If you _are_ basically familiar with cryptocurrency terms, you should be able to
 use all of the main features of this wallet without having to read the
 documentation; i.e. we wish for the primary functionality to remain easily
 discoverable.
 #### Visual Style
- **Monochrome**: Black text on white background. Color is only used when and
+- **Monochrome**: Black text on white background. No brand colors, no gradients,
-  where it is semantically meaningful and explicitly useful, such as error
+  no color-coding. Color may be introduced later for specific semantic purposes
-  messages, critical warnings, or address disambiguation. (Notable exception: we
+  (e.g. error states) but the baseline is monochrome.
  use color dots, and identicons, to help a user easily distinguish addresses.)
 - **Text-first**: Every piece of information is presented as text. Balances are
-  numbers. Addresses are hex strings. Flash messages are sentences. All fiddly
+  numbers. Addresses are hex strings. Status is a sentence. No progress spinners
-  bits can be clicked to copy to the clipboard, and external links to Etherscan
+  with animations — a text status line is sufficient.
  are provided everywhere they might be useful.
 - **Monospace font**: All text is rendered in the system monospace font.
  Ethereum addresses, transaction hashes, and balances are inherently
  fixed-width data. Rather than mixing proportional and monospace fonts, we use
  monospace everywhere for visual consistency and alignment.
 - **No images**: Zero image assets in the entire extension. No logos, no
  illustrations, no token icons. Token identity is conveyed by symbol text (ETH,
-  USDC, etc.). We display
+  USDC, etc.).
  [Blockie identicons](https://github.com/MyCryptoHQ/ethereum-blockies-base64)
  on critical screens and when space is available to allow users to disambiguate
  addresses visually, as a security feature.
 - **Tailwind CSS**: Utility-first CSS via Tailwind. No custom CSS classes for
  styling. Tailwind is configured with a minimal monochrome palette. This keeps
  the styling co-located with the markup and eliminates CSS file management.
@@ -254,19 +95,16 @@ discoverable.
  would add bundle size, build complexity, and attack surface for no benefit at
  this scale.
 - **360x600 popup**: Standard browser extension popup dimensions. The UI is
-  designed for this fixed viewport.
+  designed for this fixed viewport — no responsive breakpoints needed.
 #### No Layout Shift
 Asynchronous state changes (clipboard confirmation, transaction status, error
-messages, flash notifications, API results returning) must _never_ move around
+messages, flash notifications) must never move existing UI elements. All dynamic
-the existing UI elements. All dynamic content areas must reserve their space up
+content areas reserve their space up front using `min-height` or always-present
-front using `min-height` or always-present wrapper elements.
+wrapper elements. `visibility: hidden` is preferred over `display: none` when
-`visibility: hidden` is preferred over `display: none` when the element's space
+the element's space must be preserved. This prevents jarring content jumps that
-must be preserved. This prevents jarring content jumps that disorient users and
+disorient users and avoids mis-clicks caused by shifting buttons.
 can cause dangerous mis-clicks. Anyone who has multi-tabled on ClubGG and
 smashed the big red "all-in blind preflop" button when trying to simply "call"
 on a different table knows exactly tf I am talking about.
 #### Clickable Affordance
@@ -280,40 +118,24 @@ click it.
 #### Display Consistency
 The same data must be formatted identically everywhere it appears. Token and ETH
-amounts are displayed with exactly 4 decimal places (e.g. "1.0500 ETH", "17.1900
+amounts are always displayed with exactly 4 decimal places (e.g. "1.0500 ETH",
-USDT") in balance lists, transaction lists, send confirmations, and approval
+"17.1900 USDT") — in balance lists, transaction lists, transaction details, send
-screens. Timestamps include both an ISO datetime and a humanized relative age
+confirmations, and any other context. Timestamps include both an ISO datetime
-wherever shown. If a formatting rule applies in one place, it applies in every
+and a humanized relative age wherever shown. If a formatting rule applies in one
-place. Users should never see the same value rendered differently on two
+place, it applies in every place. Users should never see the same value rendered
-screens.
+differently on two screens.
 **Specific Exception — Truncation:** On some non-critical display locations, we
 may truncate _a small number_ of characters from the middle of an address solely
 due to display size constraints. Wherever possible, and, notably, **in all
 critical contexts (transaction confirmation view before signing, transaction
 history detail view) addresses will _NEVER_ be truncated**. Even in places we
 truncate addresses, we truncate only a maximum of 10 characters, which means
 that the portions still displayed will be more than adequate for the user to
 verify addresses even in the case of address spoofing attacks. Clicking an
 address will always copy the full, untruncated value.
 **Specific Exception — Transaction Detail view:** The transaction detail screen
 is the authoritative record of a specific transaction and shows the exact,
 untruncated amount with all meaningful decimal places (e.g. "0.00498824598498216
 ETH"). It also shows the native quantity (e.g. "4988245984982160 wei") below it.
 Both are click-copyable. Truncating to 4 decimals in summary views is acceptable
 for scannability, but the detail view must never discard precision — it is the
 one place the user can always use to verify exact details.
 #### Language & Labeling
-All user-facing text avoids unnecessary jargon wherever possible:
+All user-facing text avoids crypto jargon wherever possible:
 - "Recovery phrase" instead of "seed phrase", "mnemonic", or "BIP-39 mnemonic"
 - "Address" instead of "account", "derived key", or "HD child"
 - "Password" instead of "encryption key" or "vault passphrase"
 - "Private key" instead of "secret key" or "signing key"
 - Buttons use plain verbs: "Send", "Receive", "Copy address", "Add", "Back",
  "Cancel", "Lock", "Unlock", "Allow", "Deny"
 - No bracket notation like `[locked]` or `[setup]` — just plain titles
 - Helpful inline descriptions where needed (e.g. "This password locks the wallet
  on this device. It is not the same as your recovery phrase.")
 - Error messages are full sentences ("Please enter your password." not "password
@@ -322,14 +144,14 @@ All user-facing text avoids unnecessary jargon wherever possible:
 #### Full Identifiers Policy
 Addresses, transaction hashes, contract addresses, and all other cryptographic
-identifiers are displayed in full whenever possible. We truncate only in
+identifiers are displayed in full whenever possible — never truncated. Address
-specific, limited, non-critical places and even then only a small amount that
+poisoning attacks exploit truncated displays by generating fraud addresses that
-still prevents spoofing attacks. Address poisoning attacks exploit truncated
+share the same prefix and suffix as a legitimate address. If a user only sees
-displays by generating fraud addresses that share the same prefix and suffix as
+`0xAbCd...1234`, an attacker can create an address with the same visible
-a legitimate address. If a user only sees `0xAbCd...1234`, an attacker can
+characters and trick the user into sending funds to it. Showing the complete
-create an address with the same visible characters and trick the user into
+identifier defeats this class of attack. Truncation is only acceptable in
-sending funds to it. Showing the complete identifier defeats this class of
+space-constrained contexts where the full identifier is accessible one tap away
-attack.
+(e.g. a tooltip or copy action).
 #### Data Model
@@ -553,29 +375,16 @@ transitions.
 #### TransactionDetail
 - **When**: User tapped a transaction row from AddressDetail or AddressToken.
- **Elements** (grouped into logical blocks using light well containers; field
+- **Elements**:
  labels are self-explanatory so groups have no headings):
    - "Transaction" heading, "Back" button
    - Transaction hash: full hash (tap to copy) + etherscan link
    - Type: transaction classification — one of: Native ETH Transfer, ERC-20
      Token Transfer, Swap, Token Approval, Contract Call, Contract Creation
    - Status: "Success" or "Failed"
    - From: blockie + color dot + full address (tap to copy) + etherscan link;
      ENS name if available
    - To: blockie + color dot + full address (tap to copy) + etherscan link; ENS
      name if available
    - Time: ISO datetime + relative age in parentheses
    - Block: block number (tap to copy) + etherscan block link
    - Amount: value + symbol (bold)
-    - Native quantity: raw integer + unit (shown when available)
+    - From: blockie + color dot + full address (tap to copy) + etherscan link
-    - Token contract: shown for ERC-20 transfers — color dot + full contract
+        - ENS name if available
-      address (tap to copy) + etherscan token link
+    - To: blockie + color dot + full address (tap to copy) + etherscan link
-    - Decoded details (shown for contract calls): action name, decoded
+        - ENS name if available
-      parameters, token details, swap steps
+    - Transaction hash: full hash (tap to copy) + etherscan link
    - Network details (shown when on-chain data is available): nonce, gas price,
      gas used, transaction fee (all tap to copy)
    - Raw data (shown when calldata is present): full calldata in monospace
      dashed border
 - **Transitions**:
    - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
@@ -628,100 +437,54 @@ transitions.
 #### TxApproval
 - **When**: A connected website requests a transaction via
-  `eth_sendTransaction`. Opened via the toolbar popup by the background script.
+  `eth_sendTransaction`. Opened in a separate popup by the background script.
 - **Elements**:
    - "Transaction Request" heading
    - Site hostname (bold) + "wants to send a transaction"
    - Decoded action (if calldata is recognized): action name, token details,
      amounts, steps, deadline (see Transaction Decoding)
    - From: color dot + full address + etherscan link
-    - To/Contract: color dot + full address + etherscan link (or "contract
+    - To: color dot + full address + etherscan link (or "contract creation")
      creation"), token symbol label if known
    - Value: amount in ETH (4 decimal places)
-    - Raw data: full calldata displayed inline (shown if present)
+    - Data: raw transaction data (shown if present)
    - Password input
    - "Confirm" / "Reject" buttons
 - **Transitions**:
    - "Confirm" (with password) → closes popup (returns result to background)
    - "Reject" → closes popup (returns rejection to background)
 #### SignApproval
 - **When**: A connected website requests a message signature via
  `personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened via the toolbar
  popup by the background script.
 - **Elements**:
    - "Signature Request" heading
    - Site hostname (bold) + "wants you to sign a message"
    - Type: "Personal message" or "Typed data (EIP-712)"
    - From: color dot + full address + etherscan link
    - Message: decoded UTF-8 text (personal_sign) or formatted domain/type/
      message fields (EIP-712 typed data)
    - Password input
    - "Sign" / "Reject" buttons
 - **Transitions**:
    - "Sign" (with password) → signs locally → closes popup (returns signature)
    - "Reject" → closes popup (returns rejection to background)
 ### External Services
 AutistMask is not a fully self-contained offline tool. It necessarily
-communicates with three external services to function as a wallet:
+communicates with external services to function as a wallet:
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
  estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
  broadcast transactions (`eth_sendRawTransaction`), and check transaction
  receipts. The default endpoint is a public RPC (configurable by the user to
-  any endpoint they prefer, including a local node). By default the extension
+  any endpoint they prefer, including a local node). This is the only external
-  talks to `https://ethereum-rpc.publicnode.com`.
+  service the extension talks to.
    - **Data sent**: Ethereum addresses, transaction data, contract call
      parameters. The RPC endpoint can see all on-chain queries and submitted
      transactions.
 - **CoinDesk CADLI price API**: Used to fetch ETH/USD and token/USD prices for
  displaying fiat values. The price is cached for 5 minutes to avoid excessive
  requests. No API key required. No user data is sent — only a list of token
-  symbols. Note that CoinDesk will receive your client IP.
+  symbols.
    - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
      addresses or user-specific data.
 - **Blockscout block-explorer API**: Used to fetch transaction history (normal
  transactions and ERC-20 token transfers), ERC-20 token balances, and token
  holder counts (for spam filtering). The default endpoint is
  `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
    - **Data sent**: Ethereum addresses. Blockscout receives the user's
      addresses to query their transaction history and token balances. No
      private keys, passwords, or signing operations are sent.
 What the extension does NOT do:
 - No analytics or telemetry services
 - No token list APIs (user adds tokens manually by contract address)
 - No phishing/blocklist APIs
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
-In addition to the three user-configurable services above (RPC endpoint,
+The user's RPC endpoint and the CoinDesk price API are the only external
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
+services. Users who want maximum privacy can point the RPC at their own node
-
+(price fetching can be disabled in a future version).
 - **Phishing domain blocklist**: A community-maintained phishing domain
  blocklist is vendored into the extension at build time. At runtime, the
  extension fetches the live list once every 24 hours to detect newly added
  domains. Only the delta (domains not already in the vendored list) is kept in
  memory, keeping runtime memory usage small. The delta is persisted to
  localStorage if it is under 256 KiB.
 - **Etherscan address labels**: When confirming a transaction, the extension
  performs a best-effort lookup of the recipient address on Etherscan to check
  for phishing/scam labels. This is a direct page fetch with no API key; the
  user's browser makes the request.
 Users who want maximum privacy can point the RPC and Blockscout URLs at their
 own self-hosted instances (price fetching can be disabled in a future version).
 ### Dependencies
-AutistMask uses four runtime libraries. All cryptographic operations are
+AutistMask uses two runtime libraries. All cryptographic operations are
-delegated to ethers and libsodium — see the Crypto Policy section below.
+delegated to these libraries — see the Crypto Policy section below.
 | Package                    | Version | License | Purpose                                                                                                                                                                                                                                                 |
 | -------------------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -746,41 +509,17 @@ Dev dependencies (not shipped in extension):
 `pbkdf`, `hmac`, `encrypt`, `decrypt`, `hash`, `cipher`, `digest`, `sign`
 (case-insensitive) appear in our own source code (outside of `node_modules/`),
 it is almost certainly a bug. All cryptographic operations must go through
-`ethers` or `libsodium-wrappers-sumo`. Both are widely audited and
+`ethers` or `libsodium-wrappers-sumo`. This policy exists because:
-battle-tested.
+
 - Rolling your own crypto is the single most common source of security
  vulnerabilities in wallet software.
 - Both libraries are widely audited and battle-tested.
 - Keeping crypto out of application code makes security review tractable:
  reviewers only need to verify that we call the libraries correctly, not that
  we implemented crypto correctly.
 Exceptions require explicit authorization in a code comment referencing this
-policy, but as of now there are none.
+policy.
 ### Content Security Policy
 Both manifests declare the same policy for extension pages —
 `script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
 `content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
 a bare string in `manifest/firefox.json` (MV2).
 `'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
 build and a `wasm2js` translation of it in one file, tries WASM first, and
 silently falls back to the translation if instantiation throws. Under a plain
 `script-src 'self'` the fallback was taken on every popup load, announced by
 nothing but an uncaught `CompileError`. Measured on the same Argon2id parameters
 the vault uses (`OPSLIMIT_INTERACTIVE`, `MEMLIMIT_INTERACTIVE`), WASM derives a
 key in 141-198ms and `wasm2js` in 3204-3660ms. The work factor is identical — it
 is set by the ops and memory parameters, not by wall time — so the fallback
 bought nothing and cost about three and a half seconds on every operation that
 asks for the password, which is every signature.
 The keyword permits compiling WebAssembly and nothing else: not `eval()` of
 strings, not inline script, not remote script. Using it requires already
 executing script in an extension page, which is complete compromise on its own.
 `'unsafe-eval'` is a different proposition and is not granted.
 The grant is pinned in both directions. `tests/manifest.test.js` asserts the
 exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
 20x regression on the key derivation) and adding anything beyond it both fail
 `make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
 backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
 under the real manifest.
 ### DEBUG Mode Policy
@@ -791,19 +530,6 @@ flows, or alter program behavior beyond the banner and the hardcoded mnemonic.
 Adding new DEBUG-conditional branches requires explicit approval from the
 project owner.
 `DEBUG` is a build-time constant, not a runtime setting. `build.js` injects it
 into the bundle as the `__BUILD_DEBUG__` define — `false` unless the build was
 run with `AUTISTMASK_DEBUG=1` (see [Debug Builds](#debug-builds)) — and
 `src/shared/constants.js` reads it. It cannot be changed after the bundle is
 produced.
 The debug-mode toggle in settings is a separate, runtime-only flag. It raises
 the log level and turns the banner on, and that is all it may ever do: it feeds
 `isDebug()` in `src/shared/log.js`, which is deliberately not what
 `generateMnemonic()` consults. Mnemonic generation reads the build-time `DEBUG`
 constant directly, so no runtime toggle in a release build can reach the
 hardcoded test phrase.
 ### Key Decisions
 - **No framework**: The popup UI is vanilla JS and HTML. The extension is small
@@ -825,12 +551,12 @@ hardcoded test phrase.
    - **The password is NOT used in address derivation.** It exists solely to
      protect the recovery phrase / private key on disk. Anyone with the
      recovery phrase can restore the wallet on any device without this
-      password. This matches standard EVM wallet behavior.
+      password. This matches MetaMask's behavior.
 - **BIP-39 / BIP-44 via ethers.js**: Mnemonic generation, validation, and HD key
  derivation (`m/44'/60'/0'/0/n`) are handled entirely by ethers.js. The BIP-39
-  passphrase is always empty (matching most wallet software). The user's
+  passphrase is always empty (matching MetaMask and most wallet software). The
-  password is completely separate and has no effect on which addresses are
+  user's password is completely separate and has no effect on which addresses
-  generated.
+  are generated.
 - **ethers.js for everything Ethereum**: Transaction construction, signing, gas
  estimation, RPC communication, ERC-20 contract calls, and address derivation
  are all handled by ethers.js. This means zero hand-rolled Ethereum logic.
@@ -852,16 +578,13 @@ hardcoded test phrase.
 - View ERC-20 token balances (user adds token by contract address)
 - Send ETH to an address
 - Send ERC-20 tokens to an address
- Receive ETH/tokens (display address, copy to clipboard, QR code)
+- Receive ETH/tokens (display address, copy to clipboard)
 - Connect to web3 sites (EIP-1193 `eth_requestAccounts`)
- Sign transactions requested by connected sites (`eth_sendTransaction`)
+- Sign transactions requested by connected sites
 - Sign messages (`personal_sign`, `eth_sign`)
- Sign typed data (`eth_signTypedData_v4`, `eth_signTypedData`)
+- Lock/unlock with password
- Human-readable transaction decoding (ERC-20, Uniswap Universal Router)
+- Configurable RPC endpoint
- ETH/USD and token/USD price display
+- Future: USD value display (and other fiat currencies)
 - Configurable RPC endpoint and Blockscout API
 - Address poisoning protection (spam token filtering, dust filtering, fraud
  contract blocklist)
 ### Address Poisoning and Fake Token Transfer Attacks
@@ -949,118 +672,108 @@ indexes it as a real token transfer.
  designed as a sharp tool — users who understand the risks can configure the
  wallet to show everything unfiltered, unix-style.
-#### Phishing Domain Protection
+### Non-Goals
-AutistMask protects users from known phishing sites when they connect their
+- Token swaps (use a DEX in the browser)
-wallet or approve transactions/signatures. A community-maintained domain
+- NFT display or management
-blocklist is vendored into the extension at build time, providing immediate
+- Multi-chain support (Ethereum mainnet only, for now)
 protection without any network requests. At runtime, the extension fetches the
 live list once every 24 hours and keeps only the delta (newly added domains not
 in the vendored list) in memory. This architecture keeps runtime memory usage
 small while ensuring fresh coverage of new phishing domains.
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all
 parent domains (subdomain matching).
 #### Transaction Decoding
 When a dApp asks the user to approve a transaction, AutistMask attempts to
 decode the calldata into a human-readable summary. This is purely a display
 convenience to help the user understand what they are signing — it is not
 endorsement, special treatment, or partnership with any protocol.
 AutistMask is a generic web3 wallet. It treats all dApps, protocols, and
 contracts equally. No contract gets special handling, priority, or integration
 beyond what is needed to show the user a legible confirmation screen. Our
 commitment is to the user, not to any service, site, or contract.
 Decoded transaction summaries are best-effort. If decoding fails, the raw
 calldata is displayed in full. The decoders live in self-contained modules under
 `src/shared/` (e.g. `uniswap.js`) so they can be added for common contracts
 without polluting wallet-specific code. Contributions of decoders for other
 widely-used contracts are welcome.
 Currently supported:
 - **ERC-20**: `approve()` and `transfer()` calls — shows token symbol, spender
  or recipient, and amount.
 - **Uniswap Universal Router**: `execute()` calls — shows swap direction (e.g.
  "Swap USDT → ETH"), token addresses, amounts, execution steps, and deadline.
  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks.
 ### Non-Goals Forever
 - Built in token swaps (use a DEX in the browser)
 - Analytics, telemetry, or tracking of any kind
 - Advertisements or promotions
- Obscure token list auto-discovery (user adds tokens manually)
+- Phishing detection
-    - We detect common/popular ERC20s in the basic case
+- Hardware wallet support (maybe later)
 - Token list auto-discovery (user adds tokens manually)
 - Fiat on/off ramps
- Extensive transaction decoding/parsing
+- Browser notifications
-    - For common ones we will do best-effort, but you should just use a block
+- Transaction history (use Etherscan)
      explorer.
-### Non-Goals for 1.0
+## TODO — 0.1.0 MVP
- Multi-chain support (Ethereum mainnet only)
+Everything needed for a minimal working wallet that can send and receive ETH.
 - Hardware wallet support
-## TODO
+### Done
 - [x] Project scaffolding (Makefile, Dockerfile, CI, manifests, esbuild)
 - [x] Tailwind CSS build pipeline
 - [x] Popup UI shell with screen stacking (Welcome, AddWallet, Home,
      AddressDetail, Send, Receive, Settings)
 - [x] BIP-39 mnemonic generation via ethers.js (die button)
 - [x] BIP-39 mnemonic validation on import
 - [x] BIP-32/BIP-44 HD key derivation (real addresses from xpub)
 - [x] Private key import (real address via ethers.Wallet)
 - [x] Xpub stored unencrypted for read-only address derivation
 - [x] State persistence to extension storage (survives popup close)
 - [x] Live ETH balance fetching via JSON-RPC (`eth_getBalance`)
 - [x] ENS reverse lookup (address → name) and forward resolution (name → address
      in Send field)
 - [x] ETH/USD price fetching via CoinDesk API
 - [x] USD value display next to ETH balances
 - [x] Full address display everywhere (no truncation)
 - [x] Token list module with ~150 ERC-20 tokens ordered by market cap
 ### Wallet Management
- [x] Delete wallet (with confirmation)
+- [ ] Rename wallets (tap wallet name on Home to edit)
 - [ ] Rename addresses (tap address name on AddressDetail to edit)
 - [ ] Delete wallet (with confirmation)
 - [ ] Delete address from HD wallet (with confirmation)
- [ ] Show wallet's recovery phrase (requires password)
+- [ ] Show wallet's recovery phrase (requires password, from Settings or wallet
      context menu)
-### Transactions
+### Sending
 - [x] Encrypt recovery phrase / private key with password via libsodium
      (Argon2id + XSalsa20-Poly1305)
 - [x] Password prompt on Send (decrypt private key to construct transaction)
 - [x] Transaction construction via ethers.js (to, value, gasLimit, gasPrice)
 - [ ] Gas estimation and fee display before confirming
 - [x] Broadcast transaction via `eth_sendRawTransaction`
 - [x] Transaction status feedback (pending → confirmed / failed)
 ### Receiving
 - [x] QR code generation for address (qrcode library, renders to canvas)
 ### Display
 - [ ] Home screen: total ETH balance summed across all addresses
 - [ ] Home screen: total USD value (small text under total ETH)
 - [ ] Cache ETH/USD price for 5 minutes (don't re-fetch on every popup open)
 - [ ] Per-address USD value in small text under ETH balance everywhere
 ### Tokens (ERC-20)
 - [ ] Add token by contract address (fetch name/symbol/decimals from contract)
 - [ ] Display ERC-20 token balances per address
 - [ ] Send ERC-20 tokens
 ### Testing
 - [ ] Tests for mnemonic generation and address derivation
 - [ ] Tests for xpub derivation and child address generation
 - [ ] Tests for token list module (getTopTokenPrices, getTopTokenSymbols)
 - [ ] Test on Chrome (Manifest V3)
 - [ ] Test on Firefox (Manifest V2)
 ### Scam List
- [ ] Research and document each address in scamlist.js
+- [ ] Research and document each address in scamlist.js (what it is, why it's on
- [ ] Add more known fraud addresses from Etherscan labels
+      the list, source)
 - [ ] Add more known fraud addresses from Etherscan labels (drainers, phishing,
      address poisoning deployers)
-### Future
+### Post-MVP
 - [ ] EIP-1193 provider injection (window.ethereum) for web3 site connectivity
 - [ ] Site connection approval flow
 - [ ] Transaction signing approval flow (requests from connected sites)
 - [ ] Message signing (`personal_sign`, `eth_sign`)
 - [ ] Multi-currency fiat display (EUR, GBP, etc.)
 - [ ] Security audit of key management
 ## Policies
 - We don't mention "the other wallet" by name in code or documentation. We're
  our own thing.
 - The README is the complete authoritative technical documentation. It's ok if
  it gets big.
 ## License
 GPL-3.0. See [LICENSE](LICENSE).
 ### Third-Party Data Files
 This repository includes data files from third-party projects that are not
 covered by the GPL-3.0 license above. These files, their copyright holders, and
 their licenses are:
 | File                                                       | Source                                                                                                                    | Copyright                         | License                                                        |
 | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
 | `src/shared/phishingBlocklist.json`                        | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
 | `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`                               | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
 | `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                                         | Copyright (c) 2018 Luit Hollander | MIT                                                            |
 The full license texts for these third-party files are included in the
 [LICENSE](LICENSE) file.
 ## Author
 [@sneak](https://sneak.berlin)
--- a/REPO_POLICIES.md
+++ b/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-02-22
 ---
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,46 +34,10 @@ style conventions are in separate documents:
  every file before committing. There are zero exceptions to this rule.
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  `make hooks` (installs pre-commit hook). A model Makefile is at
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
 - Repos follow the
  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
  pattern: the implementation of each Makefile target lives in an executable
  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
  `script/docker`), and the Makefile targets are thin shims that call them. The
  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
  minimal containers (e.g. alpine images have no bash); locate the repo root
  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
  for development after a fresh clone: runs `bootstrap`, then
  `install-precommit`, plus any repo-specific initialization), `test`, and
  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
  assumes nothing is present: base tools come from nix, apt, brew, or apk
  (detected in that order; apt runs noninteractive). For node it uses the
  installed node if present; otherwise it installs a PINNED node version via
  nvm, first installing nvm itself if missing — from a hash-verified GitHub
  release archive (never `curl | sh`), with bash installed as an explicit
  prerequisite since nvm requires bash. yarn is then pinned via
  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
  always exact versions. `script/cibuild` runs the CI build: it changes to the
  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
  scripts are our own extensions to the standard: `script/check` runs
  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
  what the git pre-commit hook runs, and it calls `script/check`;
  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
  target shims to it); and `script/projectname` (literally that filename) simply
  outputs the project's name. Scripts that need the name call
  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
  so those scripts stay byte-identical across all repos. Repo-type-specific
  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
  `script/precommit`, not in the hook itself. Model scripts are at
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
  must document the provided scripts in an **Entrypoints** section (see the
  README requirements below).
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
  instead of invoking the underlying tools directly. The Makefile is the single
@@ -93,83 +57,11 @@ style conventions are in separate documents:
  as a build step so the build fails if the branch is not green. For non-server
  repos, the Dockerfile should bring up a development environment and run
  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
+  stage before the final image is assembled.
  prerequisites by running `script/bootstrap` rather than duplicating installs
  inline; COPY `script/` and the dependency manifests (`package.json` +
  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
  layer stays cached until dependencies change.
 - **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
  repos use a multistage build where linting runs in an independent stage based
  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
  `make fmt-check` and `make lint` before the full build begins. The build stage
  then declares an explicit dependency on the lint stage via
  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
  linting before proceeding to compilation and tests. This ensures lint failures
  surface in seconds rather than minutes, without blocking on dependency
  download or compilation in the build stage.
    The standard pattern for a Go repo Dockerfile is:
    ```dockerfile
    # Lint stage — fast feedback on formatting and lint issues
    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
    FROM golangci/golangci-lint@sha256:... AS lint
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make fmt-check
    RUN make lint
    # Build stage
    # golang:1.x-alpine, YYYY-MM-DD
    FROM golang@sha256:... AS builder
    WORKDIR /src
    # Force BuildKit to run the lint stage before proceeding
    COPY --from=lint /src/go.sum /dev/null
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make test
    ARG VERSION=dev
    RUN CGO_ENABLED=0 go build -trimpath \
        -ldflags="-s -w -X main.Version=${VERSION}" \
        -o /app ./cmd/app/
    # Runtime stage
    FROM alpine@sha256:...
    COPY --from=builder /app /usr/local/bin/app
    ENTRYPOINT ["app"]
    ```
    Key points:
    - The lint stage uses the `golangci/golangci-lint` image directly (it
      includes both Go and the linter), so there is no need to install the
      linter separately.
    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
      a stage dependency. BuildKit runs stages in parallel by default; without
      this line, the build stage would not wait for lint to finish and a lint
      failure might not fail the overall build.
    - If the project uses `//go:embed` directives that reference build artifacts
      (e.g. a web frontend compiled in a separate stage), the lint stage must
      create placeholder files so the embed directives resolve. Example:
      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
      The lint stage should not depend on the actual build output — it exists to
      fail fast.
    - If the project requires CGO or system libraries for linting (e.g.
      `vips-dev`), install them in the lint stage with `apk add`.
    - The build stage runs `make test` after compilation setup. Tests run in the
      build stage, not the lint stage, because they may require compiled
      artifacts or heavier dependencies.
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  Dockerfile already runs `make check`, a successful build implies all checks
+  a successful build implies all checks pass.
  pass.
 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -177,11 +69,9 @@ style conventions are in separate documents:
  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+- Pre-commit hook: `make check` if local testing is possible, otherwise
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  target to install the pre-commit hook.
  `script/install-precommit`; the Makefile must provide a `make hooks` target
  that shims to it.
 - All repos with software must have tests that run via the platform-standard
  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -192,42 +82,6 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
  Makefile.
 - **`make test` should use the conditional verbose rerun pattern.** Run tests
  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
  show full output. This keeps CI logs and `docker build` output clean on
  success (just package/suite summaries) while providing full diagnostic detail
  on failure (every test case, every assertion). The general shell pattern:
    ```makefile
    test:
    	@<test-command> || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  <test-command-with-v>; exit 1; }
    ```
    Go example:
    ```makefile
    test:
    	@go test -timeout 30s -race -cover ./... || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  go test -timeout 30s -race -v ./...; exit 1; }
    ```
    Python example:
    ```makefile
    test:
    	@python -m pytest || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  python -m pytest -v; exit 1; }
    ```
    The `exit 1` ensures the target always fails after a rerun — the first run
    already proved the tests are broken, so the build must not pass even if a
    flaky test happens to succeed on the second attempt. The rerun exists solely
    for diagnostic output.
 - Docker builds must complete in under 5 minutes.
 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -244,13 +98,6 @@ style conventions are in separate documents:
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
  a new repo.
 - **No build artifacts in version control.** Code-derived data (compiled
  bundles, minified output, generated assets) must never be committed to the
  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
  should generate these at build time. Notable exception: Go protobuf generated
  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
  downloads code but does not execute code generation.
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 - Never force-push to `main`.
@@ -274,76 +121,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
  `PORT`.
 - **HTTP/web services must be hardened for production internet exposure before
  tagging 1.0.** This means full compliance with security best practices
  including, without limitation, all of the following:
    - **Security headers** on every response:
        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
          and `includeSubDomains`.
        - `Content-Security-Policy` (CSP) with a restrictive default policy
          (`default-src 'self'` as a baseline, tightened per-resource as
          needed). Never use `unsafe-inline` or `unsafe-eval` unless
          unavoidable, and document the reason.
        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
          Prefer the `frame-ancestors` CSP directive as the primary control.
        - `X-Content-Type-Options: nosniff`.
        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
        - `Permissions-Policy` restricting access to browser features the
          application does not use (camera, microphone, geolocation, etc.).
    - **Request and response limits:**
        - Maximum request body size enforced on all endpoints (e.g. Go
          `http.MaxBytesReader`). Choose a sane default per-route; never accept
          unbounded input.
        - Maximum response body size where applicable (e.g. paginated APIs).
        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
          against slowloris attacks.
        - `WriteTimeout` on the `http.Server`.
        - `IdleTimeout` on the `http.Server`.
        - Per-handler execution time limits via `context.WithTimeout` or
          chi/stdlib `middleware.Timeout`.
    - **Authentication and session security:**
        - Rate limiting on password-based authentication endpoints. API keys are
          high-entropy and not susceptible to brute force, so they are exempt.
        - CSRF tokens on all state-mutating HTML forms. API endpoints
          authenticated via `Authorization` header (Bearer token, API key) are
          exempt because the browser does not attach these automatically.
        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
          MD5, or SHA.
        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
          `Strict`) attributes.
    - **Reverse proxy awareness:**
        - True client IP detection when behind a reverse proxy
          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
          forwarded headers only from a configured set of trusted proxy
          addresses — never trust `X-Forwarded-For` unconditionally.
    - **CORS:**
        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
          only for public, unauthenticated read-only APIs.
    - **Error handling:**
        - Internal errors must never leak stack traces, SQL queries, file paths,
          or other implementation details to the client. Return generic error
          messages in production; detailed errors only when `DEBUG` is enabled.
    - **TLS:**
        - Services never terminate TLS directly. They are always deployed behind
          a TLS-terminating reverse proxy. The service itself listens on plain
          HTTP. However, HSTS headers and `Secure` cookie flags must still be
          set by the application so that the browser enforces HTTPS end-to-end.
    This list is non-exhaustive. Apply defense-in-depth: if a standard security
    hardening measure exists for HTTP services and is not listed here, it is
    still expected. When in doubt, harden.
 - `README.md` is the primary documentation. Required sections:
    - **Description**: First line must include the project name, purpose,
      category (web server, SPA, CLI tool, etc.), license, and author. Example:
      "µPaaS is an MIT-licensed Go web application by @sneak that receives
      git-frontend webhooks and deploys applications via Docker in realtime."
    - **Getting Started**: Copy-pasteable install/usage code block.
    - **Entrypoints**: Opens by stating that the repo adheres to the
      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
      standard (with that link), then documents each provided `script/`
      entrypoint and its purpose.
    - **Rationale**: Why does this exist?
    - **Design**: How is the program structured?
    - **TODO**: Update meticulously, even between commits. When planning, put
@@ -361,14 +144,8 @@ style conventions are in separate documents:
 - Use SemVer.
 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary.
+  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
-    - `000_migration.sql` — contains ONLY the creation of the migrations
+  Post-1.0.0: add new migration files.
      tracking table itself. Nothing else.
    - `001_schema.sql` — the full application schema.
    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
      There is no installed base to migrate. Edit `001_schema.sql` directly.
    - **Post-1.0.0:** add new numbered migration files for each schema change.
      Never edit existing migrations after release.
 - All repos should have an `.editorconfig` enforcing the project's indentation
  settings.
@@ -398,9 +175,6 @@ style conventions are in separate documents:
    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
    - `Makefile`
    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
      `install-precommit`)
    - `Dockerfile`, `.dockerignore`
    - `.gitea/workflows/check.yml`
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
--- a/RULES.md
+++ b/RULES.md
@@ -1,121 +0,0 @@
 > **⚠️ THIS FILE MUST NEVER BE MODIFIED BY AGENTS.** RULES.md is maintained
 > exclusively by the project owner. AI agents, bots, and automated tools must
 > treat this file as read-only. If an audit finds a divergence between the code
 > and this file, the code must be changed to match — never the other way around.
 # AutistMask Rules Checklist
 This file is derived from README.md and REPO_POLICIES.md for use as an audit
 checklist. The authoritative policies are in those two files. If this file
 contradicts either, the originals govern.
 ---
 ## Cryptography
 - [ ] No raw crypto primitives in application code (`aes`, `sha`, `pbkdf`,
      `hmac`, `encrypt`, `decrypt`, `hash`, `cipher`, `digest`, `sign`)
 - [ ] All crypto goes through `ethers` or `libsodium-wrappers-sumo`
 - [ ] No exceptions without an explicit code comment citing the Crypto Policy
 - [ ] Secrets encrypted at rest with Argon2id + XSalsa20-Poly1305
 - [ ] Password never used in address derivation (encryption only)
 ## External Communication
 - [ ] Extension contacts exactly three external services: configured RPC
      endpoint, CoinDesk price API, and Blockscout block-explorer API
 - [ ] No analytics, telemetry, or tracking
 - [ ] No user-specific data sent except to the configured RPC endpoint
 - [ ] No Infura/Alchemy hard dependency
 - [ ] No backend servers operated by the developer
 - [ ] RPC endpoint is user-configurable (defaults to publicnode.com)
 ## Dependencies
 - [ ] Four runtime libraries only: `ethers`, `libsodium-wrappers-sumo`,
      `qrcode`, `ethereum-blockies-base64`
 - [ ] No JS framework (React, Vue, Svelte, etc.)
 - [ ] All external references pinned by cryptographic hash (per REPO_POLICIES)
 ## Address Display & Anti-Spoofing
 - [ ] Addresses displayed in full in all critical contexts (tx confirmation,
      send confirmation, transaction detail)
 - [ ] `truncateMiddle()` removes at most 10 characters — enforced in code
 - [ ] Caller floor for address truncation is 32 characters minimum
 - [ ] Clicking any address copies the full untruncated value
 - [ ] Known token symbol verification: transfers claiming a known symbol from an
      unrecognized contract are filtered
 - [ ] Tokens with < 1,000 holders hidden from tx history and send selector
 - [ ] Dust transactions below configurable threshold hidden
 - [ ] Fraud contract blocklist applied to tx history
 ## Display Consistency
 - [ ] Token/ETH amounts: exactly 4 decimal places in all summary views
 - [ ] Transaction detail view: exact untruncated amount (full precision)
 - [ ] Transaction detail view: native quantity shown (wei / base units)
 - [ ] Both amount and native quantity are click-copyable
 - [ ] Timestamps: ISO datetime + relative age, everywhere they appear
 - [ ] Same data formatted identically across all screens
 ## No Layout Shift
 - [ ] All async-populated elements have `min-height` or placeholder content
 - [ ] `formatUsd(null)` returns `""` — callers must use `&nbsp;` fallback
 - [ ] `visibility: hidden` preferred over `display: none` when space must be
      preserved
 - [ ] No UI element moves when async data (prices, balances, tx lists) arrives
 ## Clickable Affordance
 - [ ] Every button has visible border, padding, and hover state
 - [ ] Every clickable text element has underline or dashed underline
 - [ ] No invisible hit targets
 ## DEBUG Mode
 - [ ] DEBUG mode only enables: red banner + hardcoded test mnemonic
 - [ ] No `if (DEBUG)` branches that skip functionality or bypass security
 - [ ] New DEBUG conditionals require explicit project owner approval
 ## Transaction Decoding
 - [ ] Decoding is best-effort display convenience only
 - [ ] No protocol gets special handling beyond the confirmation screen
 - [ ] If decoding fails, raw calldata displayed in full (not truncated)
 - [ ] Decoders are self-contained modules in `src/shared/`
 ## Approval Flow
 - [ ] Site connection: explicit user approval via popup
 - [ ] Transaction signing: password required, decoded details shown
 - [ ] Message signing: password required, message content shown
 - [ ] Typed data signing: password required, domain/type/message fields shown
 - [ ] Rejected approvals return EIP-1193 error code 4001
 - [ ] TX and sign approvals persist across popup close/reopen (toolbar popup)
 ## Secrets & Storage
 - [ ] Public data (xpubs, addresses, balances) stored unencrypted
 - [ ] Private data (recovery phrases, private keys) encrypted at rest
 - [ ] Password only required for signing operations
 - [ ] No secrets in `.env`, credentials, or API keys committed to repo
 - [ ] `git add -A` / `git add .` never used
 ## Build & Workflow
 - [ ] All tool invocations via `make` targets, never directly
 - [ ] `make check` = `make test` + `make lint` + `make fmt-check`
 - [ ] `main` always passes `make check`
 - [ ] Feature branches for all changes, merge to main when done
 - [ ] No force-push to `main`
 - [ ] Pre-commit hook runs `make check`
 ## Language & Labeling
 - [ ] "Recovery phrase" not "seed phrase" or "mnemonic"
 - [ ] "Address" not "account" or "derived key"
 - [ ] "Password" not "encryption key" or "vault passphrase"
 - [ ] Error messages are full sentences
 - [ ] No competitor mentioned by name in code or documentation
--- a/TODO.md
+++ b/TODO.md
@@ -1,116 +0,0 @@
 # Workflow
 - `git pull` `next` and cut a branch from it — one branch per issue, named
  `issue-<N>-<slug>`. Never branch from `main`.
 - Do the work as one commit whose title ends with ` (closes #N)`, with the
  `TODO.md` update in that same commit.
 - Move Next Step to the top of Completed Steps; move the top item of Future
  Steps into Next Step.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
  `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on
  `next` continuously — and re-run `make check` after resolving, because a clean
  textual merge can still break the build.
 - Push the branch and open one PR per issue with base `next`. Never base `main`.
 - An independent reviewer who did not write the change gates the merge. On a
  passed review the PR is squash-merged into `next`.
 - `next` is the branch for the next milestone. It is kept green and mergeable to
  `main` at any moment, without notice.
 - `main` receives exactly one PR per milestone, from `next`. Releases are tagged
  from `main`.
 # Status
 pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
 milestone is in flight on `next`; its `next` -> `main` PR is
 [#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
 green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
 `dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
 compiled off.
 The backlog lives on the
 [Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
 authoritative; this file does not duplicate it. Full policy file set present. A
 real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
 which cannot see a runtime `ReferenceError` in a popup view.
 # Next Step
 Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
 `script/lint`. `make check` is `prettier --check` only today and cannot catch
 undefined identifiers, which is how
 [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
 [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
 # Completed Steps
 - 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
  fallback at 20x the Argon2id cost, pinned in both directions by
  `tests/manifest.test.js` and observed in the real popup by the e2e suite
  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
 - 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
  remaining wallets, the selection only moves when it was deleted, and the
  active-address change is broadcast to connected sites
  ([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
 - 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
  on `next`, with Status and Next Step refreshed
  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
 - 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
  as the `__BUILD_DEBUG__` esbuild define and turned on with
  `AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
  created wallet the publicly committed test recovery phrase
  ([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
 - 2026-08-09: dApp approval signing moved into the popup — the password no
  longer crosses the extension messaging boundary; the background broadcasts and
  resolves approvals only, and verifies the signed artifact against the approval
  it holds (#157).
 - 2026-08-09: Post-build assertion that every emitted bundle containing
  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
  `make build` path (#170).
 - 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
  `script/test-e2e`) driving the real popup with all network intercepted, plus
  the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
  and TransactionDetail broken for every ERC-20 transfer (#151). Harness
  demonstrated failing before the fixes and passing after (#181). Interception
  covers the MV3 background service worker, not just the popup page, and a
  launch-time canary aborts the suite if worker traffic starts escaping.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
  (#149-#168).
 - 2026-08-09: Test coverage for the address-poisoning defense in
  `src/shared/transactions.js` (#160)
 - 2026-07-26: About well in settings with build info, repo link and the version
  click easter egg (#145); proper view navigation stack (#146).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
  shims, README Entrypoints section (#148)
 - 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
  in approve-tx view (#141).
 - Sepolia testnet support (#137); etherscan links go to token-specific URLs
  (#136).
 - Transaction detail improvements: Type field and on-chain details (#130),
  txid-first reordering (#133), swap display corrections (#128), expanded
  confirm-tx warnings (#118).
 - Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
  timestamps include timezone offset (#120); layout shift audit, reserved space
  for error messages (#124).
 - Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
  duplicate detection (#115).
 - 2026-02-27: v0.1.0 tagged.
 - 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
  ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
  reverse resolution.
 # Future Steps
 Only work that has no issue of its own belongs here; everything else is on the
 tracker.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
  input validation) before any 1.0rc tag. Individual filed issues are parts of
  it, but the review is broader than any of them.
 - Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
  workflow. Extending the suite itself is tracked as
  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
  [#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
  land.
--- a/build.js
+++ b/build.js
@@ -3,168 +3,75 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
-const DIST = path.join(__dirname, "dist");
+const DIST_CHROME = path.join(__dirname, "dist", "chrome");
-const DIST_CHROME = path.join(DIST, "chrome");
+const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
 const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 // The module whose compiled DEBUG state script/verify-build asserts, and the
 // manifest naming every emitted bundle that ends up containing it. The
 // manifest is derived from esbuild's own dependency graph rather than from a
 // hardcoded list, so it tracks the bundle layout instead of rotting with it.
 const AUDITED_MODULE = "src/shared/constants.js";
 const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
 function ensureDir(dir) {
    fs.mkdirSync(dir, { recursive: true });
 }
 // Repo-relative, forward-slashed, so the manifest reads the same on every
 // platform and can be consumed by a POSIX shell script without further work.
 function repoRelative(p) {
    return path.relative(__dirname, p).split(path.sep).join("/");
 }
 // Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
 // reports every input that contributed to an output in the metafile, which is
 // the authoritative answer to "is constants.js in this bundle" — unlike
 // searching the minified text, it does not depend on what survived minification.
 function outputsContainingAuditedModule(metafile) {
    return Object.entries(metafile.outputs)
        .filter(([outFile, info]) => {
            if (!outFile.endsWith(".js")) return false;
            return Object.keys(info.inputs).some(
                (input) => repoRelative(input) === AUDITED_MODULE,
            );
        })
        .map(([outFile]) => repoRelative(outFile));
 }
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
 // produces a release build. Failing towards the safe mode is deliberate.
 function isDebugBuild() {
    return process.env.AUTISTMASK_DEBUG === "1";
 }
 function getBuildInfo() {
    const pkg = JSON.parse(
        fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
    );
    let commitHash = "unknown";
    try {
        commitHash = execSync("git rev-parse --short HEAD", {
            encoding: "utf8",
        }).trim();
    } catch (_) {
        // not a git repo or git not available
    }
    let commitHashFull = "unknown";
    try {
        commitHashFull = execSync("git rev-parse HEAD", {
            encoding: "utf8",
        }).trim();
    } catch (_) {
        // not a git repo or git not available
    }
    return {
        version: pkg.version,
        license: pkg.license,
        author: pkg.author,
        commitHash,
        commitHashFull,
        buildDate: new Date().toISOString().slice(0, 10),
    };
 }
 async function build() {
    console.log("Building AutistMask extension...");
    const buildInfo = getBuildInfo();
    console.log("Build info:", buildInfo);
    const debugBuild = isDebugBuild();
    console.log(
        debugBuild
            ? "Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)"
            : "Build mode: release (DEBUG off)",
    );
    const define = {
        __BUILD_DEBUG__: JSON.stringify(debugBuild),
        __BUILD_VERSION__: JSON.stringify(buildInfo.version),
        __BUILD_LICENSE__: JSON.stringify(buildInfo.license),
        __BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
        __BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
        __BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
        __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
    };
    // Emitted bundles that contain constants.js, accumulated across every
    // esbuild run below and written out for script/verify-build.
    const auditedBundles = [];
    // compile tailwind CSS
    console.log("Compiling Tailwind CSS...");
    const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(DIST, "styles.css");
+    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
-    ensureDir(DIST);
+    ensureDir(path.join(__dirname, "dist"));
    // Drop any manifest from a previous build before emitting anything, so a
    // build that never gets around to writing one cannot be verified against
    // a stale list.
    fs.rmSync(BUNDLE_MANIFEST, { force: true });
    execSync(
        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
        { stdio: "inherit" },
    );
    // Every bundle goes through here, so metafile collection cannot be
    // forgotten when a new entry point is added.
    async function bundle(entryPoint, outfile) {
        const result = await esbuild.build({
            entryPoints: [entryPoint],
            bundle: true,
            format: "iife",
            outfile,
            platform: "browser",
            target: ["chrome110", "firefox110"],
            minify: true,
            metafile: true,
            define,
        });
        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
    }
    for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
        ensureDir(path.join(distDir, "src", "popup"));
        ensureDir(path.join(distDir, "src", "background"));
        ensureDir(path.join(distDir, "src", "content"));
        // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "popup", "index.js"),
+            entryPoints: [path.join(SRC, "popup", "index.js")],
-            path.join(distDir, "src", "popup", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
            outfile: path.join(distDir, "src", "popup", "index.js"),
            platform: "browser",
            target: ["chrome110", "firefox110"],
            minify: true,
        });
        // bundle background script
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "background", "index.js"),
+            entryPoints: [path.join(SRC, "background", "index.js")],
-            path.join(distDir, "src", "background", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
            outfile: path.join(distDir, "src", "background", "index.js"),
            platform: "browser",
            target: ["chrome110", "firefox110"],
            minify: true,
        });
        // bundle content script
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "content", "index.js"),
+            entryPoints: [path.join(SRC, "content", "index.js")],
-            path.join(distDir, "src", "content", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
            outfile: path.join(distDir, "src", "content", "index.js"),
            platform: "browser",
            target: ["chrome110", "firefox110"],
            minify: true,
        });
        // bundle inpage script (injected into page context, separate file)
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "content", "inpage.js"),
+            entryPoints: [path.join(SRC, "content", "inpage.js")],
-            path.join(distDir, "src", "content", "inpage.js"),
+            bundle: true,
-        );
+            format: "iife",
            outfile: path.join(distDir, "src", "content", "inpage.js"),
            platform: "browser",
            target: ["chrome110", "firefox110"],
            minify: true,
        });
        // copy popup HTML
        fs.copyFileSync(
@@ -189,16 +96,6 @@ async function build() {
        path.join(DIST_FIREFOX, "manifest.json"),
    );
    // Written last so a build that died partway through leaves no manifest
    // at all, which script/verify-build treats as a hard failure rather than
    // as "nothing to check".
    const manifest = [...new Set(auditedBundles)].sort();
    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
    console.log(
        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
    );
    console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
--- a/manifest/chrome.json
+++ b/manifest/chrome.json
@@ -5,9 +5,6 @@
    "description": "Minimal Ethereum wallet for Chrome",
    "permissions": ["storage", "activeTab"],
    "host_permissions": ["<all_urls>"],
    "content_security_policy": {
        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
    },
    "action": {
        "default_popup": "src/popup/index.html"
    },
--- a/manifest/firefox.json
+++ b/manifest/firefox.json
@@ -4,7 +4,6 @@
    "version": "0.1.0",
    "description": "Minimal Ethereum wallet for Firefox",
    "permissions": ["storage", "activeTab", "<all_urls>"],
    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
    "browser_action": {
        "default_popup": "src/popup/index.html"
    },
--- a/package.json
+++ b/package.json
@@ -16,7 +16,6 @@
        "@tailwindcss/cli": "^4.2.1",
        "esbuild": "^0.27.3",
        "jest": "^30.2.0",
        "playwright-core": "1.56.0",
        "prettier": "^3.8.1",
        "tailwindcss": "^4.2.1"
    },
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -1,143 +0,0 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present. Node is
 # used directly if installed; otherwise it is installed at a pinned
 # version via nvm (installing nvm itself first, from a hash-verified
 # release archive, never curl | sh).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Pinned versions, 2026-07-07
 NODE_VERSION="22.17.0"
 NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
 YARN_VERSION="1.22.22"
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
 detect_pkgmgr() {
    [ -n "$PKGMGR" ] && return 0
    if command -v nix-env >/dev/null 2>&1; then
        PKGMGR="nix"
    elif command -v apt-get >/dev/null 2>&1; then
        PKGMGR="apt"
    elif command -v brew >/dev/null 2>&1; then
        PKGMGR="brew"
    elif command -v apk >/dev/null 2>&1; then
        PKGMGR="apk"
    else
        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
        exit 1
    fi
    if [ "$PKGMGR" = "apt" ]; then
        export DEBIAN_FRONTEND=noninteractive
        if [ "$(id -u)" != "0" ]; then
            SUDO="sudo"
        fi
    fi
 }
 # pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
 pkg_install() {
    detect_pkgmgr
    case "$PKGMGR" in
        nix) nix-env -iA "nixpkgs.$1" ;;
        apt)
            if [ -z "$APT_UPDATED" ]; then
                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
                APT_UPDATED=1
            fi
            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
            ;;
        brew) brew install "$3" ;;
        apk) apk add --no-cache "$4" ;;
    esac
 }
 missing() {
    ! command -v "$1" >/dev/null 2>&1
 }
 # verify_sha256 <file> <expected-hash>
 verify_sha256() {
    if command -v sha256sum >/dev/null 2>&1; then
        actual="$(sha256sum "$1" | cut -d' ' -f1)"
    else
        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
    fi
    if [ "$actual" != "$2" ]; then
        echo "bootstrap: sha256 mismatch for $1" >&2
        echo "  expected: $2" >&2
        echo "  actual:   $actual" >&2
        exit 1
    fi
 }
 # nvm is a bash script; run a command in a bash with nvm loaded
 nvm_sh() {
    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
 }
 ensure_nvm() {
    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
    # nvm prerequisites; nvm itself requires bash
    if missing bash; then pkg_install bash bash bash bash; fi
    if missing curl; then pkg_install curl curl curl curl; fi
    if missing git; then pkg_install git git git git; fi
    tmp="$(mktemp -d)"
    curl -fsSL -o "$tmp/nvm.tar.gz" \
        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
    mkdir -p "$HOME/.nvm"
    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
    rm -rf "$tmp"
 }
 ensure_node() {
    if ! missing node; then return 0; fi
    ensure_nvm
    nvm_sh "nvm install $NODE_VERSION"
 }
 ensure_yarn() {
    if ! missing yarn; then return 0; fi
    if ! missing corepack; then
        corepack enable
        corepack prepare "yarn@$YARN_VERSION" --activate
    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
            corepack prepare yarn@$YARN_VERSION --activate"
    else
        npm install -g "yarn@$YARN_VERSION"
    fi
 }
 install_js_deps() {
    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
            yarn install --frozen-lockfile"
    else
        yarn install --frozen-lockfile
    fi
 }
 main() {
    cd "$ROOT"
    if missing make; then pkg_install gnumake make make make; fi
    if missing git; then pkg_install git git git git; fi
    ensure_node
    ensure_yarn
    install_js_deps
    echo "bootstrap complete"
 }
 main "$@"
--- a/script/check
+++ b/script/check
@@ -1,14 +0,0 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
 # extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
    "$SCRIPT_DIR/test"
    "$SCRIPT_DIR/lint"
    "$SCRIPT_DIR/fmt-check"
 }
 main "$@"
--- a/script/cibuild
+++ b/script/cibuild
@@ -1,13 +0,0 @@
 #!/bin/sh
 # script/cibuild: run the CI build. The Dockerfile runs make check, so
 # a successful build implies all checks pass.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    docker build .
 }
 main "$@"
--- a/script/docker
+++ b/script/docker
@@ -1,14 +0,0 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
    docker build -t "$("$SCRIPT_DIR/projectname")" .
 }
 main "$@"
--- a/script/fmt
+++ b/script/fmt
@@ -1,13 +0,0 @@
 #!/bin/sh
 # script/fmt: format all files (writes).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    echo "Formatting..."
    yarn run fmt 2>&1
 }
 main "$@"
--- a/script/fmt-check
+++ b/script/fmt-check
@@ -1,14 +0,0 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Same scope as
 # script/fmt, but fails instead of writing.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    echo "Checking formatting..."
    yarn run fmt-check 2>&1
 }
 main "$@"
--- a/script/install-precommit
+++ b/script/install-precommit
@@ -1,16 +0,0 @@
 #!/bin/sh
 # script/install-precommit: install the git pre-commit hook that runs
 # script/precommit. Our own extension to scripts-to-rule-them-all.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    hook=".git/hooks/pre-commit"
    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
    chmod +x "$hook"
    echo "pre-commit hook installed: runs script/precommit"
 }
 main "$@"
--- a/script/lint
+++ b/script/lint
@@ -1,13 +0,0 @@
 #!/bin/sh
 # script/lint: run the linter.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    echo "Linting..."
    yarn run lint 2>&1
 }
 main "$@"
--- a/script/precommit
+++ b/script/precommit
@@ -1,12 +0,0 @@
 #!/bin/sh
 # script/precommit: run by the git pre-commit hook; fails the commit if
 # checks fail. Our own extension to scripts-to-rule-them-all.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
    "$SCRIPT_DIR/check"
 }
 main "$@"
--- a/script/projectname
+++ b/script/projectname
@@ -1,12 +0,0 @@
 #!/bin/sh
 # script/projectname: output the name of this project. Our own
 # extension to scripts-to-rule-them-all. Other scripts that need the
 # name (e.g. script/docker) call this, so they can stay identical
 # across all repos.
 set -eu
 main() {
    echo "autistmask"
 }
 main "$@"
--- a/script/setup
+++ b/script/setup
@@ -1,13 +0,0 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
 # installs dependencies and the git pre-commit hook.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
    "$SCRIPT_DIR/bootstrap"
    "$SCRIPT_DIR/install-precommit"
 }
 main "$@"
--- a/script/test
+++ b/script/test
@@ -1,13 +0,0 @@
 #!/bin/sh
 # script/test: run the test suite.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    echo "Running tests..."
    timeout 30 yarn run test 2>&1
 }
 main "$@"
--- a/script/test-e2e
+++ b/script/test-e2e
@@ -1,64 +0,0 @@
 #!/bin/sh
 # script/test-e2e: build the extension and drive the real popup in a real
 # Chromium inside a pinned container. Our own extension to
 # scripts-to-rule-them-all.
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
 # a used-but-not-imported identifier blow up at runtime.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
 #
 # The playwright-core devDependency is pinned to the matching Playwright
 # version (1.56.0) and the two must be bumped together: the browsers ship
 # inside this image, and playwright-core looks for the exact browser
 # revision its own version expects. A mismatch fails at launch.
 IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
 main() {
    cd "$ROOT"
    if ! command -v docker >/dev/null 2>&1; then
        echo "test-e2e: docker is required to run the e2e suite" >&2
        exit 1
    fi
    echo "Building extension for e2e..."
    yarn run build 2>&1
    echo "Running e2e suite in the pinned Playwright container..."
    # --ipc=host: Chromium's shared-memory needs more than the default
    #   64MB /dev/shm or renderers crash.
    # --user: keep files the suite touches owned by the caller, not root.
    # HOME=/tmp: the mapped uid has no home directory in the image.
    # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
    #   ctx.route() intercepts page requests only, and every fetch made by
    #   the MV3 background service worker — including the phishing
    #   blocklist fetch that src/background/index.js issues at worker
    #   startup — goes to the real internet. The flag is experimental and
    #   Playwright may drop or rename it. It cannot break silently: the
    #   harness probes service-worker interception at launch and aborts
    #   the whole suite if it is not in effect (see the interception
    #   canary in tests/e2e/harness.js). If a future Playwright removes
    #   the flag, that probe is what will fail, and the fix is either a
    #   replacement mechanism or an honest downgrade of the isolation
    #   claim in tests/e2e/network.js and README.md — not deleting the
    #   probe. The image is pinned by digest, so this can only ever bite
    #   on a deliberate bump.
    docker run --rm \
        --ipc=host \
        --user "$(id -u):$(id -g)" \
        -e HOME=/tmp \
        -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
        -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
        -v "$ROOT:/work" \
        -w /work \
        "$IMAGE" \
        node tests/e2e/run.js
 }
 main "$@"
--- a/script/verify-build
+++ b/script/verify-build
@@ -1,136 +0,0 @@
 #!/bin/sh
 # script/verify-build: assert the compiled DEBUG state of the emitted
 # bundles. Our own extension to scripts-to-rule-them-all, run at the end of
 # make build / make build-debug.
 #
 # Why this exists: DEBUG makes the publicly committed test recovery phrase the
 # output of wallet creation, so a release artifact built with it live hands
 # every new wallet to anyone who reads the repo. The test suite cannot see
 # this, because it loads src/shared/constants.js outside a bundle and takes
 # the fallback branch; the property only exists in the emitted output, so it
 # has to be asserted against the emitted output.
 #
 # What it reads: dist/constants-bundles.txt, written by build.js from
 # esbuild's metafile, naming every emitted bundle that contains
 # src/shared/constants.js. Each of those must carry exactly one of the two
 # BUILD_DEBUG_MARKER literals that constants.js folds down to.
 #
 # It fails rather than passes whenever it cannot determine a bundle's state.
 # Minified output is not a stable contract, so "matched neither form" is not
 # evidence of anything and must never read as green.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 MANIFEST="dist/constants-bundles.txt"
 MARKER_ON="autistmask-build-debug=on"
 MARKER_OFF="autistmask-build-debug=off"
 # Set by read_marker.
 MARKER=""
 fail() {
    echo "verify-build: FAIL: $*" >&2
    exit 1
 }
 has_marker() {
    grep -q -F "$1" "$2" 2>/dev/null
 }
 # Read one bundle's DEBUG state into MARKER. Exactly one marker must be
 # present. Both means the ternary in constants.js was never folded, which is
 # what happens when the __BUILD_DEBUG__ define goes missing from build.js:
 # DEBUG stops being known at build time and the debug branch is live again.
 # Neither means we are reading output we do not understand. Both are hard
 # failures; neither is ever treated as absence of a problem.
 read_marker() {
    _file="$1"
    _on=no
    _off=no
    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
        fail "$_file carries both debug markers, so the build-time DEBUG value
    was never resolved and the debug branch is still live. Check that build.js
    still defines __BUILD_DEBUG__."
    fi
    if [ "$_on" = no ] && [ "$_off" = no ]; then
        fail "$_file carries no debug marker, so its DEBUG state cannot be
    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
    or the emitted output changed shape. Refusing to report success."
    fi
    if [ "$_on" = yes ]; then
        MARKER="$MARKER_ON"
    else
        MARKER="$MARKER_OFF"
    fi
 }
 # The manifest says which bundles must carry a marker. This says no other
 # emitted bundle may carry one, which catches a manifest that has gone stale
 # or short rather than trusting whatever it happens to list.
 check_unlisted_bundles() {
    _listing="$(find dist -type f -name '*.js' | sort)"
    while read -r _file; do
        [ -n "$_file" ] || continue
        if grep -q -x -F "$_file" "$MANIFEST"; then
            continue
        fi
        if has_marker "$MARKER_ON" "$_file" ||
            has_marker "$MARKER_OFF" "$_file"; then
            fail "$_file carries a debug marker but is absent from $MANIFEST,
    so the manifest no longer describes the emitted bundles."
        fi
    done <<EOF
 $_listing
 EOF
 }
 # The requested mode, read from our own environment using build.js's exact
 # rule: only the literal 1 opts in. Deliberately not taken from anything
 # build.js records about itself, so build.js cannot vouch for build.js.
 expected_marker() {
    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
        echo "$MARKER_ON"
    else
        echo "$MARKER_OFF"
    fi
 }
 main() {
    cd "$ROOT"
    expected="$(expected_marker)"
    echo "Verifying emitted bundles (expecting $expected)..."
    [ -f "$MANIFEST" ] ||
        fail "$MANIFEST is missing. build.js writes it at the end of a
    successful build; run make build first."
    [ -s "$MANIFEST" ] ||
        fail "$MANIFEST is empty, so no emitted bundle was found to contain
    src/shared/constants.js. That is never correct, so it is a failure and not
    a pass."
    count=0
    while read -r file; do
        [ -n "$file" ] || continue
        [ -f "$file" ] ||
            fail "$MANIFEST lists $file, which does not exist."
        read_marker "$file"
        [ "$MARKER" = "$expected" ] ||
            fail "$file is $MARKER but this build expects $expected."
        echo "  ok: $file ($MARKER)"
        count=$((count + 1))
    done <"$MANIFEST"
    [ "$count" -gt 0 ] || fail "no bundles were inspected."
    check_unlisted_bundles
    echo "verify-build: $count bundle(s) verified $expected"
 }
 main "$@"
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -2,23 +2,16 @@
 // Handles EIP-1193 RPC requests from content scripts and proxies
 // non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
 const { DEFAULT_RPC_URL } = require("../shared/constants");
 const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
 const { onChainSwitch } = require("../shared/chainSwitch");
 const {
-    state,
+    ETHEREUM_MAINNET_CHAIN_ID,
-    loadState,
+    DEFAULT_RPC_URL,
-    saveState,
+} = require("../shared/constants");
-    currentNetwork,
+const { getBytes } = require("ethers");
-} = require("../shared/state");
+const { state, loadState, saveState } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
 const { debugFetch } = require("../shared/log");
-const { verifySignedTx, verifySignature } = require("../shared/approvalVerify");
+const { decryptWithPassword } = require("../shared/vault");
-const {
+const { getSignerForAddress } = require("../shared/wallet");
    isPhishingDomain,
    updatePhishingList,
    startPeriodicRefresh,
 } = require("../shared/phishingDomains");
 const storageApi =
    typeof browser !== "undefined"
@@ -37,6 +30,7 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 let nextApprovalId = 1;
 async function getState() {
    const result = await storageApi.get("autistmask");
@@ -100,13 +94,11 @@ function resetPopupUrl() {
    }
 }
-// Open approval in a separate popup window.
+// Fallback: open approval in a separate window (used when openPopup is unavailable)
 // This is the primary mechanism for tx/sign approvals (triggered programmatically,
 // not from a user gesture) and the fallback for site-connection approvals.
 function openApprovalWindow(id) {
    const popupUrl = runtime.getURL("src/popup/index.html?approval=" + id);
-    const popupWidth = 360;
+    const popupWidth = 400;
-    const popupHeight = 600;
+    const popupHeight = 500;
    windowsApi.getLastFocused((currentWin) => {
        const opts = {
@@ -135,7 +127,7 @@ function openApprovalWindow(id) {
 // Prefers the browser-action popup (anchored to toolbar, no macOS Space switch).
 function requestApproval(origin, hostname) {
    return new Promise((resolve) => {
-        const id = crypto.randomUUID();
+        const id = nextApprovalId++;
        pendingApprovals[id] = { origin, hostname, resolve };
        if (actionApi && typeof actionApi.openPopup === "function") {
@@ -157,12 +149,9 @@ function requestApproval(origin, hostname) {
 }
 // Open a tx-approval popup and return a promise that resolves with txHash or error.
 // Uses windows.create() directly because tx approvals are triggered programmatically
 // (from a dApp RPC call), not from a user gesture, so action.openPopup() is
 // unreliable in this context.
 function requestTxApproval(origin, hostname, txParams) {
    return new Promise((resolve) => {
-        const id = crypto.randomUUID();
+        const id = nextApprovalId++;
        pendingApprovals[id] = {
            origin,
            hostname,
@@ -171,17 +160,30 @@ function requestTxApproval(origin, hostname, txParams) {
            type: "tx",
        };
-        openApprovalWindow(id);
+        if (actionApi && typeof actionApi.openPopup === "function") {
            actionApi.setPopup({
                popup: "src/popup/index.html?approval=" + id,
            });
            try {
                const result = actionApi.openPopup();
                if (result && typeof result.catch === "function") {
                    result.catch(() => openApprovalWindow(id));
                }
            } catch {
                openApprovalWindow(id);
            }
        } else {
            openApprovalWindow(id);
        }
    });
 }
 // Open a sign-approval popup and return a promise that resolves with { signature } or { error }.
-// Uses windows.create() directly because sign approvals are triggered programmatically
+// Uses the toolbar popup only — no fallback window.  If openPopup() fails the
-// (from a dApp RPC call), not from a user gesture, so action.openPopup() is
+// popup URL is still set, so the user can click the toolbar icon to respond.
 // unreliable in this context.
 function requestSignApproval(origin, hostname, signParams) {
    return new Promise((resolve) => {
-        const id = crypto.randomUUID();
+        const id = nextApprovalId++;
        pendingApprovals[id] = {
            origin,
            hostname,
@@ -190,25 +192,47 @@ function requestSignApproval(origin, hostname, signParams) {
            type: "sign",
        };
-        openApprovalWindow(id);
+        if (actionApi && typeof actionApi.setPopup === "function") {
            actionApi.setPopup({
                popup: "src/popup/index.html?approval=" + id,
            });
        }
        if (actionApi && typeof actionApi.openPopup === "function") {
            try {
                const result = actionApi.openPopup();
                if (result && typeof result.catch === "function") {
                    result.catch(() => {});
                }
            } catch {
                // openPopup unsupported — user clicks toolbar icon
            }
        }
    });
 }
 // Detect when an approval popup (browser-action) closes without a response.
-// TX and sign approvals now use windows.create() and are handled by the
+// Sign approvals are NOT auto-rejected on disconnect because toolbar popups
-// windowsApi.onRemoved listener below, but we still handle site-connection
+// naturally close on focus loss and the user can reopen them.
 // approval disconnects here.
 runtime.onConnect.addListener((port) => {
    if (port.name.startsWith("approval:")) {
-        const id = port.name.split(":")[1];
+        const id = parseInt(port.name.split(":")[1], 10);
        port.onDisconnect.addListener(() => {
            const approval = pendingApprovals[id];
            if (approval) {
-                if (approval.type === "tx" || approval.type === "sign") {
+                if (approval.type === "sign") {
                    // Keep pending — user can reopen the toolbar popup
                    return;
                }
-                approval.resolve({ approved: false, remember: false });
+                if (approval.type === "tx") {
                    approval.resolve({
                        error: {
                            code: 4001,
                            message: "User rejected the request.",
                        },
                    });
                } else {
                    approval.resolve({ approved: false, remember: false });
                }
                delete pendingApprovals[id];
            }
            resetPopupUrl();
@@ -331,43 +355,31 @@ async function handleRpc(method, params, origin) {
    }
    if (method === "eth_chainId") {
-        return { result: currentNetwork().chainId };
+        return { result: ETHEREUM_MAINNET_CHAIN_ID };
    }
    if (method === "net_version") {
-        return { result: currentNetwork().networkVersion };
+        return { result: "1" };
    }
    if (method === "wallet_switchEthereumChain") {
        const chainId = params?.[0]?.chainId;
-        if (chainId === currentNetwork().chainId) {
+        if (chainId === ETHEREUM_MAINNET_CHAIN_ID) {
            return { result: null };
        }
        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
            const target = networkByChainId(chainId);
            await onChainSwitch(target.id);
            broadcastChainChanged(target.chainId);
            return { result: null };
        }
        return {
            error: {
                code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
            },
        };
    }
    if (method === "wallet_addEthereumChain") {
        const chainId = params?.[0]?.chainId;
        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
            return { result: null };
        }
        return {
            error: {
                code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
            },
        };
    }
@@ -438,13 +450,6 @@ async function handleRpc(method, params, origin) {
                ? { method, message: params[0], from: params[1] }
                : { method, message: params[1], from: params[0] };
        if (method === "eth_sign") {
            signParams.dangerWarning =
                "\u26a0\ufe0f DANGER: This site is requesting to sign a raw hash. " +
                "This can be used to sign transactions that drain your funds. " +
                "Only proceed if you fully understand what you are signing.";
        }
        const decision = await requestSignApproval(
            origin,
            hostname,
@@ -513,27 +518,6 @@ async function handleRpc(method, params, origin) {
    return { error: { message: "Unsupported method: " + method } };
 }
 // Broadcast chainChanged to all tabs when the network is switched.
 function broadcastChainChanged(chainId) {
    tabsApi.query({}, (tabs) => {
        for (const tab of tabs) {
            tabsApi.sendMessage(
                tab.id,
                {
                    type: "AUTISTMASK_EVENT",
                    eventName: "chainChanged",
                    data: chainId,
                },
                () => {
                    if (runtime.lastError) {
                        // expected for tabs without our content script
                    }
                },
            );
        }
    });
 }
 // Broadcast accountsChanged to all tabs, respecting per-address permissions
 async function broadcastAccountsChanged() {
    // Clear non-remembered approvals on address switch
@@ -542,13 +526,7 @@ async function broadcastAccountsChanged() {
    }
    // Reject and close any pending approval popups so they don't hang
    for (const [id, approval] of Object.entries(pendingApprovals)) {
-        if (approval.type === "tx" || approval.type === "sign") {
+        approval.resolve({ approved: false, remember: false });
            approval.resolve({
                error: { code: 4001, message: "User rejected the request." },
            });
        } else {
            approval.resolve({ approved: false, remember: false });
        }
        if (approval.windowId) {
            windowsApi.remove(approval.windowId, () => {
                if (runtime.lastError) {
@@ -611,11 +589,6 @@ async function backgroundRefresh() {
 setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL);
 // Fetch the phishing domain blocklist delta on startup and refresh every 24h.
 // The vendored blocklist is bundled at build time; this fetches only new entries.
 updatePhishingList();
 startPeriodicRefresh();
 // When approval window is closed without a response, treat as rejection
 if (windowsApi && windowsApi.onRemoved) {
    windowsApi.onRemoved.addListener((windowId) => {
@@ -640,39 +613,12 @@ if (windowsApi && windowsApi.onRemoved) {
 // Listen for messages from content scripts and popup
 runtime.onMessage.addListener((msg, sender, sendResponse) => {
    if (msg.type === "AUTISTMASK_RPC") {
-        // Derive origin from trusted sender info to prevent origin spoofing.
+        handleRpc(msg.method, msg.params, msg.origin).then((response) => {
        // Chrome MV3 provides sender.origin; Firefox MV2 fallback uses sender.tab.url.
        let trustedOrigin = msg.origin; // fallback only if sender info unavailable
        if (sender.origin) {
            trustedOrigin = sender.origin;
        } else if (sender.tab && sender.tab.url) {
            try {
                trustedOrigin = new URL(sender.tab.url).origin;
            } catch {
                // keep fallback
            }
        }
        handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
            sendResponse(response);
        });
        return true;
    }
    // Validate that popup-only messages originate from the extension itself.
    const POPUP_ONLY_TYPES = [
        "AUTISTMASK_GET_APPROVAL",
        "AUTISTMASK_APPROVAL_RESPONSE",
        "AUTISTMASK_TX_RESPONSE",
        "AUTISTMASK_SIGN_RESPONSE",
    ];
    if (POPUP_ONLY_TYPES.includes(msg.type)) {
        const extUrl = runtime.getURL("");
        if (!sender.url || !sender.url.startsWith(extUrl)) {
            sendResponse({ error: "Unauthorized sender" });
            return false;
        }
    }
    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
        const approval = pendingApprovals[msg.id];
        if (approval) {
@@ -688,8 +634,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                resp.type = "sign";
                resp.signParams = approval.signParams;
            }
            // Flag if the requesting domain is on the phishing blocklist.
            resp.isPhishingDomain = isPhishingDomain(approval.hostname);
            sendResponse(resp);
        } else {
            sendResponse(null);
@@ -723,28 +667,34 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
            return true;
        }
        // The popup signs; it reports back here when it could not. Fail the
        // request the same way this handler used to when it did the signing.
        if (msg.error) {
            approval.resolve({ error: { message: msg.error } });
            sendResponse({ error: msg.error });
            return false;
        }
        (async () => {
            try {
                await loadState();
                const activeAddress = await getActiveAddress();
-                // The popup holds the secret, but the background stays the
+                let wallet, addrIndex;
-                // authority on what is broadcast: the raw transaction must be
+                for (const w of state.wallets) {
-                // the approved one, signed by the approved address.
+                    for (let i = 0; i < w.addresses.length; i++) {
-                verifySignedTx(
+                        if (w.addresses[i].address === activeAddress) {
-                    msg.rawSignedTx,
+                            wallet = w;
-                    approval.txParams,
+                            addrIndex = i;
-                    activeAddress,
+                            break;
                        }
                    }
                    if (wallet) break;
                }
                if (!wallet) throw new Error("Wallet not found");
                const decrypted = await decryptWithPassword(
                    wallet.encryptedSecret,
                    msg.password,
                );
                const signer = getSignerForAddress(
                    wallet,
                    addrIndex,
                    decrypted,
                );
                const provider = getProvider(state.rpcUrl);
-                const tx = await provider.broadcastTransaction(msg.rawSignedTx);
+                const connected = signer.connect(provider);
                const tx = await connected.sendTransaction(approval.txParams);
                approval.resolve({ txHash: tx.hash });
                sendResponse({ txHash: tx.hash });
            } catch (e) {
@@ -771,23 +721,50 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
            return true;
        }
        // The popup signs; it reports back here when it could not. Fail the
        // request the same way this handler used to when it did the signing.
        if (msg.error) {
            approval.resolve({ error: { message: msg.error } });
            sendResponse({ error: msg.error });
            return false;
        }
        (async () => {
            try {
                await loadState();
                const activeAddress = await getActiveAddress();
-                // The popup holds the secret, but the background stays the
+                let wallet, addrIndex;
-                // authority on what is handed back to the page: the signature
+                for (const w of state.wallets) {
-                // must cover the approved payload and recover to the approved
+                    for (let i = 0; i < w.addresses.length; i++) {
-                // address.
+                        if (w.addresses[i].address === activeAddress) {
-                const signature = msg.signature;
+                            wallet = w;
-                verifySignature(approval.signParams, signature, activeAddress);
+                            addrIndex = i;
                            break;
                        }
                    }
                    if (wallet) break;
                }
                if (!wallet) throw new Error("Wallet not found");
                const decrypted = await decryptWithPassword(
                    wallet.encryptedSecret,
                    msg.password,
                );
                const signer = getSignerForAddress(
                    wallet,
                    addrIndex,
                    decrypted,
                );
                const sp = approval.signParams;
                let signature;
                if (sp.method === "personal_sign" || sp.method === "eth_sign") {
                    signature = await signer.signMessage(getBytes(sp.message));
                } else {
                    // eth_signTypedData_v4 / eth_signTypedData
                    const typedData = JSON.parse(sp.typedData);
                    const { domain, types, message } = typedData;
                    // ethers handles EIP712Domain internally
                    delete types.EIP712Domain;
                    signature = await signer.signTypedData(
                        domain,
                        types,
                        message,
                    );
                }
                approval.resolve({ signature });
                sendResponse({ signature });
            } catch (e) {
--- a/src/content/index.js
+++ b/src/content/index.js
@@ -13,26 +13,6 @@ if (typeof browser !== "undefined") {
    (document.head || document.documentElement).appendChild(script);
 }
 // Send the persisted EIP-6963 provider UUID to the inpage script.
 // Generated once at install time and stored in chrome.storage.local.
 (function sendProviderUuid() {
    const storage =
        typeof browser !== "undefined"
            ? browser.storage.local
            : chrome.storage.local;
    storage.get("eip6963Uuid", (items) => {
        let uuid = items?.eip6963Uuid;
        if (!uuid) {
            uuid = crypto.randomUUID();
            storage.set({ eip6963Uuid: uuid });
        }
        window.postMessage(
            { type: "AUTISTMASK_PROVIDER_UUID", uuid },
            location.origin,
        );
    });
 })();
 // Relay requests from the page to the background script
 window.addEventListener("message", (event) => {
    if (event.source !== window) return;
--- a/src/content/inpage.js
+++ b/src/content/inpage.js
@@ -2,17 +2,14 @@
 // Creates window.ethereum (EIP-1193 provider) and announces via EIP-6963.
 (function () {
-    // Defaults to mainnet; updated dynamically via eth_chainId on init and
+    const CHAIN_ID = "0x1"; // Ethereum mainnet
    // chainChanged events from the extension.
    let currentChainId = "0x1";
    let currentNetworkVersion = "1";
    const listeners = {};
    let nextId = 1;
    const pending = {};
    // Listen for responses from the content script
-    window.addEventListener("message", function onUuid(event) {
+    window.addEventListener("message", (event) => {
        if (event.source !== window) return;
        if (event.data?.type !== "AUTISTMASK_RESPONSE") return;
        const { id, result, error } = event.data;
@@ -27,16 +24,10 @@
    });
    // Listen for events pushed from the extension
-    window.addEventListener("message", function onUuid(event) {
+    window.addEventListener("message", (event) => {
        if (event.source !== window) return;
        if (event.data?.type !== "AUTISTMASK_EVENT") return;
        const { eventName, data } = event.data;
        if (eventName === "chainChanged") {
            currentChainId = data;
            currentNetworkVersion = String(parseInt(data, 16));
            provider.chainId = currentChainId;
            provider.networkVersion = currentNetworkVersion;
        }
        emit(eventName, data);
    });
@@ -66,8 +57,8 @@
    const provider = {
        isAutistMask: true,
        isMetaMask: true, // compatibility — many dApps check this
-        chainId: currentChainId,
+        chainId: CHAIN_ID,
-        networkVersion: currentNetworkVersion,
+        networkVersion: "1",
        selectedAddress: null,
        async request(args) {
@@ -84,12 +75,6 @@
                        ? result[0]
                        : null;
            }
            if (args.method === "eth_chainId" && result) {
                currentChainId = result;
                currentNetworkVersion = String(parseInt(result, 16));
                provider.chainId = currentChainId;
                provider.networkVersion = currentNetworkVersion;
            }
            return result;
        },
@@ -149,7 +134,7 @@
        // Some dApps (wagmi) check this to confirm MetaMask-like behavior
        _metamask: {
            isUnlocked() {
-                return Promise.resolve(provider.selectedAddress !== null);
+                return Promise.resolve(true);
            },
        },
    };
@@ -170,53 +155,21 @@
                "</svg>",
        );
-    let providerUuid = crypto.randomUUID(); // fallback until real UUID arrives
+    const providerInfo = {
-
+        uuid: "f3c5b2a1-8d4e-4f6a-9c7b-1e2d3a4b5c6d",
-    function buildProviderInfo() {
+        name: "AutistMask",
-        return {
+        icon: ICON_SVG,
-            uuid: providerUuid,
+        rdns: "berlin.sneak.autistmask",
-            name: "AutistMask",
+    };
            icon: ICON_SVG,
            rdns: "berlin.sneak.autistmask",
        };
    }
    function announceProvider() {
        window.dispatchEvent(
            new CustomEvent("eip6963:announceProvider", {
-                detail: Object.freeze({
+                detail: Object.freeze({ info: providerInfo, provider }),
                    info: buildProviderInfo(),
                    provider,
                }),
            }),
        );
    }
    // Listen for the persisted UUID from the content script
    function onProviderUuid(event) {
        if (event.source !== window) return;
        if (event.data?.type !== "AUTISTMASK_PROVIDER_UUID") return;
        window.removeEventListener("message", onProviderUuid);
        providerUuid = event.data.uuid;
        announceProvider();
    }
    window.addEventListener("message", onProviderUuid);
    window.addEventListener("eip6963:requestProvider", announceProvider);
    announceProvider();
    // Fetch the current chain ID from the extension on load so the provider
    // reflects the selected network immediately (covers Sepolia etc.).
    sendRequest({ method: "eth_chainId", params: [] })
        .then((chainId) => {
            if (chainId) {
                currentChainId = chainId;
                currentNetworkVersion = String(parseInt(chainId, 16));
                provider.chainId = currentChainId;
                provider.networkVersion = currentNetworkVersion;
            }
        })
        .catch(() => {
            // Best-effort — keep defaults.
        });
 })();
--- a/src/popup/index.html
+++ b/src/popup/index.html
--- a/src/popup/index.js
+++ b/src/popup/index.js
@@ -1,24 +1,16 @@
 // AutistMask popup entry point.
 // Loads state, initializes views, triggers first render.
 const { DEBUG } = require("../shared/constants");
 const { state, saveState, loadState } = require("../shared/state");
 const { setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
-const {
+const { $, showView } = require("./views/helpers");
    $,
    showView,
    updateDebugBanner,
    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 const home = require("./views/home");
 const welcome = require("./views/welcome");
 const addWallet = require("./views/addWallet");
 const importKey = require("./views/importKey");
 const addressDetail = require("./views/addressDetail");
 const addressToken = require("./views/addressToken");
 const send = require("./views/send");
@@ -28,7 +20,6 @@ const transactionDetail = require("./views/transactionDetail");
 const receive = require("./views/receive");
 const addToken = require("./views/addToken");
 const settings = require("./views/settings");
 const settingsAddToken = require("./views/settingsAddToken");
 const approval = require("./views/approval");
 function renderWalletList() {
@@ -61,42 +52,14 @@ async function doRefreshAndRender() {
 const ctx = {
    renderWalletList,
    doRefreshAndRender,
-    showAddWalletView: () => {
+    showAddWalletView: () => addWallet.show(),
-        pushCurrentView();
+    showImportKeyView: () => importKey.show(),
-        addWallet.show();
+    showAddressDetail: () => addressDetail.show(),
-    },
+    showAddressToken: () => addressToken.show(),
-    showAddressDetail: () => {
+    showAddTokenView: () => addToken.show(),
-        pushCurrentView();
+    showConfirmTx: (txInfo) => confirmTx.show(txInfo),
-        addressDetail.show();
+    showReceive: () => receive.show(),
-    },
+    showTransactionDetail: (tx) => transactionDetail.show(tx),
    showAddressToken: () => {
        pushCurrentView();
        addressToken.show();
    },
    showAddTokenView: () => {
        pushCurrentView();
        addToken.show();
    },
    showConfirmTx: (txInfo) => {
        pushCurrentView();
        confirmTx.show(txInfo);
    },
    showReceive: () => {
        pushCurrentView();
        receive.show();
    },
    showTransactionDetail: (tx) => {
        pushCurrentView();
        transactionDetail.show(tx);
    },
    showSettingsView: () => {
        pushCurrentView();
        settings.show();
    },
    showSettingsAddTokenView: () => {
        pushCurrentView();
        settingsAddToken.show();
    },
 };
 // Views that can be fully re-rendered from persisted state.
@@ -107,8 +70,6 @@ const RESTORABLE_VIEWS = new Set([
    "address-token",
    "receive",
    "settings",
    "settings-addtoken",
    "confirm-tx",
    "transaction",
    "success-tx",
    "error-tx",
@@ -159,16 +120,6 @@ function restoreView() {
        case "settings":
            settings.show();
            break;
        case "settings-addtoken":
            settingsAddToken.show();
            break;
        case "confirm-tx":
            if (state.viewData && state.viewData.pendingTx) {
                confirmTx.restore();
            } else {
                fallbackView();
            }
            break;
        case "transaction":
            if (state.viewData && state.viewData.tx) {
                transactionDetail.render();
@@ -202,14 +153,16 @@ function fallbackView() {
 }
 async function init() {
    if (DEBUG) {
        const banner = document.createElement("div");
        banner.id = "debug-banner";
        banner.textContent = "DEBUG / INSECURE";
        banner.style.cssText =
            "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
        document.body.prepend(banner);
    }
    await loadState();
    applyTheme(state.theme);
    // Sync runtime debug flag from persisted state before first render
    setRuntimeDebug(state.debugMode);
    // Create the debug/testnet banner if needed (uses runtime debug state)
    updateDebugBanner();
    // Auto-default active address
    if (
@@ -229,7 +182,7 @@ async function init() {
    const params = new URLSearchParams(window.location.search);
    const approvalId = params.get("approval");
    if (approvalId) {
-        approval.show(approvalId);
+        approval.show(parseInt(approvalId, 10));
        showView("approve-site");
        return;
    }
@@ -240,17 +193,16 @@ async function init() {
                .getElementById("view-settings")
                .classList.contains("hidden")
        ) {
-            goBack();
+            renderWalletList();
            showView("main");
            return;
        }
        pushCurrentView();
        settings.show();
    });
    setRenderMain(renderWalletList);
    welcome.init(ctx);
    addWallet.init(ctx);
    importKey.init(ctx);
    home.init(ctx);
    addressDetail.init(ctx);
    addressToken.init(ctx);
@@ -260,7 +212,6 @@ async function init() {
    receive.init(ctx);
    addToken.init(ctx);
    settings.init(ctx);
    settingsAddToken.init(ctx);
    if (!state.hasWallet) {
        showView("welcome");
--- a/src/popup/styles/main.css
+++ b/src/popup/styles/main.css
@@ -10,37 +10,11 @@
    --color-border: #000000;
    --color-border-light: #cccccc;
    --color-hover: #eeeeee;
-    --color-well: #e8e8e8;
+    --color-well: #f5f5f5;
    --color-danger-well: #fef2f2;
    --color-section: #dddddd;
 }
 html.dark {
    --color-bg: #000000;
    --color-fg: #ffffff;
    --color-muted: #aaaaaa;
    --color-border: #ffffff;
    --color-border-light: #444444;
    --color-hover: #222222;
    --color-well: #1a1a1a;
    --color-danger-well: #2a0a0a;
    --color-section: #2a2a2a;
 }
 body {
    width: 396px;
    overflow-x: hidden;
 }
 /* Copy-flash feedback: inverts colors then fades back */
 .copy-flash-active {
    background-color: var(--color-fg) !important;
    color: var(--color-bg) !important;
    transition: none;
 }
 .copy-flash-fade {
    transition:
        background-color 225ms ease-out,
        color 225ms ease-out;
 }
--- a/src/popup/theme.js
+++ b/src/popup/theme.js
@@ -1,33 +0,0 @@
 // Theme management: applies light/dark class to <html> based on preference.
 let mediaQuery = null;
 let mediaHandler = null;
 function applyTheme(theme) {
    // Clean up previous system listener
    if (mediaQuery && mediaHandler) {
        mediaQuery.removeEventListener("change", mediaHandler);
        mediaHandler = null;
    }
    if (theme === "dark") {
        document.documentElement.classList.add("dark");
    } else if (theme === "light") {
        document.documentElement.classList.remove("dark");
    } else {
        // system
        mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
        const update = () => {
            if (mediaQuery.matches) {
                document.documentElement.classList.add("dark");
            } else {
                document.documentElement.classList.remove("dark");
            }
        };
        mediaHandler = update;
        mediaQuery.addEventListener("change", update);
        update();
    }
 }
 module.exports = { applyTheme };
--- a/src/popup/views/addToken.js
+++ b/src/popup/views/addToken.js
@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -7,8 +7,7 @@ const { log } = require("../../shared/log");
 function show() {
    $("add-token-address").value = "";
-    $("add-token-info").textContent = "";
+    $("add-token-info").classList.add("hidden");
    $("add-token-info").style.visibility = "hidden";
    const list = $("common-token-list");
    list.innerHTML = getTopTokens(25)
        .map(
@@ -46,7 +45,7 @@ function init(ctx) {
        }
        const infoEl = $("add-token-info");
        infoEl.textContent = "Looking up token...";
-        infoEl.style.visibility = "visible";
+        infoEl.classList.remove("hidden");
        log.debugf("Looking up token contract", contractAddr);
        try {
            const info = await lookupTokenInfo(contractAddr, state.rpcUrl);
@@ -59,24 +58,16 @@ function init(ctx) {
            });
            await saveState();
            ctx.doRefreshAndRender();
-            // Pop the stack (back to address detail) and re-render it
+            ctx.showAddressDetail();
            // so the newly added token is visible immediately.
            if (state.viewStack.length > 0) {
                state.viewStack.pop();
            }
            require("./addressDetail").show();
        } catch (e) {
            const detail = e.shortMessage || e.message || String(e);
            log.errorf("Token lookup failed for", contractAddr, detail);
            showFlash(detail);
-            infoEl.textContent = "";
+            infoEl.classList.add("hidden");
            infoEl.style.visibility = "hidden";
        }
    });
-    $("btn-add-token-back").addEventListener("click", () => {
+    $("btn-add-token-back").addEventListener("click", ctx.showAddressDetail);
        goBack();
    });
 }
 module.exports = { init, show };
--- a/src/popup/views/addWallet.js
+++ b/src/popup/views/addWallet.js
@@ -1,307 +1,129 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const {
    generateMnemonic,
    hdWalletFromMnemonic,
    isValidMnemonic,
    addressFromPrivateKey,
    hdWalletFromXprv,
    isValidXprv,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
 const { scanForAddresses } = require("../../shared/balances");
 /**
 * Check if an address already exists in ANY wallet (hd, xprv, or key).
 * Returns the wallet object if found, or undefined.
 */
 function findWalletByAddress(addr) {
    const lower = addr.toLowerCase();
    return state.wallets.find((w) =>
        w.addresses.some((a) => a.address.toLowerCase() === lower),
    );
 }
 /**
 * Check if an xpub already exists in any HD-type wallet (hd or xprv).
 * Returns the wallet object if found, or undefined.
 */
 function findWalletByXpub(xpub) {
    return state.wallets.find((w) => w.xpub && w.xpub === xpub);
 }
 let currentMode = "mnemonic";
 const MODES = ["mnemonic", "privkey", "xprv"];
 const PASSWORD_HINTS = {
    mnemonic:
        "This password encrypts your recovery phrase on this device. You will need it to send funds.",
    privkey:
        "This password encrypts your private key on this device. You will need it to send funds.",
    xprv: "This password encrypts your key on this device. You will need it to send funds.",
 };
 function switchMode(mode) {
    currentMode = mode;
    for (const m of MODES) {
        $("add-wallet-section-" + m).classList.toggle("hidden", m !== mode);
        const tab = $("tab-" + m);
        const isActive = m === mode;
        // Active: bold, solid border on top/sides, no bottom border (connects to content)
        tab.classList.toggle("font-bold", isActive);
        tab.classList.toggle("border-solid", isActive);
        tab.classList.toggle("border-border", isActive);
        tab.classList.toggle("border-b-bg", isActive);
        tab.classList.toggle("bg-bg", isActive);
        // Inactive: muted text, dashed border on top/sides, transparent bottom, hover invert
        tab.classList.toggle("text-muted", !isActive);
        tab.classList.toggle("border-dashed", !isActive);
        tab.classList.toggle("border-border-light", !isActive);
        tab.classList.toggle("border-b-transparent", !isActive);
        tab.classList.toggle("hover:bg-fg", !isActive);
        tab.classList.toggle("hover:text-bg", !isActive);
    }
    $("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
 }
 function show() {
    $("wallet-mnemonic").value = "";
    $("import-private-key").value = "";
    $("import-xprv-key").value = "";
    $("add-wallet-password").value = "";
    $("add-wallet-password-confirm").value = "";
-    $("add-wallet-phrase-warning").style.visibility = "hidden";
+    $("add-wallet-phrase-warning").classList.add("hidden");
    switchMode("mnemonic");
    showView("add-wallet");
 }
 function validatePassword() {
    const pw = $("add-wallet-password").value;
    const pw2 = $("add-wallet-password-confirm").value;
    if (!pw) {
        showFlash("Please choose a password.");
        return null;
    }
    if (pw.length < 12) {
        showFlash("Password must be at least 12 characters.");
        return null;
    }
    if (pw !== pw2) {
        showFlash("Passwords do not match.");
        return null;
    }
    return pw;
 }
 async function importMnemonic(ctx) {
    const mnemonic = $("wallet-mnemonic").value.trim();
    if (!mnemonic) {
        showFlash("Enter a recovery phrase or press the die to generate one.");
        return;
    }
    const words = mnemonic.split(/\s+/);
    if (words.length !== 12 && words.length !== 24) {
        showFlash(
            "Recovery phrase must be 12 or 24 words. You entered " +
                words.length +
                ".",
        );
        return;
    }
    if (!isValidMnemonic(mnemonic)) {
        showFlash("Invalid recovery phrase. Check for typos.");
        return;
    }
    const pw = validatePassword();
    if (!pw) return;
    const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
    const xpubDup = findWalletByXpub(xpub);
    if (xpubDup) {
        showFlash(
            "This recovery phrase is already added (" + xpubDup.name + ").",
        );
        return;
    }
    const addrDup = findWalletByAddress(firstAddress);
    if (addrDup) {
        showFlash("Address already exists in wallet (" + addrDup.name + ").");
        return;
    }
    const encrypted = await encryptWithPassword(mnemonic, pw);
    const walletNum = state.wallets.length + 1;
    const wallet = {
        type: "hd",
        name: "Wallet " + walletNum,
        xpub: xpub,
        encryptedSecret: encrypted,
        nextIndex: 1,
        addresses: [
            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
        ],
    };
    state.wallets.push(wallet);
    state.hasWallet = true;
    await saveState();
    clearViewStack();
    ctx.renderWalletList();
    showView("main");
    // Scan for used HD addresses beyond index 0.
    showFlash("Scanning for addresses...", 30000);
    const scan = await scanForAddresses(xpub, state.rpcUrl);
    if (scan.addresses.length > 1) {
        wallet.addresses = scan.addresses.map((a) => ({
            address: a.address,
            balance: "0.0000",
            tokenBalances: [],
        }));
        wallet.nextIndex = scan.nextIndex;
        await saveState();
        ctx.renderWalletList();
        showFlash("Found " + scan.addresses.length + " addresses.");
    } else {
        showFlash("Ready.", 1000);
    }
    ctx.doRefreshAndRender();
 }
 async function importPrivateKey(ctx) {
    const key = $("import-private-key").value.trim();
    if (!key) {
        showFlash("Please enter your private key.");
        return;
    }
    let addr;
    try {
        addr = addressFromPrivateKey(key);
    } catch (e) {
        showFlash("Invalid private key.");
        return;
    }
    const pw = validatePassword();
    if (!pw) return;
    const duplicate = findWalletByAddress(addr);
    if (duplicate) {
        showFlash(
            "This address already exists in wallet (" + duplicate.name + ").",
        );
        return;
    }
    const encrypted = await encryptWithPassword(key, pw);
    const walletNum = state.wallets.length + 1;
    state.wallets.push({
        type: "key",
        name: "Wallet " + walletNum,
        encryptedSecret: encrypted,
        addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
    });
    state.hasWallet = true;
    await saveState();
    clearViewStack();
    ctx.renderWalletList();
    showView("main");
    ctx.doRefreshAndRender();
 }
 async function importXprvKey(ctx) {
    const xprv = $("import-xprv-key").value.trim();
    if (!xprv) {
        showFlash("Please enter your extended private key.");
        return;
    }
    if (!isValidXprv(xprv)) {
        showFlash("Invalid extended private key.");
        return;
    }
    let result;
    try {
        result = hdWalletFromXprv(xprv);
    } catch (e) {
        showFlash("Invalid extended private key.");
        return;
    }
    const { xpub, firstAddress } = result;
    const xpubDup = findWalletByXpub(xpub);
    if (xpubDup) {
        showFlash("This key is already added (" + xpubDup.name + ").");
        return;
    }
    const addrDup = findWalletByAddress(firstAddress);
    if (addrDup) {
        showFlash("Address already exists in wallet (" + addrDup.name + ").");
        return;
    }
    const pw = validatePassword();
    if (!pw) return;
    const encrypted = await encryptWithPassword(xprv, pw);
    const walletNum = state.wallets.length + 1;
    const wallet = {
        type: "xprv",
        name: "Wallet " + walletNum,
        xpub: xpub,
        encryptedSecret: encrypted,
        nextIndex: 1,
        addresses: [
            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
        ],
    };
    state.wallets.push(wallet);
    state.hasWallet = true;
    await saveState();
    clearViewStack();
    ctx.renderWalletList();
    showView("main");
    // Scan for used HD addresses beyond index 0.
    showFlash("Scanning for addresses...", 30000);
    const scan = await scanForAddresses(xpub, state.rpcUrl);
    if (scan.addresses.length > 1) {
        wallet.addresses = scan.addresses.map((a) => ({
            address: a.address,
            balance: "0.0000",
            tokenBalances: [],
        }));
        wallet.nextIndex = scan.nextIndex;
        await saveState();
        ctx.renderWalletList();
        showFlash("Found " + scan.addresses.length + " addresses.");
    } else {
        showFlash("Ready.", 1000);
    }
    ctx.doRefreshAndRender();
 }
 function init(ctx) {
    // Tab click handlers
    $("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
    $("tab-privkey").addEventListener("click", () => switchMode("privkey"));
    $("tab-xprv").addEventListener("click", () => switchMode("xprv"));
    // Generate mnemonic
    $("btn-generate-phrase").addEventListener("click", () => {
        $("wallet-mnemonic").value = generateMnemonic();
-        $("add-wallet-phrase-warning").style.visibility = "visible";
+        $("add-wallet-phrase-warning").classList.remove("hidden");
    });
    // Import / confirm
    $("btn-add-wallet-confirm").addEventListener("click", async () => {
-        if (currentMode === "mnemonic") {
+        const mnemonic = $("wallet-mnemonic").value.trim();
-            await importMnemonic(ctx);
+        if (!mnemonic) {
-        } else if (currentMode === "privkey") {
+            showFlash(
-            await importPrivateKey(ctx);
+                "Enter a recovery phrase or press the die to generate one.",
-        } else if (currentMode === "xprv") {
+            );
-            await importXprvKey(ctx);
+            return;
        }
        const words = mnemonic.split(/\s+/);
        if (words.length !== 12 && words.length !== 24) {
            showFlash(
                "Recovery phrase must be 12 or 24 words. You entered " +
                    words.length +
                    ".",
            );
            return;
        }
        if (!isValidMnemonic(mnemonic)) {
            showFlash("Invalid recovery phrase. Check for typos.");
            return;
        }
        const pw = $("add-wallet-password").value;
        const pw2 = $("add-wallet-password-confirm").value;
        if (!pw) {
            showFlash("Please choose a password.");
            return;
        }
        if (pw.length < 8) {
            showFlash("Password must be at least 8 characters.");
            return;
        }
        if (pw !== pw2) {
            showFlash("Passwords do not match.");
            return;
        }
        const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
        const duplicate = state.wallets.find(
            (w) =>
                w.type === "hd" &&
                w.addresses[0] &&
                w.addresses[0].address.toLowerCase() ===
                    firstAddress.toLowerCase(),
        );
        if (duplicate) {
            showFlash(
                "This recovery phrase is already added (" +
                    duplicate.name +
                    ").",
            );
            return;
        }
        const encrypted = await encryptWithPassword(mnemonic, pw);
        const walletNum = state.wallets.length + 1;
        const wallet = {
            type: "hd",
            name: "Wallet " + walletNum,
            xpub: xpub,
            encryptedSecret: encrypted,
            nextIndex: 1,
            addresses: [
                { address: firstAddress, balance: "0.0000", tokenBalances: [] },
            ],
        };
        state.wallets.push(wallet);
        state.hasWallet = true;
        await saveState();
        ctx.renderWalletList();
        showView("main");
        // Scan for used HD addresses beyond index 0.
        showFlash("Scanning for addresses...", 30000);
        const scan = await scanForAddresses(xpub, state.rpcUrl);
        if (scan.addresses.length > 1) {
            wallet.addresses = scan.addresses.map((a) => ({
                address: a.address,
                balance: "0.0000",
                tokenBalances: [],
            }));
            wallet.nextIndex = scan.nextIndex;
            await saveState();
            ctx.renderWalletList();
            showFlash("Found " + scan.addresses.length + " addresses.");
        } else {
            showFlash("Ready.", 1000);
        }
        ctx.doRefreshAndRender();
    });
    $("btn-add-wallet-back").addEventListener("click", () => {
        if (!state.hasWallet) {
            showView("welcome");
        } else {
            ctx.renderWalletList();
            showView("main");
        }
    });
-    // Back button
+    $("btn-add-wallet-import-key").addEventListener(
-    $("btn-add-wallet-back").addEventListener("click", () => {
+        "click",
-        goBack();
+        ctx.showImportKeyView,
-    });
+    );
 }
 module.exports = { init, show };
--- a/src/popup/views/addressDetail.js
+++ b/src/popup/views/addressDetail.js
@@ -2,16 +2,10 @@ const {
    $,
    showView,
    showFlash,
    flashCopyFeedback,
    balanceLinesForAddress,
    addressDotHtml,
    addressTitle,
    escapeHtml,
    truncateMiddle,
    renderAddressHtml,
    attachCopyHandlers,
    goBack,
    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
@@ -20,18 +14,23 @@ const {
    filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
    updateSendBalance,
    renderSendTokenSelect,
    resetSendValidation,
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 let ctx;
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 function etherscanAddressLink(address) {
    return `https://etherscan.io/address/${address}`;
 }
 function show() {
    state.selectedToken = null;
    const wallet = state.wallets[state.selectedWallet];
@@ -49,18 +48,21 @@ function show() {
    img.style.imageRendering = "pixelated";
    img.style.borderRadius = "50%";
    blockieEl.appendChild(img);
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-etherscan-link").innerHTML =
-    $("address-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    attachCopyHandlers($("address-line"));
+    $("address-usd-total").textContent = formatUsd(getAddressValueUsd(addr));
    const usdTotal = formatUsd(getAddressValueUsd(addr));
    $("address-usd-total").innerHTML = usdTotal || "&nbsp;";
    const ensEl = $("address-ens");
-    // ENS is now shown inside renderAddressHtml, hide the separate element
+    if (addr.ensName) {
-    ensEl.classList.add("hidden");
+        ensEl.innerHTML =
            addressDotHtml(addr.address) + escapeHtml(addr.ensName);
        ensEl.classList.remove("hidden");
    } else {
        ensEl.classList.add("hidden");
    }
    $("address-balances").innerHTML = balanceLinesForAddress(
        addr,
        state.trackedTokens,
@@ -84,39 +86,18 @@ function show() {
 function isoDate(timestamp) {
    const d = new Date(timestamp * 1000);
    const pad = (n) => String(n).padStart(2, "0");
    if (state.utcTimestamps) {
        return (
            d.getUTCFullYear() +
            "-" +
            pad(d.getUTCMonth() + 1) +
            "-" +
            pad(d.getUTCDate()) +
            "T" +
            pad(d.getUTCHours()) +
            ":" +
            pad(d.getUTCMinutes()) +
            ":" +
            pad(d.getUTCSeconds()) +
            "Z"
        );
    }
    const offsetMin = -d.getTimezoneOffset();
    const sign = offsetMin >= 0 ? "+" : "-";
    const absOff = Math.abs(offsetMin);
    const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
    return (
        d.getFullYear() +
        "-" +
        pad(d.getMonth() + 1) +
        "-" +
        pad(d.getDate()) +
-        "T" +
+        " " +
        pad(d.getHours()) +
        ":" +
        pad(d.getMinutes()) +
        ":" +
-        pad(d.getSeconds()) +
+        pad(d.getSeconds())
        tzStr
    );
 }
@@ -168,11 +149,11 @@ async function loadTransactions(address) {
        loadedTxs = txs;
-        // Collect ALL unique addresses (from + to) for ENS resolution so
+        // Collect unique counterparty addresses for ENS resolution.
        // that reverse lookups work for every displayed address, not just
        // the ones that were originally entered as ENS names.
        const counterparties = [
-            ...new Set(txs.flatMap((tx) => [tx.from, tx.to].filter(Boolean))),
+            ...new Set(
                txs.map((tx) => (tx.direction === "sent" ? tx.to : tx.from)),
            ),
        ];
        if (counterparties.length > 0) {
            try {
@@ -203,23 +184,14 @@ function renderTransactions(txs) {
    let html = "";
    let i = 0;
    for (const tx of txs) {
-        // For swap transactions, show the user's own labelled wallet
+        const counterparty = tx.direction === "sent" ? tx.to : tx.from;
        // address instead of the contract address (see issue #55).
        const counterparty =
            tx.direction === "contract" && tx.directionLabel === "Swap"
                ? tx.from
                : tx.direction === "sent" || tx.direction === "contract"
                  ? tx.to
                  : tx.from;
        const ensName = ensNameMap.get(counterparty) || null;
        const title = addressTitle(counterparty, state.wallets);
        const dirLabel = tx.directionLabel;
        const amountStr = tx.value
            ? escapeHtml(tx.value + " " + tx.symbol)
            : escapeHtml(tx.symbol);
-        const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
+        const maxAddr = Math.max(10, 36 - Math.max(0, amountStr.length - 10));
-        const displayAddr =
+        const displayAddr = ensName || truncateMiddle(counterparty, maxAddr);
            title || ensName || truncateMiddle(counterparty, maxAddr);
        const addrStr = escapeHtml(displayAddr);
        const dot = addressDotHtml(counterparty);
        const err = tx.isError ? " (failed)" : "";
@@ -247,9 +219,17 @@ function renderTransactions(txs) {
 function init(_ctx) {
    ctx = _ctx;
    $("address-full").addEventListener("click", () => {
        const addr = $("address-full").dataset.full;
        if (addr) {
            navigator.clipboard.writeText(addr);
            showFlash("Copied!");
        }
    });
    $("btn-address-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
        showView("main");
    });
    $("btn-send").addEventListener("click", () => {
@@ -266,8 +246,6 @@ function init(_ctx) {
        $("send-token").classList.remove("hidden");
        $("send-token-static").classList.add("hidden");
        updateSendBalance();
        resetSendValidation();
        pushCurrentView();
        showView("send");
    });
@@ -276,102 +254,6 @@ function init(_ctx) {
    });
    $("btn-add-token").addEventListener("click", ctx.showAddTokenView);
    // More menu dropdown
    const moreBtn = $("btn-more-menu");
    const moreDropdown = $("more-menu-dropdown");
    moreBtn.addEventListener("click", (e) => {
        e.stopPropagation();
        const isOpen = !moreDropdown.classList.toggle("hidden");
        moreBtn.classList.toggle("bg-fg", isOpen);
        moreBtn.classList.toggle("text-bg", isOpen);
    });
    document.addEventListener("click", () => {
        moreDropdown.classList.add("hidden");
        moreBtn.classList.remove("bg-fg", "text-bg");
    });
    moreDropdown.addEventListener("click", (e) => {
        e.stopPropagation();
    });
    $("btn-export-privkey").addEventListener("click", () => {
        moreDropdown.classList.add("hidden");
        moreBtn.classList.remove("bg-fg", "text-bg");
        pushCurrentView();
        const wallet = state.wallets[state.selectedWallet];
        const addr = wallet.addresses[state.selectedAddress];
        const blockieEl = $("export-privkey-jazzicon");
        blockieEl.innerHTML = "";
        const bImg = document.createElement("img");
        bImg.src = makeBlockie(addr.address);
        bImg.width = 48;
        bImg.height = 48;
        bImg.style.imageRendering = "pixelated";
        bImg.style.borderRadius = "50%";
        blockieEl.appendChild(bImg);
        $("export-privkey-title").textContent =
            wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
        const exportAddrContainer = $("export-privkey-dot").parentElement;
        exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
        attachCopyHandlers(exportAddrContainer);
        $("export-privkey-password").value = "";
        $("export-privkey-flash").textContent = "";
        $("export-privkey-flash").style.visibility = "hidden";
        $("export-privkey-password-section").classList.remove("hidden");
        $("export-privkey-result").classList.add("hidden");
        $("export-privkey-value").textContent = "";
        showView("export-privkey");
    });
    $("btn-export-privkey-confirm").addEventListener("click", async () => {
        const password = $("export-privkey-password").value;
        if (!password) {
            $("export-privkey-flash").textContent = "Password is required.";
            $("export-privkey-flash").style.visibility = "visible";
            return;
        }
        const btn = $("btn-export-privkey-confirm");
        btn.disabled = true;
        btn.classList.add("text-muted");
        const wallet = state.wallets[state.selectedWallet];
        try {
            const secret = await decryptWithPassword(
                wallet.encryptedSecret,
                password,
            );
            const signer = getSignerForAddress(
                wallet,
                state.selectedAddress,
                secret,
            );
            const privateKey = signer.privateKey;
            $("export-privkey-password-section").classList.add("hidden");
            $("export-privkey-value").textContent = privateKey;
            $("export-privkey-result").classList.remove("hidden");
            $("export-privkey-flash").style.visibility = "hidden";
        } catch {
            $("export-privkey-flash").textContent = "Wrong password.";
            $("export-privkey-flash").style.visibility = "visible";
        } finally {
            btn.disabled = false;
            btn.classList.remove("text-muted");
        }
    });
    $("export-privkey-value").addEventListener("click", () => {
        const key = $("export-privkey-value").textContent;
        if (key) {
            navigator.clipboard.writeText(key);
            showFlash("Copied!");
            flashCopyFeedback($("export-privkey-value"));
        }
    });
    $("btn-export-privkey-back").addEventListener("click", () => {
        $("export-privkey-value").textContent = "";
        $("export-privkey-password").value = "";
        goBack();
    });
 }
 module.exports = { init, show };
--- a/src/popup/views/addressToken.js
+++ b/src/popup/views/addressToken.js
@@ -5,19 +5,12 @@ const {
    $,
    showView,
    showFlash,
    flashCopyFeedback,
    addressDotHtml,
    addressTitle,
    escapeHtml,
    truncateMiddle,
    balanceLine,
    renderAddressHtml,
    attachCopyHandlers,
    goBack,
    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
 const {
    formatUsd,
    getPrice,
@@ -28,52 +21,38 @@ const {
    filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
    updateSendBalance,
    renderSendTokenSelect,
    resetSendValidation,
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 let ctx;
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 function etherscanAddressLink(address) {
    return `https://etherscan.io/address/${address}`;
 }
 function isoDate(timestamp) {
    const d = new Date(timestamp * 1000);
    const pad = (n) => String(n).padStart(2, "0");
    if (state.utcTimestamps) {
        return (
            d.getUTCFullYear() +
            "-" +
            pad(d.getUTCMonth() + 1) +
            "-" +
            pad(d.getUTCDate()) +
            "T" +
            pad(d.getUTCHours()) +
            ":" +
            pad(d.getUTCMinutes()) +
            ":" +
            pad(d.getUTCSeconds()) +
            "Z"
        );
    }
    const offsetMin = -d.getTimezoneOffset();
    const sign = offsetMin >= 0 ? "+" : "-";
    const absOff = Math.abs(offsetMin);
    const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
    return (
        d.getFullYear() +
        "-" +
        pad(d.getMonth() + 1) +
        "-" +
        pad(d.getDate()) +
-        "T" +
+        " " +
        pad(d.getHours()) +
        ":" +
        pad(d.getMinutes()) +
        ":" +
-        pad(d.getSeconds()) +
+        pad(d.getSeconds())
        tzStr
    );
 }
@@ -106,7 +85,6 @@ function show() {
    // Determine token symbol and balance
    let symbol, amount, price;
    const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
    if (tokenId === "ETH") {
        symbol = "ETH";
        amount = parseFloat(addr.balance || "0");
@@ -115,11 +93,7 @@ function show() {
        const tb = (addr.tokenBalances || []).find(
            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
        );
-        symbol = resolveSymbol(
+        symbol = tb ? tb.symbol : "?";
            tokenId,
            addr.tokenBalances,
            state.trackedTokens,
        );
        amount = tb ? parseFloat(tb.balance || "0") : 0;
        price = getPrice(symbol);
    }
@@ -141,73 +115,20 @@ function show() {
    blockieEl.appendChild(img);
    // Address line
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-token-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-token-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-token-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-token-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-token-etherscan-link").innerHTML =
-    $("address-token-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
    attachCopyHandlers($("address-token-line"));
    // USD total for this token only
-    const usdVal = price ? amount * price : null;
+    const usdVal = price ? amount * price : 0;
-    const usdStr = formatUsd(usdVal);
+    $("address-token-usd-total").textContent = formatUsd(usdVal);
    $("address-token-usd-total").innerHTML = usdStr || "&nbsp;";
    // Single token balance line (no tokenId — not clickable here)
    $("address-token-balance").innerHTML = balanceLine(symbol, amount, price);
    // Token contract details (ERC-20 only)
    const contractInfo = $("address-token-contract-info");
    if (tokenId !== "ETH") {
        const tb = (addr.tokenBalances || []).find(
            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
        );
        const tracked = (state.trackedTokens || []).find(
            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
        );
        const rawName =
            (tb && tb.name) ||
            (tracked && tracked.name) ||
            (knownToken && knownToken.name) ||
            null;
        const rawSymbol =
            (tb && tb.symbol) ||
            (tracked && tracked.symbol) ||
            (knownToken && knownToken.symbol) ||
            null;
        const tokenName = rawName ? escapeHtml(rawName) : null;
        const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
        const tokenDecimals =
            tb && tb.decimals != null
                ? tb.decimals
                : tracked && tracked.decimals != null
                  ? tracked.decimals
                  : knownToken && knownToken.decimals != null
                    ? knownToken.decimals
                    : null;
        const tokenHolders = tb && tb.holders != null ? tb.holders : null;
        const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
        let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
        infoHtml += `<div class="mb-2">${renderAddressHtml(tokenId)}</div>`;
        if (tokenName)
            infoHtml += `<div class="mb-1"><span class="text-muted">Name:</span> ${tokenName}</div>`;
        if (tokenSymbol)
            infoHtml += `<div class="mb-1"><span class="text-muted">Symbol:</span> ${tokenSymbol}</div>`;
        if (tokenDecimals != null)
            infoHtml += `<div class="mb-1"><span class="text-muted">Decimals:</span> ${tokenDecimals}</div>`;
        if (tokenHolders != null)
            infoHtml += `<div class="mb-1"><span class="text-muted">Holders:</span> ${Number(tokenHolders).toLocaleString()}</div>`;
        if (projectUrl)
            infoHtml += `<div class="mb-1"><span class="text-muted">Website:</span> <a href="${escapeHtml(projectUrl)}" target="_blank" rel="noopener" class="underline decoration-dashed">${escapeHtml(projectUrl)}</a></div>`;
        contractInfo.innerHTML = infoHtml;
        attachCopyHandlers(contractInfo);
        contractInfo.classList.remove("hidden");
    } else {
        contractInfo.innerHTML = "";
        contractInfo.classList.add("hidden");
    }
    // Transactions
    $("address-token-tx-list").innerHTML =
        '<div class="text-muted text-xs py-1">Loading...</div>';
@@ -253,10 +174,11 @@ async function loadTransactions(address, tokenId) {
        loadedTxs = txs;
-        // Collect ALL unique addresses for ENS resolution so reverse
+        // Collect unique counterparty addresses for ENS resolution
        // lookups work for every displayed address.
        const counterparties = [
-            ...new Set(txs.flatMap((tx) => [tx.from, tx.to].filter(Boolean))),
+            ...new Set(
                txs.map((tx) => (tx.direction === "sent" ? tx.to : tx.from)),
            ),
        ];
        if (counterparties.length > 0) {
            try {
@@ -289,14 +211,12 @@ function renderTransactions(txs) {
    for (const tx of txs) {
        const counterparty = tx.direction === "sent" ? tx.to : tx.from;
        const ensName = ensNameMap.get(counterparty) || null;
        const title = addressTitle(counterparty, state.wallets);
        const dirLabel = tx.directionLabel;
        const amountStr = tx.value
            ? escapeHtml(tx.value + " " + tx.symbol)
            : escapeHtml(tx.symbol);
-        const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
+        const maxAddr = Math.max(10, 36 - Math.max(0, amountStr.length - 10));
-        const displayAddr =
+        const displayAddr = ensName || truncateMiddle(counterparty, maxAddr);
            title || ensName || truncateMiddle(counterparty, maxAddr);
        const addrStr = escapeHtml(displayAddr);
        const dot = addressDotHtml(counterparty);
        const err = tx.isError ? " (failed)" : "";
@@ -323,17 +243,16 @@ function renderTransactions(txs) {
 function init(_ctx) {
    ctx = _ctx;
-    $("address-token-contract-info").addEventListener("click", (e) => {
+    $("address-token-full").addEventListener("click", () => {
-        const copyEl = e.target.closest("[data-copy]");
+        const addr = $("address-token-full").dataset.full;
-        if (copyEl) {
+        if (addr) {
-            navigator.clipboard.writeText(copyEl.dataset.copy);
+            navigator.clipboard.writeText(addr);
            showFlash("Copied!");
            flashCopyFeedback(copyEl);
        }
    });
    $("btn-address-token-back").addEventListener("click", () => {
-        goBack();
+        ctx.showAddressDetail();
    });
    $("btn-address-token-send").addEventListener("click", () => {
@@ -360,14 +279,26 @@ function init(_ctx) {
        $("send-token").classList.add("hidden");
        let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
        if (tokenId !== "ETH") {
-            staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
+            const dot = addressDotHtml(tokenId);
            const link = `https://etherscan.io/token/${tokenId}`;
            const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
            staticHtml +=
                `<div class="flex items-center text-xs">${dot}` +
                `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
                extLink +
                `</div>`;
        }
        $("send-token-static").innerHTML = staticHtml;
        $("send-token-static").classList.remove("hidden");
-        attachCopyHandlers($("send-token-static"));
+        // Attach copy handler for the contract address
        const copyEl = $("send-token-static").querySelector("[data-copy]");
        if (copyEl) {
            copyEl.addEventListener("click", () => {
                navigator.clipboard.writeText(copyEl.dataset.copy);
                showFlash("Copied!");
            });
        }
        updateSendBalance();
        resetSendValidation();
        pushCurrentView();
        showView("send");
    });
--- a/src/popup/views/approval.js
+++ b/src/popup/views/approval.js
@@ -1,37 +1,27 @@
-const {
+const { $, addressDotHtml, escapeHtml, showView } = require("./helpers");
-    $,
+const { state, saveState } = require("../../shared/state");
-    addressTitle,
+const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
    escapeHtml,
    showView,
    showError,
    hideError,
    renderAddressHtml,
    attachCopyHandlers,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const {
    formatEther,
    formatUnits,
    getBytes,
    Interface,
    toUtf8String,
 } = require("ethers");
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { getProvider } = require("../../shared/balances");
 const txStatus = require("./txStatus");
-const uniswap = require("../../shared/uniswap");
+
 const runtime =
    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 const erc20Iface = new Interface(ERC20_ABI);
 function approvalAddressHtml(address) {
-    const title = addressTitle(address, state.wallets);
+    const dot = addressDotHtml(address);
-    return renderAddressHtml(address, { title });
+    const link = `https://etherscan.io/address/${address}`;
    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
 }
 function formatTxValue(val) {
@@ -46,124 +36,88 @@ function tokenLabel(address) {
    return t ? t.symbol : null;
 }
-// Try to decode calldata using known ABIs.
+function etherscanTokenLink(address) {
    return `https://etherscan.io/token/${address}`;
 }
 // Try to decode calldata using the ERC-20 ABI.
 // Returns { name, description, details } or null.
 function decodeCalldata(data, toAddress) {
    if (!data || data === "0x" || data.length < 10) return null;
    // Try ERC-20 (approve / transfer)
    try {
        const parsed = erc20Iface.parseTransaction({ data });
-        if (parsed) {
+        if (!parsed) return null;
            const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
            const tokenSymbol = token ? token.symbol : null;
            const tokenDecimals = token ? token.decimals : 18;
            const contractLabel = tokenSymbol
                ? tokenSymbol + " (" + toAddress + ")"
                : toAddress;
-            if (parsed.name === "approve") {
+        const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
-                const spender = parsed.args[0];
+        const tokenSymbol = token ? token.symbol : null;
-                const rawAmount = parsed.args[1];
+        const tokenDecimals = token ? token.decimals : 18;
-                const maxUint = BigInt(
+        const contractLabel = tokenSymbol
-                    "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            ? tokenSymbol + " (" + toAddress + ")"
-                );
+            : toAddress;
                const isUnlimited = rawAmount === maxUint;
                const amountRaw = isUnlimited
                    ? "Unlimited"
                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
                const amountStr = isUnlimited
                    ? "Unlimited"
                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
-                return {
+        if (parsed.name === "approve") {
-                    name: "Token Approval",
+            const spender = parsed.args[0];
-                    description: tokenSymbol
+            const rawAmount = parsed.args[1];
-                        ? "Approve spending of your " + tokenSymbol
+            const maxUint = BigInt(
-                        : "Approve spending of an ERC-20 token",
+                "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-                    details: [
+            );
-                        {
+            const isUnlimited = rawAmount === maxUint;
-                            label: "Token",
+            const amountStr = isUnlimited
-                            value: contractLabel,
+                ? "Unlimited"
-                            address: toAddress,
+                : formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
-                            isToken: true,
+                  (tokenSymbol ? " " + tokenSymbol : "");
                        },
                        {
                            label: "Spender",
                            value: spender,
                            address: spender,
                        },
                        {
                            label: "Amount",
                            value: amountStr,
                            rawValue: amountRaw,
                        },
                    ],
                };
            }
-            if (parsed.name === "transfer") {
+            return {
-                const to = parsed.args[0];
+                name: "Token Approval",
-                const rawAmount = parsed.args[1];
+                description: tokenSymbol
-                const amountRaw = formatTxValue(
+                    ? "Approve spending of your " + tokenSymbol
-                    formatUnits(rawAmount, tokenDecimals),
+                    : "Approve spending of an ERC-20 token",
-                );
+                details: [
-                const amountStr =
+                    {
-                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
+                        label: "Token",
-
+                        value: contractLabel,
-                return {
+                        address: toAddress,
-                    name: "Token Transfer",
+                        isToken: true,
-                    description: tokenSymbol
+                    },
-                        ? "Transfer " + tokenSymbol
+                    { label: "Spender", value: spender, address: spender },
-                        : "Transfer ERC-20 token",
+                    { label: "Amount", value: amountStr },
-                    details: [
+                ],
-                        {
+            };
                            label: "Token",
                            value: contractLabel,
                            address: toAddress,
                            isToken: true,
                        },
                        { label: "Recipient", value: to, address: to },
                        {
                            label: "Amount",
                            value: amountStr,
                            rawValue: amountRaw,
                        },
                    ],
                };
            }
        }
        if (parsed.name === "transfer") {
            const to = parsed.args[0];
            const rawAmount = parsed.args[1];
            const amountStr =
                formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
                (tokenSymbol ? " " + tokenSymbol : "");
            return {
                name: "Token Transfer",
                description: tokenSymbol
                    ? "Transfer " + tokenSymbol
                    : "Transfer ERC-20 token",
                details: [
                    {
                        label: "Token",
                        value: contractLabel,
                        address: toAddress,
                        isToken: true,
                    },
                    { label: "Recipient", value: to, address: to },
                    { label: "Amount", value: amountStr },
                ],
            };
        }
        return null;
    } catch {
-        // Not ERC-20 — fall through
+        return null;
    }
    // Try Uniswap Universal Router
    const routerResult = uniswap.decode(data, toAddress);
    if (routerResult) return routerResult;
    return null;
 }
 function showPhishingWarning(elementId, isPhishing) {
    const el = $(elementId);
    if (!el) return;
    // The background script performs the authoritative phishing domain check
    // and passes the result via the isPhishingDomain flag.
    if (isPhishing) {
        el.classList.remove("hidden");
    } else {
        el.classList.add("hidden");
    }
 }
 function showTxApproval(details) {
    showPhishingWarning(
        "approve-tx-phishing-warning",
        details.isPhishingDomain,
    );
    pendingTxParams = details.txParams;
    const toAddr = details.txParams.to;
    const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
    const ethValue = formatEther(details.txParams.value || "0");
@@ -180,41 +134,20 @@ function showTxApproval(details) {
    // If this is an ERC-20 call, try to extract the real recipient and amount
    const decoded = decodeCalldata(details.txParams.data, toAddr || "");
    if (decoded && decoded.details) {
        let decodedTokenAddr = null;
        let decodedTokenSymbol = null;
        for (const d of decoded.details) {
            if (d.label === "Recipient" && d.address) {
                pendingTxDetails.to = d.address;
            }
            if (d.label === "Amount") {
-                pendingTxDetails.amount = d.rawValue || d.value;
+                pendingTxDetails.amount = d.value;
            }
            if (d.label === "Token In" && d.isToken && d.address) {
                const t = TOKEN_BY_ADDRESS.get(d.address.toLowerCase());
                if (t) {
                    decodedTokenAddr = d.address;
                    decodedTokenSymbol = t.symbol;
                }
            }
        }
        if (token) {
            pendingTxDetails.token = toAddr;
            pendingTxDetails.tokenSymbol = token.symbol;
        } else if (decodedTokenAddr) {
            pendingTxDetails.token = decodedTokenAddr;
            pendingTxDetails.tokenSymbol = decodedTokenSymbol;
        }
    }
    // Carry decoded calldata info through to success/error views
    if (decoded) {
        pendingTxDetails.decoded = {
            name: decoded.name,
            description: decoded.description,
            details: decoded.details,
        };
    }
    $("approve-tx-hostname").textContent = details.hostname;
    $("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
@@ -226,19 +159,17 @@ function showTxApproval(details) {
            toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
        }
        toHtml += approvalAddressHtml(toAddr);
        if (symbol) {
            const link = etherscanTokenLink(toAddr);
            toHtml = toHtml.replace("</div>", "") + ""; // approvalAddressHtml already has etherscan link
        }
        $("approve-tx-to").innerHTML = toHtml;
    } else {
        $("approve-tx-to").innerHTML = escapeHtml("(contract creation)");
    }
    const ethValueFormatted = formatTxValue(
        formatEther(details.txParams.value || "0"),
    );
    const ethPrice = getPrice("ETH");
    const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
    const usdStr = formatUsd(ethUsd);
    $("approve-tx-value").textContent =
-        ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
+        formatTxValue(formatEther(details.txParams.value || "0")) + " ETH";
    // Decode calldata (reuse decoded from above)
    const decodedEl = $("approve-tx-decoded");
@@ -253,9 +184,12 @@ function showTxApproval(details) {
            detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
            if (d.address) {
                if (d.isToken) {
                    const tLink = etherscanTokenLink(d.address);
                    detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
                    detailsHtml += approvalAddressHtml(d.address);
                } else {
                    detailsHtml += approvalAddressHtml(d.address);
                }
                detailsHtml += approvalAddressHtml(d.address);
            } else {
                detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
            }
@@ -275,11 +209,7 @@ function showTxApproval(details) {
        $("approve-tx-data-section").classList.add("hidden");
    }
    $("approve-tx-password").value = "";
    hideError("approve-tx-error");
    showView("approve-tx");
    attachCopyHandlers("view-approve-tx");
 }
 function decodeHexMessage(hex) {
@@ -331,13 +261,7 @@ function formatTypedDataHtml(jsonStr) {
 }
 function showSignApproval(details) {
    showPhishingWarning(
        "approve-sign-phishing-warning",
        details.isPhishingDomain,
    );
    const sp = details.signParams;
    pendingSignParams = sp;
    $("approve-sign-hostname").textContent = details.hostname;
    $("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
@@ -360,25 +284,12 @@ function showSignApproval(details) {
        }
    }
    // Display danger warning for eth_sign (raw hash signing)
    const warningEl = $("approve-sign-danger-warning");
    if (warningEl) {
        if (sp.dangerWarning) {
            warningEl.textContent = sp.dangerWarning;
            warningEl.style.visibility = "visible";
        } else {
            warningEl.textContent = "";
            warningEl.style.visibility = "hidden";
        }
    }
    $("approve-sign-password").value = "";
-    hideError("approve-sign-error");
+    $("approve-sign-error").classList.add("hidden");
    $("btn-approve-sign").disabled = false;
    $("btn-approve-sign").classList.remove("text-muted");
    showView("approve-sign");
    attachCopyHandlers("view-approve-sign");
 }
 function show(id) {
@@ -397,52 +308,16 @@ function show(id) {
            showSignApproval(details);
            return;
        }
        // Site connection approval
        showPhishingWarning(
            "approve-site-phishing-warning",
            details.isPhishingDomain,
        );
        $("approve-hostname").textContent = details.hostname;
        $("approve-address").innerHTML = approvalAddressHtml(
            state.activeAddress,
        );
        attachCopyHandlers("view-approve-site");
        $("approve-remember").checked = state.rememberSiteChoice;
    });
 }
 let approvalId = null;
 let pendingTxDetails = null;
 // The exact parameters shown to the user, kept so the popup signs what it
 // displayed rather than re-fetching anything at approval time. Both are
 // repopulated by show() when the popup is closed and reopened.
 let pendingTxParams = null;
 let pendingSignParams = null;
 // Approve buttons stay disabled and muted while the popup derives the key and
 // signs, which is slow enough (Argon2id) that a double click is likely.
 function setTxButtonBusy(busy) {
    $("btn-approve-tx").disabled = busy;
    $("btn-approve-tx").classList.toggle("text-muted", busy);
 }
 function setSignButtonBusy(busy) {
    $("btn-approve-sign").disabled = busy;
    $("btn-approve-sign").classList.toggle("text-muted", busy);
 }
 // Locate the wallet and the address index owning the currently active
 // address. Returns null when no wallet holds it.
 function findActiveWallet() {
    for (const wallet of state.wallets) {
        for (let i = 0; i < wallet.addresses.length; i++) {
            if (wallet.addresses[i].address === state.activeAddress) {
                return { wallet, addrIndex: i };
            }
        }
    }
    return null;
 }
 function init(ctx) {
    $("approve-remember").addEventListener("change", async () => {
@@ -472,86 +347,34 @@ function init(ctx) {
        window.close();
    });
-    $("btn-approve-tx").addEventListener("click", async () => {
+    $("btn-approve-tx").addEventListener("click", () => {
-        let password = $("approve-tx-password").value;
+        const password = $("approve-tx-password").value;
        if (!password) {
-            showError("approve-tx-error", "Please enter your password.");
+            $("approve-tx-error").textContent = "Please enter your password.";
            $("approve-tx-error").classList.remove("hidden");
            return;
        }
-        hideError("approve-tx-error");
+        $("approve-tx-error").classList.add("hidden");
-        setTxButtonBusy(true);
+        $("btn-approve-tx").disabled = true;
        $("btn-approve-tx").classList.add("text-muted");
-        const active = findActiveWallet();
+        runtime.sendMessage(
-        if (!active) {
+            {
-            password = null;
+                type: "AUTISTMASK_TX_RESPONSE",
-            showError(
+                id: approvalId,
-                "approve-tx-error",
+                approved: true,
-                "No wallet was found for the active address.",
+                password: password,
-            );
+            },
-            setTxButtonBusy(false);
+            (response) => {
-            return;
+                if (response && response.txHash) {
-        }
+                    txStatus.showWait(pendingTxDetails, response.txHash);
-
+                } else {
-        // Decrypt here, in the popup. The password must never cross the
+                    const msg =
-        // extension messaging boundary; only the signed transaction does.
+                        (response && response.error) || "Transaction failed.";
-        let decryptedSecret;
+                    txStatus.showError(pendingTxDetails, null, msg);
-        try {
+                }
-            decryptedSecret = await decryptWithPassword(
+            },
-                active.wallet.encryptedSecret,
+        );
                password,
            );
        } catch {
            showError(
                "approve-tx-error",
                "That password is incorrect. Please try again.",
            );
            setTxButtonBusy(false);
            return;
        } finally {
            // Best-effort: drop the password as soon as the key derivation
            // is done. Note that JS strings are immutable; this clears the
            // reference but the original string may persist until GC.
            password = null;
        }
        const payload = {
            type: "AUTISTMASK_TX_RESPONSE",
            id: approvalId,
            approved: true,
        };
        try {
            const signer = getSignerForAddress(
                active.wallet,
                active.addrIndex,
                decryptedSecret,
            );
            const provider = getProvider(state.rpcUrl);
            const connected = signer.connect(provider);
            // This is the sequence ethers' own sendTransaction() runs
            // internally, so nonce, gas, fee and chain id population are
            // identical to when the background did the signing.
            const populated =
                await connected.populateTransaction(pendingTxParams);
            delete populated.from;
            payload.rawSignedTx = await connected.signTransaction(populated);
        } catch (e) {
            payload.error =
                e.shortMessage || e.message || "Transaction signing failed.";
        } finally {
            // Best-effort: clear the decrypted secret after use, with the
            // same immutability caveat as the password above.
            decryptedSecret = null;
        }
        runtime.sendMessage(payload, (response) => {
            if (response && response.txHash) {
                txStatus.showWait(pendingTxDetails, response.txHash);
            } else {
                const msg =
                    (response && response.error) || "Transaction failed.";
                txStatus.showError(pendingTxDetails, null, msg);
            }
        });
    });
    $("btn-reject-tx").addEventListener("click", () => {
@@ -563,93 +386,37 @@ function init(ctx) {
        window.close();
    });
-    $("btn-approve-sign").addEventListener("click", async () => {
+    $("btn-approve-sign").addEventListener("click", () => {
-        let password = $("approve-sign-password").value;
+        const password = $("approve-sign-password").value;
        if (!password) {
-            showError("approve-sign-error", "Please enter your password.");
+            $("approve-sign-error").textContent = "Please enter your password.";
            $("approve-sign-error").classList.remove("hidden");
            return;
        }
-        hideError("approve-sign-error");
+        $("approve-sign-error").classList.add("hidden");
-        setSignButtonBusy(true);
+        $("btn-approve-sign").disabled = true;
        $("btn-approve-sign").classList.add("text-muted");
-        const active = findActiveWallet();
+        runtime.sendMessage(
-        if (!active) {
+            {
-            password = null;
+                type: "AUTISTMASK_SIGN_RESPONSE",
-            showError(
+                id: approvalId,
-                "approve-sign-error",
+                approved: true,
-                "No wallet was found for the active address.",
+                password: password,
-            );
+            },
-            setSignButtonBusy(false);
+            (response) => {
-            return;
+                if (response && response.signature) {
-        }
+                    window.close();
-
+                } else {
-        // Decrypt here, in the popup. The password must never cross the
+                    const msg =
-        // extension messaging boundary; only the signature does.
+                        (response && response.error) || "Signing failed.";
-        let decryptedSecret;
+                    $("approve-sign-error").textContent = msg;
-        try {
+                    $("approve-sign-error").classList.remove("hidden");
-            decryptedSecret = await decryptWithPassword(
+                    $("btn-approve-sign").disabled = false;
-                active.wallet.encryptedSecret,
+                    $("btn-approve-sign").classList.remove("text-muted");
-                password,
+                }
-            );
+            },
-        } catch {
+        );
            showError(
                "approve-sign-error",
                "That password is incorrect. Please try again.",
            );
            setSignButtonBusy(false);
            return;
        } finally {
            // Best-effort: drop the password as soon as the key derivation
            // is done. Note that JS strings are immutable; this clears the
            // reference but the original string may persist until GC.
            password = null;
        }
        const payload = {
            type: "AUTISTMASK_SIGN_RESPONSE",
            id: approvalId,
            approved: true,
        };
        try {
            const signer = getSignerForAddress(
                active.wallet,
                active.addrIndex,
                decryptedSecret,
            );
            const sp = pendingSignParams;
            if (sp.method === "personal_sign" || sp.method === "eth_sign") {
                payload.signature = await signer.signMessage(
                    getBytes(sp.message),
                );
            } else {
                // eth_signTypedData_v4 / eth_signTypedData
                const typedData = JSON.parse(sp.typedData);
                const { domain, types, message } = typedData;
                // ethers handles EIP712Domain internally
                delete types.EIP712Domain;
                payload.signature = await signer.signTypedData(
                    domain,
                    types,
                    message,
                );
            }
        } catch (e) {
            payload.error = e.shortMessage || e.message || "Signing failed.";
        } finally {
            // Best-effort: clear the decrypted secret after use, with the
            // same immutability caveat as the password above.
            decryptedSecret = null;
        }
        runtime.sendMessage(payload, (response) => {
            if (response && response.signature) {
                window.close();
            } else {
                const msg = (response && response.error) || "Signing failed.";
                showError("approve-sign-error", msg);
                setSignButtonBusy(false);
            }
        });
    });
    $("btn-reject-sign").addEventListener("click", () => {
@@ -662,4 +429,4 @@ function init(ctx) {
    });
 }
-module.exports = { init, show, decodeCalldata };
+module.exports = { init, show };
--- a/src/popup/views/confirmTx.js
+++ b/src/popup/views/confirmTx.js
@@ -1,6 +1,6 @@
-// Transaction confirmation view with inline password.
+// Transaction confirmation view + password modal.
-// Shows transaction details, warnings, errors. On Sign & Send,
+// Shows transaction details, warnings, errors. On proceed, opens
-// reads inline password, decrypts secret, signs and broadcasts.
+// password modal, decrypts secret, signs and broadcasts.
 const {
    parseEther,
@@ -14,35 +14,36 @@ const {
    showError,
    hideError,
    showView,
    showFlash,
    flashCopyFeedback,
    addressTitle,
    addressDotHtml,
    escapeHtml,
    renderAddressHtml,
    attachCopyHandlers,
    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
-const {
+const { isScamAddress } = require("../../shared/scamlist");
-    getLocalWarnings,
+const { ERC20_ABI } = require("../../shared/constants");
    getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 let pendingTx = null;
-function restore() {
+function etherscanTokenLink(address) {
-    const d = state.viewData;
+    return `https://etherscan.io/token/${address}`;
-    if (d && d.pendingTx) {
+}
-        show(d.pendingTx);
+
-    }
+function etherscanAddressLink(address) {
    return `https://etherscan.io/address/${address}`;
 }
 function blockieHtml(address) {
@@ -52,10 +53,22 @@ function blockieHtml(address) {
 function confirmAddressHtml(address, ensName, title) {
    const blockie = blockieHtml(address);
-    return (
+    const dot = addressDotHtml(address);
-        `<div class="mb-1">${blockie}</div>` +
+    const link = etherscanAddressLink(address);
-        renderAddressHtml(address, { title, ensName })
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    );
+    let html = `<div class="mb-1">${blockie}</div>`;
    if (title) {
        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
    }
    if (ensName) {
        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
    }
    html +=
        `<div class="flex items-center">${title || ensName ? "" : dot}` +
        `<span class="break-all">${escapeHtml(address)}</span>` +
        extLink +
        `</div>`;
    return html;
 }
 function valueWithUsd(text, usdAmount) {
@@ -82,12 +95,11 @@ function show(txInfo) {
    // Token contract section (ERC-20 only)
    const tokenSection = $("confirm-token-section");
    if (isErc20) {
-        $("confirm-token-contract").innerHTML = renderAddressHtml(
+        const link = etherscanTokenLink(txInfo.token);
-            txInfo.token,
+        $("confirm-token-contract").innerHTML =
-            {},
+            escapeHtml(txInfo.token) +
-        );
+            ` <a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
        tokenSection.classList.remove("hidden");
        attachCopyHandlers(tokenSection);
    } else {
        tokenSection.classList.add("hidden");
    }
@@ -134,23 +146,28 @@ function show(txInfo) {
        $("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
    }
-    // Check for warnings (synchronous local checks)
+    // Check for warnings
-    const localWarnings = getLocalWarnings(txInfo.to, {
+    const warnings = [];
-        fromAddress: txInfo.from,
+    if (isScamAddress(txInfo.to)) {
-    });
+        warnings.push(
            "This address is on a known scam/fraud list. Do not send funds to this address.",
        );
    }
    if (txInfo.to.toLowerCase() === txInfo.from.toLowerCase()) {
        warnings.push("You are sending to your own address.");
    }
    const warningsEl = $("confirm-warnings");
-    if (localWarnings.length > 0) {
+    if (warnings.length > 0) {
-        warningsEl.innerHTML = localWarnings
+        warningsEl.innerHTML = warnings
            .map(
                (w) =>
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
            )
            .join("");
-        warningsEl.style.visibility = "visible";
+        warningsEl.classList.remove("hidden");
    } else {
-        warningsEl.innerHTML = "";
+        warningsEl.classList.add("hidden");
        warningsEl.style.visibility = "hidden";
    }
    // Check for errors
@@ -188,40 +205,21 @@ function show(txInfo) {
        errorsEl.innerHTML = errors
            .map((e) => `<div class="text-xs">${e}</div>`)
            .join("");
-        errorsEl.style.visibility = "visible";
+        errorsEl.classList.remove("hidden");
        sendBtn.disabled = true;
        sendBtn.classList.add("text-muted");
    } else {
-        errorsEl.innerHTML = "";
+        errorsEl.classList.add("hidden");
        errorsEl.style.visibility = "hidden";
        sendBtn.disabled = false;
        sendBtn.classList.remove("text-muted");
    }
    // Reset password field and error
    $("confirm-tx-password").value = "";
    hideError("confirm-tx-password-error");
    // Gas estimate — show placeholder then fetch async
-    $("confirm-fee").style.visibility = "visible";
+    $("confirm-fee").classList.remove("hidden");
    $("confirm-fee-amount").textContent = "Estimating...";
    state.viewData = { pendingTx: txInfo };
    showView("confirm-tx");
    attachCopyHandlers("view-confirm-tx");
    // Reset async warnings to hidden (space always reserved, no layout shift)
    $("confirm-recipient-warning").style.visibility = "hidden";
    $("confirm-contract-warning").style.visibility = "hidden";
    $("confirm-burn-warning").style.visibility = "hidden";
    $("confirm-etherscan-warning").style.visibility = "hidden";
    // Show burn warning via reserved element (in addition to inline warning)
    if (isBurnAddress(txInfo.to)) {
        $("confirm-burn-warning").style.visibility = "visible";
    }
    estimateGas(txInfo);
    checkRecipientHistory(txInfo);
 }
 async function estimateGas(txInfo) {
@@ -264,42 +262,39 @@ async function estimateGas(txInfo) {
    }
 }
-async function checkRecipientHistory(txInfo) {
+function showPasswordModal() {
-    try {
+    $("modal-password").value = "";
-        const provider = getProvider(state.rpcUrl);
+    hideError("modal-password-error");
-        const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
+    $("password-modal").classList.remove("hidden");
-            fromAddress: txInfo.from,
+}
-        });
+
-        for (const w of asyncWarnings) {
+function hidePasswordModal() {
-            if (w.type === "contract") {
+    $("password-modal").classList.add("hidden");
                $("confirm-contract-warning").style.visibility = "visible";
            }
            if (w.type === "new-address") {
                $("confirm-recipient-warning").style.visibility = "visible";
            }
            if (w.type === "etherscan-phishing") {
                $("confirm-etherscan-warning").style.visibility = "visible";
            }
        }
    } catch (e) {
        log.errorf("recipient history check failed:", e.message);
    }
 }
 function init(ctx) {
-    $("btn-confirm-send").addEventListener("click", async () => {
+    $("btn-confirm-send").addEventListener("click", () => {
-        const password = $("confirm-tx-password").value;
+        showPasswordModal();
    });
    $("btn-confirm-back").addEventListener("click", () => {
        showView("send");
    });
    $("btn-modal-cancel").addEventListener("click", () => {
        hidePasswordModal();
    });
    $("btn-modal-confirm").addEventListener("click", async () => {
        const password = $("modal-password").value;
        if (!password) {
-            showError(
+            showError("modal-password-error", "Please enter your password.");
                "confirm-tx-password-error",
                "Please enter your password.",
            );
            return;
        }
        const wallet = state.wallets[state.selectedWallet];
        let decryptedSecret;
-        hideError("confirm-tx-password-error");
+        hideError("modal-password-error");
        try {
            decryptedSecret = await decryptWithPassword(
@@ -307,12 +302,11 @@ function init(ctx) {
                password,
            );
        } catch (e) {
-            showError("confirm-tx-password-error", "Wrong password.");
+            showError("modal-password-error", "Wrong password.");
            return;
        }
-        $("btn-confirm-send").disabled = true;
+        hidePasswordModal();
        $("btn-confirm-send").classList.add("text-muted");
        let tx;
        try {
@@ -340,24 +334,12 @@ function init(ctx) {
                tx = await contract.transfer(pendingTx.to, amount);
            }
            // Best-effort: clear decrypted secret after use.
            // Note: JS strings are immutable; this nulls the reference but
            // the original string may persist in memory until GC.
            decryptedSecret = null;
            txStatus.showWait(pendingTx, tx.hash);
        } catch (e) {
            decryptedSecret = null;
            const hash = tx ? tx.hash : null;
            txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
        } finally {
            $("btn-confirm-send").disabled = false;
            $("btn-confirm-send").classList.remove("text-muted");
        }
    });
    $("btn-confirm-back").addEventListener("click", () => {
        goBack();
    });
 }
-module.exports = { init, show, restore };
+module.exports = { init, show };
--- a/src/popup/views/deleteWallet.js
+++ b/src/popup/views/deleteWallet.js
@@ -1,96 +0,0 @@
 const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
 const {
    removeWalletFromState,
    broadcastActiveChanged,
 } = require("../../shared/walletDelete");
 let deleteWalletIndex = null;
 let ctx = null;
 function show(walletIdx) {
    deleteWalletIndex = walletIdx;
    const wallet = state.wallets[walletIdx];
    $("delete-wallet-name").textContent =
        wallet.name || "Wallet " + (walletIdx + 1);
    $("delete-wallet-password").value = "";
    $("delete-wallet-flash").textContent = "";
    $("delete-wallet-flash").style.visibility = "hidden";
    showView("delete-wallet-confirm");
 }
 function init(_ctx) {
    ctx = _ctx;
    $("btn-delete-wallet-back").addEventListener("click", () => {
        deleteWalletIndex = null;
        goBack();
    });
    $("btn-delete-wallet-confirm").addEventListener("click", async () => {
        const pw = $("delete-wallet-password").value;
        if (!pw) {
            $("delete-wallet-flash").textContent =
                "Please enter your password.";
            $("delete-wallet-flash").style.visibility = "visible";
            return;
        }
        if (deleteWalletIndex === null) {
            $("delete-wallet-flash").textContent =
                "No wallet selected for deletion.";
            $("delete-wallet-flash").style.visibility = "visible";
            return;
        }
        const btn = $("btn-delete-wallet-confirm");
        btn.disabled = true;
        btn.classList.add("text-muted");
        const walletIdx = deleteWalletIndex;
        const wallet = state.wallets[walletIdx];
        // Verify password against the wallet's encrypted data
        try {
            await decryptWithPassword(wallet.encryptedSecret, pw);
        } catch (_e) {
            $("delete-wallet-flash").textContent = "Wrong password.";
            $("delete-wallet-flash").style.visibility = "visible";
            btn.disabled = false;
            btn.classList.remove("text-muted");
            return;
        }
        // Remove the wallet and repair selection, permissions and hasWallet
        const { activeAddressChanged } = removeWalletFromState(
            state,
            walletIdx,
        );
        deleteWalletIndex = null;
        if (!state.hasWallet) {
            clearViewStack();
            await saveState();
            // Save before broadcasting: the background reads the active
            // address back out of storage to build accountsChanged.
            if (activeAddressChanged) broadcastActiveChanged();
            showView("welcome");
        } else {
            await saveState();
            if (activeAddressChanged) broadcastActiveChanged();
            // Reset stack to [main] so Settings back goes home.
            // Use require() lazily to avoid circular dependency
            // (settings.js requires deleteWallet.js).
            clearViewStack();
            state.viewStack.push("main");
            ctx.renderWalletList();
            const settings = require("./settings");
            settings.show();
            showFlash("Wallet deleted.");
        }
    });
 }
 module.exports = { init, show };
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -1,18 +1,17 @@
 // Shared DOM helpers used by all views.
-const { isDebug } = require("../../shared/log");
+const { DEBUG } = require("../../shared/constants");
 const {
    formatUsd,
    getPrice,
    getAddressValueUsd,
 } = require("../../shared/prices");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
 const VIEWS = [
    "welcome",
    "add-wallet",
    "import-key",
    "main",
    "address",
    "address-token",
@@ -24,13 +23,10 @@ const VIEWS = [
    "receive",
    "add-token",
    "settings",
    "delete-wallet-confirm",
    "settings-addtoken",
    "transaction",
    "approve-site",
    "approve-tx",
    "approve-sign",
    "export-privkey",
 ];
 function $(id) {
@@ -40,13 +36,11 @@ function $(id) {
 function showError(id, msg) {
    const el = $(id);
    el.textContent = msg;
-    el.style.visibility = "visible";
+    el.classList.remove("hidden");
 }
 function hideError(id) {
-    const el = $(id);
+    $(id).classList.add("hidden");
    el.textContent = "";
    el.style.visibility = "hidden";
 }
 function showView(name) {
@@ -59,77 +53,14 @@ function showView(name) {
    clearFlash();
    state.currentView = name;
    saveState();
-    updateDebugBanner(name);
+    if (DEBUG) {
-}
+        const banner = document.getElementById("debug-banner");
-
+        if (banner) {
-// Create or update the debug/insecure warning banner.
+            banner.textContent = "DEBUG / INSECURE (" + name + ")";
 // Called on every view switch and after the settings debug toggle changes.
 // The banner is shown when the compile-time DEBUG constant is true OR when
 // the user has enabled runtime debug mode via the settings easter egg, OR
 // when the active network is a testnet.
 function updateDebugBanner(viewName) {
    const debug = isDebug();
    const net = currentNetwork();
    const show = debug || net.isTestnet;
    let banner = document.getElementById("debug-banner");
    if (show) {
        if (!banner) {
            banner = document.createElement("div");
            banner.id = "debug-banner";
            banner.style.cssText =
                "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
            document.body.prepend(banner);
        }
        const suffix = viewName ? " (" + viewName + ")" : "";
        if (debug && net.isTestnet) {
            banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
        } else if (net.isTestnet) {
            banner.textContent = "[TESTNET]" + suffix;
        } else {
            banner.textContent = "DEBUG / INSECURE" + suffix;
        }
    } else if (banner) {
        banner.remove();
    }
 }
 // Callback to re-render the main/home view when navigating back to it.
 // Set once by index.js via setRenderMain().
 let _renderMain = null;
 function setRenderMain(fn) {
    _renderMain = fn;
 }
 // Push the current view onto the navigation stack so goBack() can
 // return to it.  Call this before any forward navigation.
 function pushCurrentView() {
    if (state.currentView) {
        state.viewStack.push(state.currentView);
    }
 }
 // Pop the navigation stack and show the previous view.  If the stack
 // is empty, fall back to the main (home) view.
 function goBack() {
    let target;
    if (state.viewStack.length > 0) {
        target = state.viewStack.pop();
    } else {
        target = "main";
    }
    if (target === "main" && _renderMain) {
        _renderMain();
    }
    showView(target);
 }
 // Clear the entire navigation stack (used when resetting to root,
 // e.g. after adding or deleting a wallet).
 function clearViewStack() {
    state.viewStack = [];
 }
 let flashTimer = null;
 function clearFlash() {
@@ -151,7 +82,7 @@ function showFlash(msg, duration = 2000) {
 function balanceLine(symbol, amount, price, tokenId) {
    const qty = amount.toFixed(4);
-    const usd = price ? formatUsd(amount * price) || "&nbsp;" : "&nbsp;";
+    const usd = price ? formatUsd(amount * price) : "";
    const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
    const clickClass = tokenId
        ? " cursor-pointer hover:bg-hover balance-row"
@@ -200,18 +131,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
    return html;
 }
 // Truncate the middle of a string, replacing removed characters with "…".
 // Safety: refuses to truncate more than 10 characters, which is the maximum
 // that still prevents address spoofing attacks (see Display Consistency in
 // README).  Callers that need to display less should use a different UI
 // approach rather than silently making addresses insecure.
 function truncateMiddle(str, maxLen) {
    if (str.length <= maxLen) return str;
-    const removed = str.length - maxLen + 1; // +1 for the ellipsis char
+    if (maxLen < 5) return str.slice(0, maxLen);
    if (removed > 10) {
        maxLen = str.length - 10 + 1;
    }
    if (maxLen >= str.length) return str;
    const half = Math.floor((maxLen - 1) / 2);
    return str.slice(0, half) + "\u2026" + str.slice(-(maxLen - 1 - half));
 }
@@ -271,163 +193,21 @@ function addressTitle(address, wallets) {
 // Render an address with color dot, optional ENS name, optional title,
 // and optional truncation. Title and ENS are shown as bold labels above
 // the full address.
 // Delegates to renderAddressHtml for consistent output.
 function formatAddressHtml(address, ensName, maxLen, title) {
    return renderAddressHtml(address, { title, ensName, maxLen });
 }
 function isoDate(timestamp) {
    const d = new Date(timestamp * 1000);
    const pad = (n) => String(n).padStart(2, "0");
    if (state.utcTimestamps) {
        return (
            d.getUTCFullYear() +
            "-" +
            pad(d.getUTCMonth() + 1) +
            "-" +
            pad(d.getUTCDate()) +
            "T" +
            pad(d.getUTCHours()) +
            ":" +
            pad(d.getUTCMinutes()) +
            ":" +
            pad(d.getUTCSeconds()) +
            "Z"
        );
    }
    const offsetMin = -d.getTimezoneOffset();
    const sign = offsetMin >= 0 ? "+" : "-";
    const absOff = Math.abs(offsetMin);
    const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
    return (
        d.getFullYear() +
        "-" +
        pad(d.getMonth() + 1) +
        "-" +
        pad(d.getDate()) +
        "T" +
        pad(d.getHours()) +
        ":" +
        pad(d.getMinutes()) +
        ":" +
        pad(d.getSeconds()) +
        tzStr
    );
 }
 function timeAgo(timestamp) {
    const seconds = Math.floor(Date.now() / 1000 - timestamp);
    if (seconds < 60) return seconds + " seconds ago";
    const minutes = Math.floor(seconds / 60);
    if (minutes < 60)
        return minutes + " minute" + (minutes !== 1 ? "s" : "") + " ago";
    const hours = Math.floor(minutes / 60);
    if (hours < 24) return hours + " hour" + (hours !== 1 ? "s" : "") + " ago";
    const days = Math.floor(hours / 24);
    if (days < 30) return days + " day" + (days !== 1 ? "s" : "") + " ago";
    const months = Math.floor(days / 30);
    if (months < 12)
        return months + " month" + (months !== 1 ? "s" : "") + " ago";
    const years = Math.floor(days / 365);
    return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 // Shared external-link icon SVG used across all views.
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 function etherscanAddressUrl(address) {
    return `${currentNetwork().explorerUrl}/address/${address}`;
 }
 function etherscanLinkHtml(url) {
    return (
        `<a href="${url}" target="_blank" rel="noopener" ` +
        `class="inline-flex items-center">${EXT_ICON}</a>`
    );
 }
 // Render a copyable text span with dashed underline affordance.
 // The caller must attach click handlers via attachCopyHandlers() or
 // manually wire up [data-copy] elements after inserting the HTML.
 function copyableHtml(text, extraClass) {
    const cls =
        "underline decoration-dashed cursor-pointer" +
        (extraClass ? " " + extraClass : "");
    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
 }
 // Attach click-to-copy handlers to all [data-copy] elements within
 // a container.  Safe to call multiple times on the same container.
 function attachCopyHandlers(container) {
    const root =
        typeof container === "string"
            ? document.getElementById(container)
            : container;
    if (!root) return;
    root.querySelectorAll("[data-copy]").forEach((el) => {
        el.onclick = () => {
            navigator.clipboard.writeText(el.dataset.copy);
            showFlash("Copied!");
            flashCopyFeedback(el);
        };
    });
 }
 // Unified address rendering.
 //
 // Produces consistent HTML for any Ethereum address:
 //   • Color dot
 //   • Optional title (e.g. "Wallet 1 — Address 2") shown bold above address
 //   • Optional ENS name shown bold above address
 //   • Full address (or truncated via maxLen) with dashed-underline click-to-copy
 //   • Etherscan external link icon
 //
 // Options object:
 //   title    — wallet title string (from addressTitle)
 //   ensName  — ENS name string
 //   maxLen   — if set, truncate address display (min 32 chars enforced)
 //   noLink   — if true, omit etherscan link
 //
 // After inserting the returned HTML into the DOM, call
 // attachCopyHandlers() on the parent to wire up click-to-copy.
 function renderAddressHtml(address, opts) {
    const { title, ensName, maxLen, noLink } = opts || {};
    const dot = addressDotHtml(address);
    const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
    const link = etherscanAddressUrl(address);
    const extLink = noLink ? "" : etherscanLinkHtml(link);
    let html = "";
    if (title) {
        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
    }
    if (ensName) {
        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
    }
    if (title || ensName) {
-        html += `<div class="flex items-center">${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
+        let html = "";
-    } else {
+        if (title) {
-        html += `<div class="flex items-center">${dot}${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
+            html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
        }
        if (ensName) {
            html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
        }
        html += `<div class="break-all">${escapeHtml(displayAddr)}</div>`;
        return html;
    }
-    return html;
+    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(displayAddr)}</span></div>`;
 }
 function flashCopyFeedback(el) {
    if (!el) return;
    el.classList.remove("copy-flash-fade");
    el.classList.add("copy-flash-active");
    setTimeout(() => {
        el.classList.remove("copy-flash-active");
        el.classList.add("copy-flash-fade");
        setTimeout(() => {
            el.classList.remove("copy-flash-fade");
        }, 275);
    }, 75);
 }
 module.exports = {
@@ -435,13 +215,7 @@ module.exports = {
    showError,
    hideError,
    showView,
    updateDebugBanner,
    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
    showFlash,
    flashCopyFeedback,
    balanceLine,
    balanceLinesForAddress,
    addressColor,
@@ -449,13 +223,5 @@ module.exports = {
    escapeHtml,
    addressTitle,
    formatAddressHtml,
    renderAddressHtml,
    copyableHtml,
    attachCopyHandlers,
    etherscanAddressUrl,
    etherscanLinkHtml,
    EXT_ICON,
    truncateMiddle,
    isoDate,
    timeAgo,
 };
--- a/src/popup/views/home.js
+++ b/src/popup/views/home.js
@@ -2,24 +2,13 @@ const {
    $,
    showView,
    showFlash,
    flashCopyFeedback,
    balanceLinesForAddress,
    isoDate,
    timeAgo,
    addressDotHtml,
    addressTitle,
    escapeHtml,
    truncateMiddle,
    renderAddressHtml,
    attachCopyHandlers,
    pushCurrentView,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
    updateSendBalance,
    renderSendTokenSelect,
    resetSendValidation,
 } = require("./send");
 const { deriveAddressFromXpub } = require("../../shared/wallet");
 const {
    formatUsd,
@@ -49,15 +38,13 @@ function renderTotalValue() {
    const ethPrice = getPrice("ETH");
    if (priceEl) {
-        priceEl.innerHTML = ethPrice
+        priceEl.textContent = ethPrice ? formatUsd(ethPrice) + " USD/ETH" : "";
            ? formatUsd(ethPrice) + " USD/ETH"
            : "&nbsp;";
    }
    const addr = findActiveAddr();
    if (!addr) {
-        el.innerHTML = "&nbsp;";
+        el.textContent = "";
-        if (subEl) subEl.innerHTML = "&nbsp;";
+        if (subEl) subEl.textContent = "";
        return;
    }
    const ethBal = parseFloat(addr.balance || "0");
@@ -67,22 +54,72 @@ function renderTotalValue() {
    if (subEl) {
        const totalUsd = getAddressValueUsd(addr);
-        subEl.innerHTML =
+        subEl.textContent =
-            totalUsd !== null ? "Total: " + formatUsd(totalUsd) : "&nbsp;";
+            totalUsd !== null ? "Total: " + formatUsd(totalUsd) : "";
    }
 }
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 function renderActiveAddress() {
    const el = $("active-address-display");
    if (!el) return;
    if (state.activeAddress) {
-        el.innerHTML = renderAddressHtml(state.activeAddress);
+        const addr = state.activeAddress;
-        attachCopyHandlers(el);
+        const dot = addressDotHtml(addr);
        const link = `https://etherscan.io/address/${addr}`;
        el.innerHTML =
            `<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
        $("active-addr-copy").addEventListener("click", () => {
            navigator.clipboard.writeText(addr);
            showFlash("Copied!");
        });
    } else {
        el.textContent = "";
    }
 }
 function timeAgo(timestamp) {
    const seconds = Math.floor(Date.now() / 1000 - timestamp);
    if (seconds < 60) return seconds + " seconds ago";
    const minutes = Math.floor(seconds / 60);
    if (minutes < 60)
        return minutes + " minute" + (minutes !== 1 ? "s" : "") + " ago";
    const hours = Math.floor(minutes / 60);
    if (hours < 24) return hours + " hour" + (hours !== 1 ? "s" : "") + " ago";
    const days = Math.floor(hours / 24);
    if (days < 30) return days + " day" + (days !== 1 ? "s" : "") + " ago";
    const months = Math.floor(days / 30);
    if (months < 12)
        return months + " month" + (months !== 1 ? "s" : "") + " ago";
    const years = Math.floor(days / 365);
    return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 function isoDate(timestamp) {
    const d = new Date(timestamp * 1000);
    const pad = (n) => String(n).padStart(2, "0");
    return (
        d.getFullYear() +
        "-" +
        pad(d.getMonth() + 1) +
        "-" +
        pad(d.getDate()) +
        " " +
        pad(d.getHours()) +
        ":" +
        pad(d.getMinutes()) +
        ":" +
        pad(d.getSeconds())
    );
 }
 let homeTxs = [];
 function renderHomeTxList(ctx) {
@@ -96,22 +133,13 @@ function renderHomeTxList(ctx) {
    let html = "";
    let i = 0;
    for (const tx of homeTxs) {
-        // For swap transactions, show the user's own labelled wallet
+        const counterparty = tx.direction === "sent" ? tx.to : tx.from;
        // address (the one that initiated the swap) instead of the
        // contract address which is not useful in the list view.
        const counterparty =
            tx.direction === "contract" && tx.directionLabel === "Swap"
                ? tx.from
                : tx.direction === "sent" || tx.direction === "contract"
                  ? tx.to
                  : tx.from;
        const dirLabel = tx.directionLabel;
        const amountStr = tx.value
            ? escapeHtml(tx.value + " " + tx.symbol)
            : escapeHtml(tx.symbol);
-        const title = addressTitle(counterparty, state.wallets);
+        const maxAddr = Math.max(10, 36 - Math.max(0, amountStr.length - 10));
-        const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
+        const displayAddr = truncateMiddle(counterparty, maxAddr);
        const displayAddr = title || truncateMiddle(counterparty, maxAddr);
        const addrStr = escapeHtml(displayAddr);
        const dot = addressDotHtml(counterparty);
        const err = tx.isError ? " (failed)" : "";
@@ -228,7 +256,7 @@ function render(ctx) {
        html += `<div>`;
        html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
-        if (wallet.type === "hd" || wallet.type === "xprv") {
+        if (wallet.type === "hd") {
            html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
        }
        html += `</div>`;
@@ -248,7 +276,7 @@ function render(ctx) {
            html += `<span class="flex-shrink-0 ml-1">${infoBtn}</span>`;
            html += `</div>`;
            const addrUsd = formatUsd(getAddressValueUsd(addr));
-            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || "&nbsp;"}</div>`;
+            html += `<div class="text-xs text-muted text-right">${addrUsd}</div>`;
            html += balanceLinesForAddress(
                addr,
                state.trackedTokens,
@@ -381,8 +409,6 @@ function init(ctx) {
        $("send-token-static").classList.add("hidden");
        renderSendTokenSelect(addr);
        updateSendBalance();
        resetSendValidation();
        pushCurrentView();
        showView("send");
    });
--- a/src/popup/views/importKey.js
+++ b/src/popup/views/importKey.js
@@ -0,0 +1,69 @@
 const { $, showView, showFlash } = require("./helpers");
 const { addressFromPrivateKey } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
 function show() {
    $("import-private-key").value = "";
    $("import-key-password").value = "";
    $("import-key-password-confirm").value = "";
    showView("import-key");
 }
 function init(ctx) {
    $("btn-import-key-confirm").addEventListener("click", async () => {
        const key = $("import-private-key").value.trim();
        if (!key) {
            showFlash("Please enter your private key.");
            return;
        }
        let addr;
        try {
            addr = addressFromPrivateKey(key);
        } catch (e) {
            showFlash("Invalid private key.");
            return;
        }
        const pw = $("import-key-password").value;
        const pw2 = $("import-key-password-confirm").value;
        if (!pw) {
            showFlash("Please choose a password.");
            return;
        }
        if (pw.length < 8) {
            showFlash("Password must be at least 8 characters.");
            return;
        }
        if (pw !== pw2) {
            showFlash("Passwords do not match.");
            return;
        }
        const encrypted = await encryptWithPassword(key, pw);
        const walletNum = state.wallets.length + 1;
        state.wallets.push({
            type: "key",
            name: "Wallet " + walletNum,
            encryptedSecret: encrypted,
            addresses: [
                { address: addr, balance: "0.0000", tokenBalances: [] },
            ],
        });
        state.hasWallet = true;
        await saveState();
        ctx.renderWalletList();
        showView("main");
        ctx.doRefreshAndRender();
    });
    $("btn-import-key-back").addEventListener("click", () => {
        if (!state.hasWallet) {
            showView("welcome");
        } else {
            ctx.renderWalletList();
            showView("main");
        }
    });
 }
 module.exports = { init, show };
--- a/src/popup/views/receive.js
+++ b/src/popup/views/receive.js
@@ -1,27 +1,23 @@
-const {
+const { $, showView, showFlash, addressDotHtml } = require("./helpers");
-    $,
+const { state, currentAddress } = require("../../shared/state");
    showView,
    showFlash,
    flashCopyFeedback,
    formatAddressHtml,
    addressTitle,
    attachCopyHandlers,
    goBack,
 } = require("./helpers");
 const { state, currentAddress, currentNetwork } = require("../../shared/state");
 const QRCode = require("qrcode");
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 function show() {
    const addr = currentAddress();
    const address = addr ? addr.address : "";
-    const title = address ? addressTitle(address, state.wallets) : null;
+    $("receive-dot").innerHTML = address ? addressDotHtml(address) : "";
-    const ensName = addr ? addr.ensName || null : null;
+    $("receive-address").textContent = address;
-    $("receive-address-block").innerHTML = address
+    const link = address ? `https://etherscan.io/address/${address}` : "";
-        ? formatAddressHtml(address, ensName, null, title)
+    $("receive-etherscan-link").innerHTML = link
        ? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
        : "";
    $("receive-address-block").dataset.full = address;
    // Etherscan link is now included in formatAddressHtml via renderAddressHtml
    $("receive-etherscan-link").innerHTML = "";
    if (address) {
        QRCode.toCanvas($("receive-qr"), address, {
            width: 200,
@@ -45,30 +41,29 @@ function show() {
        warningEl.textContent =
            "This is an ERC-20 token. Only send " +
            symbol +
-            " on " +
+            " on the Ethereum network to this address. Sending tokens on other networks will result in permanent loss.";
-            currentNetwork().name +
+        warningEl.classList.remove("hidden");
            " to this address. Sending tokens on other networks will result in permanent loss.";
        warningEl.style.visibility = "visible";
    } else {
-        warningEl.textContent = "";
+        warningEl.classList.add("hidden");
        warningEl.style.visibility = "hidden";
    }
    showView("receive");
    attachCopyHandlers("view-receive");
 }
 function init(ctx) {
    $("btn-receive-copy").addEventListener("click", () => {
-        const addr = $("receive-address-block").dataset.full;
+        const addr = $("receive-address").textContent;
        if (addr) {
            navigator.clipboard.writeText(addr);
            showFlash("Copied!");
            flashCopyFeedback($("receive-address-block"));
        }
    });
    $("btn-receive-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
            ctx.showAddressToken();
        } else {
            ctx.showAddressDetail();
        }
    });
 }
--- a/src/popup/views/send.js
+++ b/src/popup/views/send.js
@@ -1,119 +1,17 @@
 // Send view: collect To, Amount, Token. Then go to confirmation.
-const {
+const { $, showFlash, addressDotHtml, escapeHtml } = require("./helpers");
    $,
    showFlash,
    addressTitle,
    escapeHtml,
    renderAddressHtml,
    attachCopyHandlers,
    goBack,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
-const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../../shared/tokenList");
 const { getAddress } = require("ethers");
-const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+const EXT_ICON =
-
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
-/**
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
- * Validate a destination address string.
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
- * Returns { valid: true } or { valid: false, error: "..." }.
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
- */
+    `</svg></span>`;
 function validateToAddress(value) {
    const v = value.trim();
    if (!v) return { valid: false, error: "" };
    // ENS names: contains a dot and doesn't start with 0x
    if (v.includes(".") && !v.startsWith("0x")) {
        // Basic ENS format check: at least one label before and after dot
        if (/^[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+$/.test(v)) {
            return { valid: true };
        }
        return {
            valid: false,
            error: "Please enter a valid ENS name.",
        };
    }
    // Must look like an Ethereum address
    if (!/^0x[0-9a-fA-F]{40}$/.test(v)) {
        return {
            valid: false,
            error: "Please enter a valid Ethereum address.",
        };
    }
    // Reject zero address
    if (v.toLowerCase() === ZERO_ADDRESS) {
        return {
            valid: false,
            error: "Sending to the zero address is not allowed.",
        };
    }
    // EIP-55 checksum validation: all-lowercase is ok, otherwise must match checksum
    if (v !== v.toLowerCase()) {
        try {
            const checksummed = getAddress(v);
            if (checksummed !== v) {
                return {
                    valid: false,
                    error: "Address checksum is invalid. Please double-check the address.",
                };
            }
        } catch {
            return {
                valid: false,
                error: "Address checksum is invalid. Please double-check the address.",
            };
        }
    }
    // Warn if sending to own address
    const addr = currentAddress();
    if (addr && v.toLowerCase() === addr.address.toLowerCase()) {
        // Allow but will warn — we return valid with a warning
        return {
            valid: true,
            warning: "This is your own address. Are you sure?",
        };
    }
    return { valid: true };
 }
 function updateToValidation() {
    const input = $("send-to");
    const errorEl = $("send-to-error");
    const btn = $("btn-send-review");
    const value = input.value.trim();
    if (!value) {
        errorEl.textContent = "";
        btn.disabled = true;
        btn.classList.add("opacity-50");
        return;
    }
    const result = validateToAddress(value);
    if (!result.valid) {
        errorEl.textContent = result.error;
        errorEl.style.color = "#cc0000";
        btn.disabled = true;
        btn.classList.add("opacity-50");
    } else if (result.warning) {
        errorEl.textContent = result.warning;
        errorEl.style.color = "#b8860b";
        btn.disabled = false;
        btn.classList.remove("opacity-50");
    } else {
        errorEl.textContent = "";
        btn.disabled = false;
        btn.classList.remove("opacity-50");
    }
 }
 function isSpoofedToken(t) {
    const upper = (t.symbol || "").toUpperCase();
@@ -143,12 +41,17 @@ function renderSendTokenSelect(addr) {
 function updateSendBalance() {
    const addr = currentAddress();
    if (!addr) return;
-    const title = addressTitle(addr.address, state.wallets);
+    const dot = addressDotHtml(addr.address);
-    $("send-from").innerHTML = renderAddressHtml(addr.address, {
+    const link = `https://etherscan.io/address/${addr.address}`;
-        title,
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-        ensName: addr.ensName,
+    let fromHtml = "";
-    });
+    if (addr.ensName) {
-    attachCopyHandlers($("send-from"));
+        fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(addr.ensName)}</div>`;
        fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
    } else {
        fromHtml += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(addr.address)}</span>${extLink}</div>`;
    }
    $("send-from").innerHTML = fromHtml;
    const token = state.selectedToken || $("send-token").value;
    if (token === "ETH") {
        $("send-balance").textContent =
@@ -157,11 +60,7 @@ function updateSendBalance() {
        const tb = (addr.tokenBalances || []).find(
            (t) => t.address.toLowerCase() === token.toLowerCase(),
        );
-        const symbol = resolveSymbol(
+        const symbol = tb ? tb.symbol : "?";
            token,
            addr.tokenBalances,
            state.trackedTokens,
        );
        const bal = tb ? tb.balance || "0" : "0";
        $("send-balance").textContent =
            "Current balance: " + bal + " " + symbol;
@@ -172,13 +71,6 @@ function init(_ctx) {
    ctx = _ctx;
    $("send-token").addEventListener("change", updateSendBalance);
    // Initial state: disable review button until address is entered
    $("btn-send-review").disabled = true;
    $("btn-send-review").classList.add("opacity-50");
    // Validate address on input
    $("send-to").addEventListener("input", updateToValidation);
    $("btn-send-review").addEventListener("click", async () => {
        const to = $("send-to").value.trim();
        const amount = $("send-amount").value.trim();
@@ -186,15 +78,6 @@ function init(_ctx) {
            showFlash("Please enter a recipient address.");
            return;
        }
        // Re-validate before proceeding
        const validation = validateToAddress(to);
        if (!validation.valid) {
            showFlash(
                validation.error || "Please enter a valid Ethereum address.",
            );
            return;
        }
        if (!amount || isNaN(parseFloat(amount)) || parseFloat(amount) <= 0) {
            showFlash("Please enter a valid amount.");
            return;
@@ -228,11 +111,7 @@ function init(_ctx) {
            const tb = (addr.tokenBalances || []).find(
                (t) => t.address.toLowerCase() === token.toLowerCase(),
            );
-            tokenSymbol = resolveSymbol(
+            tokenSymbol = tb ? tb.symbol : "?";
                token,
                addr.tokenBalances,
                state.trackedTokens,
            );
            tokenBalance = tb ? tb.balance || "0" : "0";
        }
@@ -251,23 +130,12 @@ function init(_ctx) {
    $("btn-send-back").addEventListener("click", () => {
        $("send-token").classList.remove("hidden");
        $("send-token-static").classList.add("hidden");
-        goBack();
+        if (state.selectedToken) {
            ctx.showAddressToken();
        } else {
            ctx.showAddressDetail();
        }
    });
 }
-function resetSendValidation() {
+module.exports = { init, updateSendBalance, renderSendTokenSelect };
    const errorEl = $("send-to-error");
    const btn = $("btn-send-review");
    if (errorEl) errorEl.textContent = "";
    if (btn) {
        btn.disabled = true;
        btn.classList.add("opacity-50");
    }
 }
 module.exports = {
    init,
    updateSendBalance,
    renderSendTokenSelect,
    resetSendValidation,
 };
--- a/src/popup/views/settings.js
+++ b/src/popup/views/settings.js
@@ -1,34 +1,11 @@
-const {
+const { $, showView, showFlash } = require("./helpers");
-    $,
+const { state, saveState } = require("../../shared/state");
-    showView,
+const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
-    updateDebugBanner,
+const { log, debugFetch } = require("../../shared/log");
    showFlash,
    escapeHtml,
    flashCopyFeedback,
    goBack,
    pushCurrentView,
 } = require("./helpers");
 const { applyTheme } = require("../theme");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
 const {
    BUILD_VERSION,
    BUILD_LICENSE,
    BUILD_AUTHOR,
    BUILD_COMMIT,
    BUILD_DATE,
    GITEA_COMMIT_URL,
 } = require("../../shared/buildInfo");
 const runtime =
    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 let versionClickCount = 0;
 let versionClickTimer = null;
 function renderSiteList(containerId, siteMap, stateKey) {
    const container = $(containerId);
    const hostnames = [...new Set(Object.values(siteMap).flat())];
@@ -61,122 +38,10 @@ function renderSiteList(containerId, siteMap, stateKey) {
    });
 }
 function renderTrackedTokens() {
    const container = $("settings-tracked-tokens");
    if (state.trackedTokens.length === 0) {
        container.innerHTML = '<p class="text-xs text-muted">None</p>';
        return;
    }
    let html = "";
    state.trackedTokens.forEach((token, idx) => {
        const label = token.name
            ? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
            : escapeHtml(token.symbol);
        html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
        html += `<span>${label}</span>`;
        html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
        html += `</div>`;
    });
    container.innerHTML = html;
    container.querySelectorAll(".btn-remove-token").forEach((btn) => {
        btn.addEventListener("click", async () => {
            const idx = parseInt(btn.dataset.idx, 10);
            state.trackedTokens.splice(idx, 1);
            await saveState();
            renderTrackedTokens();
        });
    });
 }
 function renderWalletListSettings() {
    const container = $("settings-wallet-list");
    if (state.wallets.length === 0) {
        container.innerHTML = '<p class="text-xs text-muted">No wallets.</p>';
        return;
    }
    let html = "";
    state.wallets.forEach((wallet, idx) => {
        const name = escapeHtml(wallet.name || "Wallet " + (idx + 1));
        html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
        html += `<span class="settings-wallet-name cursor-pointer underline decoration-dashed" data-idx="${idx}">${name}</span>`;
        html += `<button class="btn-delete-wallet border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
        html += `</div>`;
    });
    container.innerHTML = html;
    container.querySelectorAll(".btn-delete-wallet").forEach((btn) => {
        btn.addEventListener("click", () => {
            const idx = parseInt(btn.dataset.idx, 10);
            pushCurrentView();
            deleteWallet.show(idx);
        });
    });
    // Inline rename on click
    container.querySelectorAll(".settings-wallet-name").forEach((span) => {
        span.addEventListener("click", () => {
            const idx = parseInt(span.dataset.idx, 10);
            const wallet = state.wallets[idx];
            const input = document.createElement("input");
            input.type = "text";
            input.className =
                "border border-border p-0 text-xs bg-bg text-fg w-full";
            input.value = wallet.name || "Wallet " + (idx + 1);
            span.replaceWith(input);
            input.focus();
            input.select();
            const finish = async () => {
                const val = input.value.trim();
                if (val && val !== wallet.name) {
                    wallet.name = val;
                    await saveState();
                }
                renderWalletListSettings();
            };
            input.addEventListener("blur", finish);
            input.addEventListener("keydown", (e) => {
                if (e.key === "Enter") input.blur();
                if (e.key === "Escape") {
                    input.value = wallet.name || "Wallet " + (idx + 1);
                    input.blur();
                }
            });
        });
    });
 }
 function show() {
    $("settings-rpc").value = state.rpcUrl;
    $("settings-blockscout").value = state.blockscoutUrl;
    const networkSelect = $("settings-network");
    if (networkSelect) {
        networkSelect.value = state.networkId;
    }
    renderTrackedTokens();
    renderSiteLists();
    renderWalletListSettings();
    // Populate About well
    $("about-license").textContent = BUILD_LICENSE;
    // Show only the name part of the author field (strip email)
    const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
    $("about-author").textContent = authorName;
    $("about-version").textContent = BUILD_VERSION;
    $("about-release-date").textContent = BUILD_DATE;
    $("about-commit-link").textContent = BUILD_COMMIT;
    $("about-commit-link").href = GITEA_COMMIT_URL;
    // Reset version click counter each time settings opens
    versionClickCount = 0;
    // Show debug well if debug mode is already enabled
    const debugWell = $("settings-debug-well");
    if (state.debugMode) {
        debugWell.style.display = "";
    } else {
        debugWell.style.display = "none";
    }
    $("settings-debug-mode").checked = state.debugMode;
    showView("settings");
 }
@@ -190,8 +55,6 @@ function renderSiteLists() {
 }
 function init(ctx) {
    deleteWallet.init(ctx);
    $("btn-save-rpc").addEventListener("click", async () => {
        const url = $("settings-rpc").value.trim();
        if (!url) {
@@ -216,12 +79,9 @@ function init(ctx) {
                showFlash("Endpoint returned error: " + json.error.message);
                return;
            }
-            const net = currentNetwork();
+            if (json.result !== ETHEREUM_MAINNET_CHAIN_ID) {
            if (json.result !== net.chainId) {
                showFlash(
-                    "Wrong network (expected " +
+                    "Wrong network (expected mainnet, got chain " +
                        net.name +
                        ", got chain " +
                        json.result +
                        ").",
                );
@@ -260,30 +120,12 @@ function init(ctx) {
        showFlash("Saved.");
    });
    const networkSelect = $("settings-network");
    if (networkSelect) {
        networkSelect.addEventListener("change", async () => {
            const newId = networkSelect.value;
            const net = await onChainSwitch(newId);
            $("settings-rpc").value = state.rpcUrl;
            $("settings-blockscout").value = state.blockscoutUrl;
            showFlash("Switched to " + net.name + ".");
        });
    }
    $("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
    $("settings-show-zero-balances").addEventListener("change", async () => {
        state.showZeroBalanceTokens = $("settings-show-zero-balances").checked;
        await saveState();
    });
    $("settings-theme").value = state.theme;
    $("settings-theme").addEventListener("change", async () => {
        state.theme = $("settings-theme").value;
        await saveState();
        applyTheme(state.theme);
    });
    $("settings-hide-low-holders").checked = state.hideLowHolderTokens;
    $("settings-hide-low-holders").addEventListener("change", async () => {
        state.hideLowHolderTokens = $("settings-hide-low-holders").checked;
@@ -311,81 +153,11 @@ function init(ctx) {
        }
    });
    $("settings-utc-timestamps").checked = state.utcTimestamps;
    $("settings-utc-timestamps").addEventListener("change", async () => {
        state.utcTimestamps = $("settings-utc-timestamps").checked;
        await saveState();
    });
    $("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView);
    $("btn-settings-add-token").addEventListener(
        "click",
        ctx.showSettingsAddTokenView,
    );
    // Bright saturated colors for easter egg flashes (clicks 6–10)
    const easterEggColors = [
        "#ff0055", // hot pink
        "#00cc44", // vivid green
        "#3366ff", // electric blue
        "#ff9900", // bright orange
        "#aa00ff", // vivid purple
    ];
    // Easter egg: click version 10 times to reveal the debug well.
    // Each click does a copy-flash animation. After 5 clicks, each
    // additional click flashes a different bright saturated color.
    $("about-version").addEventListener("click", () => {
        versionClickCount++;
        clearTimeout(versionClickTimer);
        // Reset counter if user stops clicking for 3 seconds
        versionClickTimer = setTimeout(() => {
            versionClickCount = 0;
        }, 3000);
        const el = $("about-version");
        if (versionClickCount > 5) {
            // Colored flash for clicks 6–10
            const colorIdx = versionClickCount - 6;
            const color = easterEggColors[colorIdx % easterEggColors.length];
            el.classList.remove("copy-flash-fade");
            el.style.backgroundColor = color;
            el.style.color = "#ffffff";
            setTimeout(() => {
                el.style.backgroundColor = "";
                el.style.color = "";
                el.classList.add("copy-flash-fade");
                setTimeout(() => {
                    el.classList.remove("copy-flash-fade");
                }, 275);
            }, 75);
        } else {
            // Standard copy-flash for clicks 1–5
            flashCopyFeedback(el);
        }
        if (versionClickCount >= 10) {
            versionClickCount = 0;
            clearTimeout(versionClickTimer);
            $("settings-debug-well").style.display = "";
        }
    });
    // Debug mode toggle — update runtime flag, persist, and re-render banner
    $("settings-debug-mode").addEventListener("change", async () => {
        state.debugMode = $("settings-debug-mode").checked;
        setRuntimeDebug(state.debugMode);
        await saveState();
        updateDebugBanner(state.currentView);
    });
    // Sync runtime debug flag on init
    setRuntimeDebug(state.debugMode);
    $("btn-settings-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
        showView("main");
    });
 }
--- a/src/popup/views/settingsAddToken.js
+++ b/src/popup/views/settingsAddToken.js
@@ -1,162 +0,0 @@
 const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
 const { log } = require("../../shared/log");
 let ctx;
 function isTracked(address) {
    const lower = address.toLowerCase();
    return state.trackedTokens.some((t) => t.address.toLowerCase() === lower);
 }
 function tokenLabel(t) {
    return t.name ? t.name + " (" + t.symbol + ")" : t.symbol;
 }
 function renderTop10() {
    const el = $("settings-addtoken-top10");
    el.innerHTML = getTopTokens(10)
        .map((t) => {
            const tracked = isTracked(t.address);
            const cls = tracked
                ? "border border-border px-1 text-xs opacity-40 cursor-default"
                : "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
            return (
                `<button class="settings-addtoken-quick ${cls}"` +
                ` data-address="${t.address}"` +
                ` data-symbol="${t.symbol}"` +
                ` data-decimals="${t.decimals}"` +
                ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
                `${tracked ? " disabled" : ""}>${t.symbol}</button>`
            );
        })
        .join("");
    el.querySelectorAll(".settings-addtoken-quick:not([disabled])").forEach(
        (btn) => {
            btn.addEventListener("click", async () => {
                const token = {
                    address: btn.dataset.address,
                    symbol: btn.dataset.symbol,
                    decimals: parseInt(btn.dataset.decimals, 10),
                    name: btn.dataset.name || btn.dataset.symbol,
                };
                state.trackedTokens.push(token);
                await saveState();
                showFlash("Added " + token.symbol);
                renderTop10();
                renderDropdown();
                ctx.doRefreshAndRender();
            });
        },
    );
 }
 function renderDropdown() {
    const sel = $("settings-addtoken-select");
    const tokens = getTopTokens(100);
    let html = '<option value="">-- select --</option>';
    for (const t of tokens) {
        const tracked = isTracked(t.address);
        const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
        html +=
            `<option value="${t.address}"` +
            ` data-symbol="${t.symbol}"` +
            ` data-decimals="${t.decimals}"` +
            ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
            `${tracked ? " disabled" : ""}>${label}</option>`;
    }
    sel.innerHTML = html;
 }
 function show() {
    $("settings-addtoken-address").value = "";
    $("settings-addtoken-info").textContent = "";
    $("settings-addtoken-info").style.visibility = "hidden";
    renderTop10();
    renderDropdown();
    showView("settings-addtoken");
 }
 function init(_ctx) {
    ctx = _ctx;
    $("btn-settings-addtoken-back").addEventListener("click", () => {
        goBack();
    });
    $("btn-settings-addtoken-select").addEventListener("click", async () => {
        const sel = $("settings-addtoken-select");
        const opt = sel.options[sel.selectedIndex];
        if (!opt || !opt.value) {
            showFlash("Please select a token.");
            return;
        }
        if (isTracked(opt.value)) {
            showFlash("Already tracked.");
            return;
        }
        const token = {
            address: opt.value,
            symbol: opt.dataset.symbol,
            decimals: parseInt(opt.dataset.decimals, 10),
            name: opt.dataset.name || opt.dataset.symbol,
        };
        state.trackedTokens.push(token);
        await saveState();
        showFlash("Added " + token.symbol);
        renderTop10();
        renderDropdown();
        ctx.doRefreshAndRender();
    });
    $("btn-settings-addtoken-manual").addEventListener("click", async () => {
        const addr = $("settings-addtoken-address").value.trim();
        if (!addr || !addr.startsWith("0x")) {
            showFlash(
                "Please enter a valid contract address starting with 0x.",
            );
            return;
        }
        if (isTracked(addr)) {
            showFlash("Already tracked.");
            return;
        }
        if (isScamAddress(addr)) {
            showFlash("This address is on a known scam/fraud list.");
            return;
        }
        const infoEl = $("settings-addtoken-info");
        infoEl.textContent = "Looking up token...";
        infoEl.style.visibility = "visible";
        log.debugf("Looking up token contract", addr);
        try {
            const info = await lookupTokenInfo(addr, state.rpcUrl);
            log.infof("Adding token", info.symbol, addr);
            state.trackedTokens.push({
                address: addr,
                symbol: info.symbol,
                decimals: info.decimals,
                name: info.name,
            });
            await saveState();
            showFlash("Added " + info.symbol);
            $("settings-addtoken-address").value = "";
            infoEl.textContent = "";
            infoEl.style.visibility = "hidden";
            renderTop10();
            renderDropdown();
            ctx.doRefreshAndRender();
        } catch (e) {
            const detail = e.shortMessage || e.message || String(e);
            log.errorf("Token lookup failed for", addr, detail);
            showFlash(detail);
            infoEl.textContent = "";
            infoEl.style.visibility = "hidden";
        }
    });
 }
 module.exports = { init, show };
--- a/src/popup/views/transactionDetail.js
+++ b/src/popup/views/transactionDetail.js
@@ -5,43 +5,61 @@ const {
    $,
    showView,
    showFlash,
    flashCopyFeedback,
    addressTitle,
    addressDotHtml,
    escapeHtml,
    isoDate,
    timeAgo,
    renderAddressHtml,
    attachCopyHandlers,
    copyableHtml,
    etherscanLinkHtml,
    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
-const { log, debugFetch } = require("../../shared/log");
+
-const { decodeCalldata } = require("./approval");
+const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 let ctx;
-/**
+function isoDate(timestamp) {
- * Determine a human-readable transaction type string from tx fields.
+    const d = new Date(timestamp * 1000);
- */
+    const pad = (n) => String(n).padStart(2, "0");
-function getTransactionType(tx) {
+    return (
-    if (!tx.to) return "Contract Creation";
+        d.getFullYear() +
-    if (tx.direction === "contract") {
+        "-" +
-        if (tx.directionLabel === "Swap") return "Swap";
+        pad(d.getMonth() + 1) +
-        if (
+        "-" +
-            tx.method === "approve" ||
+        pad(d.getDate()) +
-            tx.directionLabel === "Approve" ||
+        " " +
-            tx.method === "setApprovalForAll"
+        pad(d.getHours()) +
-        )
+        ":" +
-            return "Token Approval";
+        pad(d.getMinutes()) +
-        return "Contract Call";
+        ":" +
-    }
+        pad(d.getSeconds())
-    if (tx.symbol && tx.symbol !== "ETH") return "ERC-20 Token Transfer";
+    );
-    return "Native ETH Transfer";
+}
 function timeAgo(timestamp) {
    const seconds = Math.floor(Date.now() / 1000 - timestamp);
    if (seconds < 60) return seconds + " seconds ago";
    const minutes = Math.floor(seconds / 60);
    if (minutes < 60)
        return minutes + " minute" + (minutes !== 1 ? "s" : "") + " ago";
    const hours = Math.floor(minutes / 60);
    if (hours < 24) return hours + " hour" + (hours !== 1 ? "s" : "") + " ago";
    const days = Math.floor(hours / 24);
    if (days < 30) return days + " day" + (days !== 1 ? "s" : "") + " ago";
    const months = Math.floor(days / 30);
    if (months < 12)
        return months + " month" + (months !== 1 ? "s" : "") + " ago";
    const years = Math.floor(days / 365);
    return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 function copyableHtml(text, extraClass) {
    const cls =
        "underline decoration-dashed cursor-pointer" +
        (extraClass ? " " + extraClass : "");
    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
 }
 function blockieHtml(address) {
@@ -49,17 +67,34 @@ function blockieHtml(address) {
    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
-function txAddressHtml(address, ensName, title) {
+function txAddressHtml(address, ensName) {
    const blockie = blockieHtml(address);
-    return (
+    const dot = addressDotHtml(address);
-        `<div class="mb-1">${blockie}</div>` +
+    const link = `https://etherscan.io/address/${address}`;
-        renderAddressHtml(address, { title, ensName })
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    );
+    let html = `<div class="mb-1">${blockie}</div>`;
    if (ensName) {
        html +=
            `<div class="flex items-center">${dot}` +
            copyableHtml(ensName, "") +
            extLink +
            `</div>` +
            `<div class="break-all">` +
            copyableHtml(address, "break-all") +
            `</div>`;
    } else {
        html +=
            `<div class="flex items-center">${dot}` +
            copyableHtml(address, "break-all") +
            extLink +
            `</div>`;
    }
    return html;
 }
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
-    const extLink = etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
    return copyableHtml(hash, "break-all") + extLink;
 }
@@ -70,19 +105,12 @@ function show(tx) {
            from: tx.from,
            to: tx.to,
            value: tx.value,
            exactValue: tx.exactValue || tx.value,
            rawAmount: tx.rawAmount || "",
            rawUnit: tx.rawUnit || "",
            symbol: tx.symbol,
            timestamp: tx.timestamp,
            isError: tx.isError,
            fromEns: tx.fromEns || null,
            toEns: tx.toEns || null,
            directionLabel: tx.directionLabel || null,
            direction: tx.direction || null,
            isContractCall: tx.isContractCall || false,
            method: tx.method || null,
            contractAddress: tx.contractAddress || null,
        },
    };
    render();
@@ -92,267 +120,35 @@ function render() {
    const tx = state.viewData.tx;
    if (!tx) return;
    $("tx-detail-hash").innerHTML = txHashHtml(tx.hash);
-
+    $("tx-detail-from").innerHTML = txAddressHtml(tx.from, tx.fromEns);
-    const fromTitle = addressTitle(tx.from, state.wallets);
+    $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns);
-    const toTitle = addressTitle(tx.to, state.wallets);
+    $("tx-detail-value").textContent = tx.value
-    $("tx-detail-from").innerHTML = txAddressHtml(
+        ? tx.value + " " + tx.symbol
        tx.from,
        tx.fromEns,
        fromTitle,
    );
    $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
    // Exact amount (full precision, copyable)
    const exactStr = tx.exactValue
        ? tx.exactValue + " " + tx.symbol
        : tx.directionLabel + " " + tx.symbol;
-    $("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
+    $("tx-detail-time").textContent =
-
+        isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
    // Native quantity (raw integer, copyable)
    const nativeEl = $("tx-detail-native");
    if (tx.rawAmount && tx.rawUnit) {
        const nativeStr = tx.rawAmount + " " + tx.rawUnit;
        nativeEl.innerHTML = copyableHtml(nativeStr, "");
        nativeEl.parentElement.classList.remove("hidden");
    } else {
        nativeEl.innerHTML = "";
        nativeEl.parentElement.classList.add("hidden");
    }
    // Always show transaction type as the first field
    const typeSection = $("tx-detail-type-section");
    const typeEl = $("tx-detail-type");
    const headingEl = $("tx-detail-heading");
    if (typeSection && typeEl) {
        typeEl.textContent = getTransactionType(tx);
        typeSection.classList.remove("hidden");
    }
    if (headingEl) headingEl.textContent = "Transaction";
    // Token contract address (for ERC-20 transfers)
    const tokenContractSection = $("tx-detail-token-contract-section");
    const tokenContractEl = $("tx-detail-token-contract");
    if (tokenContractSection && tokenContractEl) {
        if (tx.contractAddress) {
            const dot = addressDotHtml(tx.contractAddress);
            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
            tokenContractEl.innerHTML =
                `<div class="flex items-center">${dot}` +
                copyableHtml(tx.contractAddress, "break-all") +
                etherscanLinkHtml(link) +
                `</div>`;
            tokenContractSection.classList.remove("hidden");
        } else {
            tokenContractSection.classList.add("hidden");
        }
    }
    // Hide calldata and raw data sections; always fetch full tx details
    const calldataSection = $("tx-detail-calldata-section");
    if (calldataSection) calldataSection.classList.add("hidden");
    const rawDataSection = $("tx-detail-rawdata-section");
    if (rawDataSection) rawDataSection.classList.add("hidden");
    // Hide on-chain detail sections until populated
    for (const id of [
        "tx-detail-block-section",
        "tx-detail-nonce-section",
        "tx-detail-fee-section",
        "tx-detail-gasprice-section",
        "tx-detail-gasused-section",
        "tx-detail-network-section",
    ]) {
        const el = $(id);
        if (el) el.classList.add("hidden");
    }
    loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
    const isoStr = isoDate(tx.timestamp);
    $("tx-detail-time").innerHTML =
        copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
    $("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
    showView("transaction");
    attachCopyHandlers("view-transaction");
 }
-function showDetailField(sectionId, contentId, value) {
+    document
-    const section = $(sectionId);
+        .getElementById("view-transaction")
-    const el = $(contentId);
+        .querySelectorAll("[data-copy]")
-    if (!section || !el) return;
+        .forEach((el) => {
    el.innerHTML = copyableHtml(value, "");
    section.classList.remove("hidden");
 }
 function populateOnChainDetails(txData) {
    // Block number
    if (txData.block_number != null) {
        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
        const blockSection = $("tx-detail-block-section");
        const blockEl = $("tx-detail-block");
        if (blockSection && blockEl) {
            blockEl.innerHTML =
                copyableHtml(String(txData.block_number), "") +
                etherscanLinkHtml(blockLink);
            blockSection.classList.remove("hidden");
        }
    }
    // Nonce
    if (txData.nonce != null) {
        showDetailField(
            "tx-detail-nonce-section",
            "tx-detail-nonce",
            String(txData.nonce),
        );
    }
    // Transaction fee
    const feeWei = txData.fee?.value || txData.tx_fee;
    if (feeWei) {
        const feeEth = formatEther(String(feeWei));
        showDetailField(
            "tx-detail-fee-section",
            "tx-detail-fee",
            feeEth + " ETH",
        );
    }
    // Gas price
    const gasPrice = txData.gas_price;
    if (gasPrice) {
        const gwei = formatUnits(String(gasPrice), "gwei");
        showDetailField(
            "tx-detail-gasprice-section",
            "tx-detail-gasprice",
            gwei + " Gwei",
        );
    }
    // Gas used
    const gasUsed = txData.gas_used;
    if (gasUsed) {
        showDetailField(
            "tx-detail-gasused-section",
            "tx-detail-gasused",
            String(gasUsed),
        );
    }
    // Show the network details wrapper if any child section is visible
    const networkWrapper = $("tx-detail-network-section");
    if (networkWrapper) {
        const hasVisible = [
            "tx-detail-nonce-section",
            "tx-detail-fee-section",
            "tx-detail-gasprice-section",
            "tx-detail-gasused-section",
        ].some((id) => {
            const el = $(id);
            return el && !el.classList.contains("hidden");
        });
        if (hasVisible) networkWrapper.classList.remove("hidden");
    }
    // Bind copy handlers for newly added elements
    for (const id of [
        "tx-detail-block-section",
        "tx-detail-nonce-section",
        "tx-detail-fee-section",
        "tx-detail-gasprice-section",
        "tx-detail-gasused-section",
    ]) {
        const section = $(id);
        if (!section) continue;
        section.querySelectorAll("[data-copy]").forEach((el) => {
            el.onclick = () => {
                navigator.clipboard.writeText(el.dataset.copy);
                showFlash("Copied!");
                flashCopyFeedback(el);
            };
        });
    }
 }
 async function loadFullTxDetails(txHash, toAddress, isContractCall) {
    const section = $("tx-detail-calldata-section");
    const actionEl = $("tx-detail-calldata-action");
    const detailsEl = $("tx-detail-calldata-details");
    const wellEl = $("tx-detail-calldata-well");
    const rawSection = $("tx-detail-rawdata-section");
    const rawEl = $("tx-detail-rawdata");
    if (!section || !actionEl || !detailsEl) return;
    try {
        const resp = await debugFetch(
            state.blockscoutUrl + "/transactions/" + txHash,
        );
        if (!resp.ok) return;
        const txData = await resp.json();
        // Populate on-chain detail fields (block, nonce, gas, fee)
        populateOnChainDetails(txData);
        const inputData = txData.raw_input || txData.input || null;
        if (!inputData || inputData === "0x") return;
        const decoded = decodeCalldata(inputData, toAddress || "");
        if (decoded) {
            // Render decoded calldata matching approval view style
            actionEl.textContent = decoded.name;
            let detailsHtml = "";
            if (decoded.description) {
                detailsHtml += `<div class="mb-2">${escapeHtml(decoded.description)}</div>`;
            }
            for (const d of decoded.details || []) {
                detailsHtml += `<div class="mb-2">`;
                detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
                if (d.address && d.isToken) {
                    // Token entry: show symbol on its own line, then address via shared renderer
                    const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                    if (tokenSymbol) {
                        detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                    }
                    detailsHtml += renderAddressHtml(d.address);
                } else if (d.address) {
                    detailsHtml += renderAddressHtml(d.address);
                } else {
                    detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
                }
                detailsHtml += `</div>`;
            }
            detailsEl.innerHTML = detailsHtml;
            if (wellEl) wellEl.classList.remove("hidden");
        } else {
            // Unknown contract call — show method name in well
            const method = txData.method || "Unknown contract call";
            actionEl.textContent = method;
            detailsEl.innerHTML = "";
            if (wellEl) wellEl.classList.remove("hidden");
        }
        // Always show raw data
        if (rawSection && rawEl) {
            rawEl.innerHTML = copyableHtml(inputData, "break-all");
            rawSection.classList.remove("hidden");
        }
        section.classList.remove("hidden");
        // Bind copy handlers for new elements (including raw data now outside section)
        const copyTargets = [section, rawSection].filter(Boolean);
        for (const container of copyTargets) {
            attachCopyHandlers(container);
        }
    } catch (e) {
        log.errorf("loadCalldata failed:", e.message);
    }
 }
 function init(_ctx) {
    ctx = _ctx;
    $("btn-tx-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
            ctx.showAddressToken();
        } else {
            ctx.showAddressDetail();
        }
    });
 }
--- a/src/popup/views/txStatus.js
+++ b/src/popup/views/txStatus.js
@@ -3,19 +3,21 @@
 const {
    $,
    showView,
-    addressTitle,
+    showFlash,
    addressDotHtml,
    escapeHtml,
    renderAddressHtml,
    attachCopyHandlers,
    copyableHtml,
    etherscanLinkHtml,
    clearViewStack,
 } = require("./helpers");
-const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
+const { state, saveState } = require("../../shared/state");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 const EXT_ICON =
    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
    `</svg></span>`;
 let ctx;
 let elapsedTimer = null;
 let pollTimer = null;
@@ -32,19 +34,31 @@ function clearTimers() {
 }
 function toAddressHtml(address) {
-    const title = addressTitle(address, state.wallets);
+    const dot = addressDotHtml(address);
-    return renderAddressHtml(address, { title });
+    const link = `https://etherscan.io/address/${address}`;
    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
 }
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
-    return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
    return (
        `<span class="underline decoration-dashed cursor-pointer break-all" data-copy="${escapeHtml(hash)}">${escapeHtml(hash)}</span>` +
        extLink
    );
 }
-function blockNumberHtml(blockNumber) {
+function attachCopyHandlers(viewId) {
-    const num = String(blockNumber);
+    document
-    const link = `${currentNetwork().explorerUrl}/block/${num}`;
+        .getElementById(viewId)
-    return copyableHtml(num) + etherscanLinkHtml(link);
+        .querySelectorAll("[data-copy]")
        .forEach((el) => {
            el.onclick = () => {
                navigator.clipboard.writeText(el.dataset.copy);
                showFlash("Copied!");
            };
        });
 }
 function showWait(txInfo, txHash) {
@@ -99,84 +113,18 @@ function showSuccess(txInfo, txHash, blockNumber) {
        to: txInfo.to,
        hash: txHash,
        blockNumber: blockNumber,
        decoded: txInfo.decoded || null,
    };
    renderSuccess();
    ctx.doRefreshAndRender();
 }
 function tokenLabel(address) {
    const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
    return t ? t.symbol : null;
 }
 function etherscanTokenLink(address) {
    return `${currentNetwork().explorerUrl}/token/${address}`;
 }
 function decodedDetailsHtml(decoded) {
    if (!decoded || !decoded.details) return "";
    let html = `<div class="border border-border border-dashed p-2 mb-3">`;
    if (decoded.name) {
        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
        html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
    }
    if (decoded.description) {
        html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Description</div>`;
        html += `<div>${escapeHtml(decoded.description)}</div></div>`;
    }
    for (const d of decoded.details) {
        html += `<div class="mb-2">`;
        html += `<div class="text-xs text-muted mb-1">${escapeHtml(d.label)}</div>`;
        if (d.address) {
            if (d.isToken) {
                const sym = tokenLabel(d.address) || "Unknown token";
                html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
                html += toAddressHtml(d.address);
            } else {
                html += toAddressHtml(d.address);
            }
        } else {
            html += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
        }
        html += `</div>`;
    }
    html += `</div>`;
    return html;
 }
 function renderSuccess() {
    const d = state.viewData;
    if (!d || !d.hash) return;
-
+    $("success-tx-summary").textContent = d.amount + " " + d.symbol;
-    const hasDecoded = d.decoded && d.decoded.details;
+    $("success-tx-to").innerHTML = toAddressHtml(d.to);
-
+    $("success-tx-block").textContent = String(d.blockNumber);
    // When decoded details are present, the Amount and To are already
    // shown inside the decoded well — hide the top-level duplicates.
    const summarySection = $("success-tx-summary").parentElement;
    const toSection = $("success-tx-to").parentElement;
    if (hasDecoded) {
        summarySection.classList.add("hidden");
        toSection.classList.add("hidden");
    } else {
        summarySection.classList.remove("hidden");
        toSection.classList.remove("hidden");
        $("success-tx-summary").textContent = d.amount + " " + d.symbol;
        $("success-tx-to").innerHTML = toAddressHtml(d.to);
    }
    $("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
    $("success-tx-hash").innerHTML = txHashHtml(d.hash);
    // Show decoded calldata details if present
    const decodedEl = $("success-tx-decoded");
    if (decodedEl && hasDecoded) {
        decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
        decodedEl.classList.remove("hidden");
    } else if (decodedEl) {
        decodedEl.classList.add("hidden");
    }
    attachCopyHandlers("view-success-tx");
    showView("success-tx");
 }
@@ -222,16 +170,10 @@ function navigateBack() {
        window.close();
        return;
    }
    // After a completed transaction, reset the navigation stack
    // and go directly to the address view (token or detail).
    // Use require() lazily to call show() without the ctx push wrapper.
    clearViewStack();
    state.viewStack.push("main");
    if (state.selectedToken) {
-        state.viewStack.push("address");
+        ctx.showAddressToken();
        require("./addressToken").show();
    } else {
-        require("./addressDetail").show();
+        ctx.showAddressDetail();
    }
 }
--- a/src/shared/addressWarnings.js
+++ b/src/shared/addressWarnings.js
@@ -1,114 +0,0 @@
 // Address warning module.
 // Provides local and async (RPC-based) warning checks for Ethereum addresses.
 // Returns arrays of {type, message, severity} objects.
 const { isScamAddress } = require("./scamlist");
 const { isBurnAddress } = require("./constants");
 const { checkEtherscanLabel } = require("./etherscanLabels");
 const { log } = require("./log");
 /**
 * Check an address against local-only lists (scam, burn, self-send).
 * Synchronous — no network calls.
 *
 * @param {string} address - The target address to check.
 * @param {object} [options] - Optional context.
 * @param {string} [options.fromAddress] - Sender address (for self-send check).
 * @returns {Array<{type: string, message: string, severity: string}>}
 */
 function getLocalWarnings(address, options = {}) {
    const warnings = [];
    const addr = address.toLowerCase();
    if (isScamAddress(addr)) {
        warnings.push({
            type: "scam",
            message:
                "This address is on a known scam/fraud list. Do not send funds to this address.",
            severity: "critical",
        });
    }
    if (isBurnAddress(addr)) {
        warnings.push({
            type: "burn",
            message:
                "This is a known null/burn address. Funds sent here are permanently destroyed and cannot be recovered.",
            severity: "critical",
        });
    }
    if (options.fromAddress && addr === options.fromAddress.toLowerCase()) {
        warnings.push({
            type: "self-send",
            message: "You are sending to your own address.",
            severity: "warning",
        });
    }
    return warnings;
 }
 /**
 * Check an address against local lists AND via RPC queries.
 * Async — performs network calls to check contract status and tx history.
 *
 * @param {string} address - The target address to check.
 * @param {object} provider - An ethers.js provider instance.
 * @param {object} [options] - Optional context.
 * @param {string} [options.fromAddress] - Sender address (for self-send check).
 * @returns {Promise<Array<{type: string, message: string, severity: string}>>}
 */
 async function getFullWarnings(address, provider, options = {}) {
    const warnings = getLocalWarnings(address, options);
    let isContract = false;
    try {
        const code = await provider.getCode(address);
        if (code && code !== "0x") {
            isContract = true;
            warnings.push({
                type: "contract",
                message:
                    "This address is a smart contract, not a regular wallet.",
                severity: "warning",
            });
        }
    } catch (e) {
        log.errorf("contract check failed:", e.message);
    }
    // Skip tx count check for contracts — they may legitimately have
    // zero inbound EOA transactions.
    if (!isContract) {
        try {
            const txCount = await provider.getTransactionCount(address);
            if (txCount === 0) {
                warnings.push({
                    type: "new-address",
                    message:
                        "This address has never sent a transaction. Double-check it is correct.",
                    severity: "info",
                });
            }
        } catch (e) {
            log.errorf("tx count check failed:", e.message);
        }
    }
    // Etherscan label check (best-effort async — network failures are silent).
    // Runs for ALL addresses including contracts, since many dangerous
    // flagged addresses on Etherscan (drainers, phishing contracts) are contracts.
    try {
        const etherscanWarning = await checkEtherscanLabel(address);
        if (etherscanWarning) {
            warnings.push(etherscanWarning);
        }
    } catch (e) {
        log.errorf("etherscan label check failed:", e.message);
    }
    return warnings;
 }
 module.exports = { getLocalWarnings, getFullWarnings };
--- a/src/shared/approvalVerify.js
+++ b/src/shared/approvalVerify.js
@@ -1,124 +0,0 @@
 // Verification of the signed artifacts produced by the approval popup.
 //
 // Signing happens in the popup, where the password is entered; the background
 // only broadcasts the raw transaction and resolves the pending approval back
 // to the requesting page. So that moving the signing out of the background
 // does not turn the background into a blind relay, the background re-derives
 // the signer from the artifact and checks it against the approval it is
 // holding before acting on it. All recovery is delegated to ethers.
 //
 // Every failure message is a full sentence, because these strings are shown to
 // the user and returned to the dApp.
 const {
    Transaction,
    getAddress,
    getBytes,
    verifyMessage,
    verifyTypedData,
 } = require("ethers");
 // Case-insensitive address comparison that tolerates absent values on either
 // side. Two absent addresses compare equal (contract creation has no `to`).
 function sameAddress(a, b) {
    const aMissing = a === null || a === undefined || a === "";
    const bMissing = b === null || b === undefined || b === "";
    if (aMissing || bMissing) return aMissing && bMissing;
    try {
        return getAddress(a) === getAddress(b);
    } catch {
        return String(a).toLowerCase() === String(b).toLowerCase();
    }
 }
 // Normalize a transaction value (hex string, decimal string, number or
 // bigint) to a bigint. An absent value is zero, matching ethers.
 function normalizeValue(v) {
    if (v === null || v === undefined || v === "") return 0n;
    return BigInt(v);
 }
 // Normalize call data to a lowercase hex string. Absent data is "0x".
 function normalizeData(v) {
    if (v === null || v === undefined || v === "" || v === "0x") return "0x";
    return String(v).toLowerCase();
 }
 // Assert that a raw signed transaction is the transaction the user approved,
 // signed by the address the approval was raised for. Returns the parsed
 // ethers Transaction on success, throws otherwise.
 function verifySignedTx(rawSignedTx, txParams, expectedFrom) {
    if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
        throw new Error("The signed transaction is missing or malformed.");
    }
    let parsed;
    try {
        parsed = Transaction.from(rawSignedTx);
    } catch {
        throw new Error("The signed transaction could not be decoded.");
    }
    if (!parsed.from) {
        throw new Error("The signed transaction carries no valid signature.");
    }
    if (!sameAddress(parsed.from, expectedFrom)) {
        throw new Error(
            "The signed transaction was signed by a different address than the one that was approved.",
        );
    }
    if (!sameAddress(parsed.to, txParams.to)) {
        throw new Error(
            "The signed transaction does not go to the approved recipient.",
        );
    }
    if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
        throw new Error(
            "The signed transaction does not carry the approved value.",
        );
    }
    if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
        throw new Error(
            "The signed transaction does not carry the approved call data.",
        );
    }
    return parsed;
 }
 // Assert that a signature over the approved message or typed data was
 // produced by the address the approval was raised for. Returns the recovered
 // address on success, throws otherwise.
 function verifySignature(signParams, signature, expectedFrom) {
    if (typeof signature !== "string" || !signature.startsWith("0x")) {
        throw new Error("The signature is missing or malformed.");
    }
    let recovered;
    try {
        if (
            signParams.method === "personal_sign" ||
            signParams.method === "eth_sign"
        ) {
            recovered = verifyMessage(getBytes(signParams.message), signature);
        } else {
            const typedData = JSON.parse(signParams.typedData);
            const { domain, types, message } = typedData;
            // ethers derives EIP712Domain itself and rejects it as an input.
            delete types.EIP712Domain;
            recovered = verifyTypedData(domain, types, message, signature);
        }
    } catch {
        throw new Error("The signature could not be verified.");
    }
    if (!sameAddress(recovered, expectedFrom)) {
        throw new Error(
            "The signature was produced by a different address than the one that was approved.",
        );
    }
    return recovered;
 }
 module.exports = { verifySignedTx, verifySignature, sameAddress };
--- a/src/shared/balances.js
+++ b/src/shared/balances.js
@@ -15,15 +15,10 @@ const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
-// Accepts an optional networkName ("mainnet" or "sepolia") for the static
+const mainnet = Network.from("mainnet");
-// network hint so ethers picks the right chain parameters.  When omitted,
+
-// reads the currently selected network from extension state.
+function getProvider(rpcUrl) {
-function getProvider(rpcUrl, networkName) {
+    return new JsonRpcProvider(rpcUrl, mainnet, { staticNetwork: mainnet });
    // Lazy require to avoid circular dependency issues at module scope.
    const { currentNetwork } = require("./state");
    const name = networkName || currentNetwork().id;
    const net = Network.from(name);
    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
 }
 function formatBalance(wei) {
@@ -90,7 +85,6 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
            balances.push({
                address: item.token.address_hash,
                name: item.token.name || "",
                symbol: item.token.symbol || "???",
                decimals: decimals,
                balance: bal,
@@ -129,27 +123,15 @@ async function refreshBalances(wallets, rpcUrl, blockscoutUrl, trackedTokens) {
                    }),
            );
-            // ENS reverse lookup — only overwrite on success so that
+            // ENS reverse lookup
            // transient RPC errors don't wipe a previously resolved name.
            updates.push(
                provider
                    .lookupAddress(addr.address)
                    .then((name) => {
                        addr.ensName = name || null;
                        log.debugf(
                            "ENS reverse",
                            addr.address,
                            "->",
                            addr.ensName,
                        );
                    })
-                    .catch((e) => {
+                    .catch(() => {
-                        log.errorf(
+                        addr.ensName = null;
                            "ENS reverse failed",
                            addr.address,
                            e.message,
                        );
                        // Keep existing addr.ensName if we had one
                    }),
            );
@@ -210,10 +192,6 @@ async function lookupTokenInfo(contractAddress, rpcUrl) {
        name = symbol;
    }
    // Truncate to prevent storage of excessively long values from RPC
    name = String(name).slice(0, 64);
    symbol = String(symbol).slice(0, 12);
    log.infof("Token resolved:", symbol, "decimals", Number(decimals));
    return { name, symbol, decimals: Number(decimals) };
 }
--- a/src/shared/buildInfo.js
+++ b/src/shared/buildInfo.js
@@ -1,35 +0,0 @@
 // Build-time constants injected by esbuild define in build.js.
 // These globals are replaced at bundle time with string literals.
 /* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
          __BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
 const BUILD_VERSION =
    typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
 const BUILD_LICENSE =
    typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
 const BUILD_AUTHOR =
    typeof __BUILD_AUTHOR__ !== "undefined"
        ? __BUILD_AUTHOR__
        : "sneak <sneak@sneak.berlin>";
 const BUILD_COMMIT =
    typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
 const BUILD_COMMIT_FULL =
    typeof __BUILD_COMMIT_FULL__ !== "undefined"
        ? __BUILD_COMMIT_FULL__
        : "unknown";
 const BUILD_DATE =
    typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
 const GITEA_COMMIT_URL =
    "https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
 module.exports = {
    BUILD_VERSION,
    BUILD_LICENSE,
    BUILD_AUTHOR,
    BUILD_COMMIT,
    BUILD_COMMIT_FULL,
    BUILD_DATE,
    GITEA_COMMIT_URL,
 };
--- a/src/shared/chainSwitch.js
+++ b/src/shared/chainSwitch.js
@@ -1,57 +0,0 @@
 // Consolidated chain-switch handler.
 //
 // Every state change required when the active network changes is
 // performed here so that callers (settings UI, background
 // wallet_switchEthereumChain, future chain additions) all go
 // through a single code path.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
 const { networkById } = require("./networks");
 const { clearPrices } = require("./prices");
 // Switch the active chain and reset all chain-specific cached state.
 // Returns the network configuration object for the new chain.
 async function onChainSwitch(newNetworkId) {
    const { state, saveState } = require("./state");
    const net = networkById(newNetworkId);
    // --- core identity ---
    state.networkId = net.id;
    state.rpcUrl = net.defaultRpcUrl;
    state.blockscoutUrl = net.defaultBlockscoutUrl;
    // --- price cache ---
    // Prices are chain-specific (testnet tokens are worthless,
    // ETC has different pricing, etc.).
    clearPrices();
    // --- balance / refresh state ---
    // Reset last-refresh timestamp so the next polling cycle
    // triggers an immediate balance refresh on the new chain.
    state.lastBalanceRefresh = 0;
    // Clear per-address balances and token balances so stale data
    // from the previous chain is never displayed while the first
    // refresh on the new chain is in flight.
    for (const wallet of state.wallets) {
        for (const addr of wallet.addresses) {
            addr.balance = "0";
            addr.tokenBalances = [];
        }
    }
    // --- chain-specific caches ---
    // Token holder counts and fraud contract lists are
    // chain-specific and must not carry over.
    state.tokenHolderCache = {};
    state.fraudContracts = [];
    await saveState();
    return net;
 }
 module.exports = { onChainSwitch };
--- a/src/shared/constants.js
+++ b/src/shared/constants.js
@@ -1,32 +1,8 @@
-// DEBUG is a build-time constant injected by esbuild's define in build.js
+const DEBUG = true;
 // (see src/shared/buildInfo.js for the same pattern). It is false unless the
 // bundle was produced with AUTISTMASK_DEBUG=1, and it is false whenever the
 // module is loaded outside a bundle (tests, plain require). It must never be
 // derived from anything the user can change at runtime: it is what gates the
 // hardcoded test mnemonic below.
 /* global __BUILD_DEBUG__ */
 const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
 // Machine-readable record of the compiled DEBUG state, read out of the emitted
 // bundles by script/verify-build. It is derived from DEBUG itself so the two
 // cannot disagree, and it is a plain string literal rather than a minifier
 // artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
 // staying byte-stable across versions.
 //
 // The ambiguity is the point. When DEBUG is known at build time the bundler
 // folds this to exactly one of the two literals. When it is not — which is
 // exactly what happens if the __BUILD_DEBUG__ define goes missing from
 // build.js — the ternary survives, both literals appear in the bundle, and
 // verify-build fails rather than guessing.
 const BUILD_DEBUG_MARKER = DEBUG
    ? "autistmask-build-debug=on"
    : "autistmask-build-debug=off";
 const DEBUG_MNEMONIC =
    "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 const ETHEREUM_MAINNET_CHAIN_ID = "0x1";
 const ETHEREUM_SEPOLIA_CHAIN_ID = "0xaa36a7";
 const DEFAULT_RPC_URL = "https://ethereum-rpc.publicnode.com";
@@ -44,29 +20,12 @@ const ERC20_ABI = [
    "function approve(address spender, uint256 amount) returns (bool)",
 ];
 // Known null/burn addresses that permanently destroy funds.
 const BURN_ADDRESSES = new Set([
    "0x0000000000000000000000000000000000000000",
    "0x0000000000000000000000000000000000000001",
    "0x000000000000000000000000000000000000dead",
    "0xdead000000000000000000000000000000000000",
    "0x00000000000000000000000000000000deadbeef",
 ]);
 function isBurnAddress(address) {
    return BURN_ADDRESSES.has(address.toLowerCase());
 }
 module.exports = {
    DEBUG,
    BUILD_DEBUG_MARKER,
    DEBUG_MNEMONIC,
    ETHEREUM_MAINNET_CHAIN_ID,
    ETHEREUM_SEPOLIA_CHAIN_ID,
    DEFAULT_RPC_URL,
    DEFAULT_BLOCKSCOUT_URL,
    BIP44_ETH_PATH,
    ERC20_ABI,
    BURN_ADDRESSES,
    isBurnAddress,
 };
--- a/src/shared/ens.js
+++ b/src/shared/ens.js
@@ -39,7 +39,7 @@ async function resolveEnsName(address, rpcUrl) {
        return name;
    } catch (e) {
        log.errorf("ENS reverse lookup failed", address, e.message);
-        // Don't cache failures — let subsequent lookups retry
+        setCache(address, null);
        return null;
    }
 }
--- a/src/shared/etherscanLabels.js
+++ b/src/shared/etherscanLabels.js
@@ -1,107 +0,0 @@
 // Etherscan address label lookup via page scraping.
 // Extension users make the requests directly to Etherscan — no proxy needed.
 // This is a best-effort enrichment: network failures return null silently.
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
 const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
 // Patterns in the page body that indicate a scam/phishing warning.
 const SCAM_BODY_PATTERNS = [
    /used in a\s+(?:\w+\s+)?phishing scam/i,
    /used in a\s+(?:\w+\s+)?scam/i,
    /wallet\s+drainer/i,
 ];
 /**
 * Parse the Etherscan address page HTML to extract label info.
 * Exported for unit testing (no fetch needed).
 *
 * @param {string} html - Raw HTML of the Etherscan address page.
 * @returns {{ label: string|null, isPhishing: boolean, warning: string|null }}
 */
 function parseEtherscanPage(html) {
    // Extract <title> content
    const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
    let label = null;
    let isPhishing = false;
    let warning = null;
    if (titleMatch) {
        const title = titleMatch[1].trim();
        // Title: "LABEL | Address: 0x... | Etherscan" or "Address: 0x... | Etherscan"
        const labelMatch = title.match(/^(.+?)\s*\|\s*Address:/);
        if (labelMatch) {
            const candidate = labelMatch[1].trim();
            // Only treat as a label if it's not just "Address" (unlabeled addresses)
            if (candidate.toLowerCase() !== "address") {
                label = candidate;
            }
        }
    }
    // Check label against phishing patterns
    if (label) {
        for (const pat of PHISHING_LABEL_PATTERNS) {
            if (pat.test(label)) {
                isPhishing = true;
                warning = `Etherscan labels this address as "${label}" (Phish/Hack).`;
                break;
            }
        }
    }
    // Check page body for scam warning banners
    if (!isPhishing) {
        for (const pat of SCAM_BODY_PATTERNS) {
            if (pat.test(html)) {
                isPhishing = true;
                warning = label
                    ? `Etherscan labels this address as "${label}" and reports it was used in a scam.`
                    : "Etherscan reports this address was flagged for phishing/scam activity.";
                break;
            }
        }
    }
    return { label, isPhishing, warning };
 }
 /**
 * Fetch an address page from Etherscan and check for scam/phishing labels.
 * Returns a warning object if the address is flagged, or null.
 * Network failures return null silently (best-effort check).
 *
 * Uses the current network's explorer URL so the lookup works on both
 * mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
 *
 * @param {string} address - Ethereum address to check.
 * @returns {Promise<{type: string, message: string, severity: string}|null>}
 */
 async function checkEtherscanLabel(address) {
    try {
        // Lazy require to avoid pulling in chrome.storage at module scope
        // (which breaks unit tests that only exercise parseEtherscanPage).
        const { currentNetwork } = require("./state");
        const etherscanBase = currentNetwork().explorerUrl + "/address/";
        const resp = await fetch(etherscanBase + address, {
            headers: { Accept: "text/html" },
        });
        if (!resp.ok) return null;
        const html = await resp.text();
        const result = parseEtherscanPage(html);
        if (result.isPhishing) {
            return {
                type: "etherscan-phishing",
                message: result.warning,
                severity: "critical",
            };
        }
        return null;
    } catch {
        // Network errors are expected — Etherscan may rate-limit or block.
        return null;
    }
 }
 module.exports = { parseEtherscanPage, checkEtherscanLabel };
--- a/src/shared/log.js
+++ b/src/shared/log.js
@@ -1,27 +1,12 @@
 // Leveled logger. Outputs to console with [AutistMask] prefix.
-// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
+// Level is DEBUG when the DEBUG constant is true, INFO otherwise.
 // debugMode state flag is enabled.  The runtime flag is checked lazily so it
 // responds immediately when toggled in settings.
 const { DEBUG } = require("./constants");
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
-
+const threshold = DEBUG ? LEVELS.debug : LEVELS.info;
 // Runtime debug mode flag — set by settings.js when the user toggles debug
 // mode via the easter egg.  Kept here as a simple mutable reference so it can
 // be updated without circular dependency issues with state.js.
 let _runtimeDebug = false;
 function setRuntimeDebug(enabled) {
    _runtimeDebug = enabled;
 }
 function isDebug() {
    return DEBUG || _runtimeDebug;
 }
 function emit(level, method, args) {
    const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
    if (LEVELS[level] >= threshold) {
        console[method]("[AutistMask]", ...args);
    }
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
    return resp;
 }
-module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
+module.exports = { log, debugFetch };
--- a/src/shared/networks.js
+++ b/src/shared/networks.js
@@ -1,57 +0,0 @@
 // Network definitions for supported Ethereum networks.
 // Each network specifies its chain ID, default RPC and Blockscout endpoints,
 // and the block explorer base URL used for address/tx/token/block links.
 const NETWORKS = {
    mainnet: {
        id: "mainnet",
        name: "Ethereum Mainnet",
        chainId: "0x1",
        networkVersion: "1",
        nativeCurrency: "ETH",
        defaultRpcUrl: "https://ethereum-rpc.publicnode.com",
        defaultBlockscoutUrl: "https://eth.blockscout.com/api/v2",
        explorerUrl: "https://etherscan.io",
        isTestnet: false,
    },
    sepolia: {
        id: "sepolia",
        name: "Sepolia Testnet",
        chainId: "0xaa36a7",
        networkVersion: "11155111",
        nativeCurrency: "SepoliaETH",
        defaultRpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
        defaultBlockscoutUrl: "https://eth-sepolia.blockscout.com/api/v2",
        explorerUrl: "https://sepolia.etherscan.io",
        isTestnet: true,
    },
 };
 const SUPPORTED_CHAIN_IDS = new Set(
    Object.values(NETWORKS).map((n) => n.chainId),
 );
 function networkById(id) {
    return NETWORKS[id] || NETWORKS.mainnet;
 }
 function networkByChainId(chainId) {
    for (const net of Object.values(NETWORKS)) {
        if (net.chainId === chainId) return net;
    }
    return null;
 }
 // Build a block explorer link for the given path type and value.
 // type: "address" | "tx" | "token" | "block"
 function explorerLink(network, type, value) {
    return `${network.explorerUrl}/${type}/${value}`;
 }
 module.exports = {
    NETWORKS,
    SUPPORTED_CHAIN_IDS,
    networkById,
    networkByChainId,
    explorerLink,
 };
--- a/src/shared/phishingBlocklist.json
+++ b/src/shared/phishingBlocklist.json
--- a/src/shared/phishingDomains.js
+++ b/src/shared/phishingDomains.js
@@ -1,215 +0,0 @@
 // Domain-based phishing detection using a vendored blocklist with delta updates.
 //
 // A community-maintained phishing domain blocklist is vendored in
 // phishingBlocklist.json and bundled at build time. At runtime, we fetch
 // the live list periodically and keep only the delta (new entries not in
 // the vendored list) in memory. This keeps runtime memory usage small.
 //
 // The domain-checker checks the in-memory delta first (fresh/recent scam
 // sites), then falls back to the vendored list.
 //
 // If the delta is under 256 KiB it is persisted to localStorage so it
 // survives extension/service-worker restarts.
 const vendoredConfig = require("./phishingBlocklist.json");
 const BLOCKLIST_URL =
    "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const DELTA_STORAGE_KEY = "phishing-delta";
 const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 // Vendored set — built once from the bundled JSON.
 const vendoredBlacklist = new Set(
    (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
 );
 // Delta set — only entries from live list that are NOT in vendored.
 let deltaBlacklist = new Set();
 let lastFetchTime = 0;
 let fetchPromise = null;
 let refreshTimer = null;
 /**
 * Load delta entries from localStorage on startup.
 * Called once during module initialization in the background script.
 */
 function loadDeltaFromStorage() {
    try {
        const raw = localStorage.getItem(DELTA_STORAGE_KEY);
        if (!raw) return;
        const data = JSON.parse(raw);
        if (data.blacklist && Array.isArray(data.blacklist)) {
            deltaBlacklist = new Set(
                data.blacklist.map((d) => d.toLowerCase()),
            );
        }
    } catch {
        // localStorage unavailable or corrupt — start empty
    }
 }
 /**
 * Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
 */
 function saveDeltaToStorage() {
    try {
        const data = {
            blacklist: Array.from(deltaBlacklist),
        };
        const json = JSON.stringify(data);
        if (json.length < MAX_DELTA_BYTES) {
            localStorage.setItem(DELTA_STORAGE_KEY, json);
        } else {
            // Too large — remove stale key if present
            localStorage.removeItem(DELTA_STORAGE_KEY);
        }
    } catch {
        // localStorage unavailable — skip silently
    }
 }
 /**
 * Load a pre-parsed config and compute the delta against the vendored list.
 * Used for both live fetches and testing.
 *
 * @param {{ blacklist?: string[] }} config
 */
 function loadConfig(config) {
    const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
    // Delta = entries in the live list that are NOT in the vendored list
    deltaBlacklist = new Set(
        liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
    );
    lastFetchTime = Date.now();
    saveDeltaToStorage();
 }
 /**
 * Generate hostname variants for subdomain matching.
 * "sub.evil.com" yields ["sub.evil.com", "evil.com"].
 *
 * @param {string} hostname
 * @returns {string[]}
 */
 function hostnameVariants(hostname) {
    const h = hostname.toLowerCase();
    const variants = [h];
    const parts = h.split(".");
    // Parent domains: a.b.c.d -> b.c.d, c.d
    for (let i = 1; i < parts.length - 1; i++) {
        variants.push(parts.slice(i).join("."));
    }
    return variants;
 }
 /**
 * Check if a hostname is on the phishing blocklist.
 * Checks delta first (fresh/recent scam sites), then vendored list.
 *
 * @param {string} hostname - The hostname to check.
 * @returns {boolean}
 */
 function isPhishingDomain(hostname) {
    if (!hostname) return false;
    const variants = hostnameVariants(hostname);
    // Check delta blacklist first (fresh/recent scam sites), then vendored
    for (const v of variants) {
        if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
    }
    return false;
 }
 /**
 * Fetch the latest blocklist and compute delta against vendored data.
 * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
 *
 * @returns {Promise<void>}
 */
 async function updatePhishingList() {
    // Skip if recently fetched
    if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
        return;
    }
    // De-duplicate concurrent calls
    if (fetchPromise) return fetchPromise;
    fetchPromise = (async () => {
        try {
            const resp = await fetch(BLOCKLIST_URL);
            if (!resp.ok) throw new Error("HTTP " + resp.status);
            const config = await resp.json();
            loadConfig(config);
        } catch {
            // Silently fail — vendored list still provides coverage.
            // We'll retry next time.
        } finally {
            fetchPromise = null;
        }
    })();
    return fetchPromise;
 }
 /**
 * Start periodic refresh of the phishing list.
 * Should be called once from the background script on startup.
 */
 function startPeriodicRefresh() {
    if (refreshTimer) return;
    refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
 }
 /**
 * Return the total blocklist size (vendored + delta) for diagnostics.
 *
 * @returns {number}
 */
 function getBlocklistSize() {
    return vendoredBlacklist.size + deltaBlacklist.size;
 }
 /**
 * Return the delta blocklist size for diagnostics.
 *
 * @returns {number}
 */
 function getDeltaSize() {
    return deltaBlacklist.size;
 }
 /**
 * Reset internal state (for testing).
 */
 function _reset() {
    deltaBlacklist = new Set();
    lastFetchTime = 0;
    fetchPromise = null;
    if (refreshTimer) {
        clearInterval(refreshTimer);
        refreshTimer = null;
    }
 }
 // Load persisted delta on module initialization
 loadDeltaFromStorage();
 module.exports = {
    isPhishingDomain,
    updatePhishingList,
    startPeriodicRefresh,
    loadConfig,
    getBlocklistSize,
    getDeltaSize,
    hostnameVariants,
    _reset,
    // Exposed for testing only
    _getVendoredBlacklistSize: () => vendoredBlacklist.size,
    _getDeltaBlacklist: () => deltaBlacklist,
 };
--- a/src/shared/prices.js
+++ b/src/shared/prices.js
@@ -8,13 +8,6 @@ const prices = {};
 let lastFetchedAt = 0;
 async function refreshPrices() {
    // Testnet tokens have no real market value — skip price fetching
    // and clear any stale mainnet prices so the UI shows no USD values.
    const { currentNetwork } = require("./state");
    if (currentNetwork().isTestnet) {
        clearPrices();
        return;
    }
    const now = Date.now();
    if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
    try {
@@ -26,19 +19,7 @@ async function refreshPrices() {
    }
 }
 // Clear all cached prices and reset the fetch timestamp so the
 // next refreshPrices() call will fetch fresh data.
 function clearPrices() {
    for (const key of Object.keys(prices)) {
        delete prices[key];
    }
    lastFetchedAt = 0;
 }
 // Return the USD price for a symbol, or null on testnet / unknown.
 function getPrice(symbol) {
    const { currentNetwork } = require("./state");
    if (currentNetwork().isTestnet) return null;
    return prices[symbol] || null;
 }
@@ -56,8 +37,6 @@ function formatUsd(amount) {
 }
 function getAddressValueUsd(addr) {
    const { currentNetwork } = require("./state");
    if (currentNetwork().isTestnet) return null;
    if (!prices.ETH) return null;
    let total = 0;
    const ethBal = parseFloat(addr.balance || "0");
@@ -72,8 +51,6 @@ function getAddressValueUsd(addr) {
 }
 function getWalletValueUsd(wallet) {
    const { currentNetwork } = require("./state");
    if (currentNetwork().isTestnet) return null;
    if (!prices.ETH) return null;
    let total = 0;
    for (const addr of wallet.addresses) {
@@ -83,8 +60,6 @@ function getWalletValueUsd(wallet) {
 }
 function getTotalValueUsd(wallets) {
    const { currentNetwork } = require("./state");
    if (currentNetwork().isTestnet) return null;
    if (!prices.ETH) return null;
    let total = 0;
    for (const wallet of wallets) {
@@ -96,7 +71,6 @@ function getTotalValueUsd(wallets) {
 module.exports = {
    prices,
    refreshPrices,
    clearPrices,
    getPrice,
    formatUsd,
    getAddressValueUsd,
--- a/src/shared/scamlist.js
+++ b/src/shared/scamlist.js
--- a/src/shared/state.js
+++ b/src/shared/state.js
@@ -1,7 +1,6 @@
 // State management and extension storage persistence.
 const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
 const { networkById } = require("./networks");
 const storageApi =
    typeof browser !== "undefined"
@@ -12,7 +11,6 @@ const DEFAULT_STATE = {
    hasWallet: false,
    wallets: [],
    trackedTokens: [],
    networkId: "mainnet",
    rpcUrl: DEFAULT_RPC_URL,
    blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
    lastBalanceRefresh: 0,
@@ -25,11 +23,8 @@ const DEFAULT_STATE = {
    hideFraudContracts: true,
    hideDustTransactions: true,
    dustThresholdGwei: 100000,
    utcTimestamps: false,
    fraudContracts: [],
    tokenHolderCache: {},
    theme: "system",
    debugMode: false,
 };
 const state = {
@@ -39,20 +34,13 @@ const state = {
    selectedAddress: null,
    selectedToken: null,
    viewData: {},
    viewStack: [],
 };
 // Return the network configuration for the currently selected network.
 function currentNetwork() {
    return networkById(state.networkId);
 }
 async function saveState() {
    const persisted = {
        hasWallet: state.hasWallet,
        wallets: state.wallets,
        trackedTokens: state.trackedTokens,
        networkId: state.networkId,
        rpcUrl: state.rpcUrl,
        blockscoutUrl: state.blockscoutUrl,
        lastBalanceRefresh: state.lastBalanceRefresh,
@@ -65,17 +53,13 @@ async function saveState() {
        hideFraudContracts: state.hideFraudContracts,
        hideDustTransactions: state.hideDustTransactions,
        dustThresholdGwei: state.dustThresholdGwei,
        utcTimestamps: state.utcTimestamps,
        fraudContracts: state.fraudContracts,
        tokenHolderCache: state.tokenHolderCache,
        theme: state.theme,
        debugMode: state.debugMode,
        currentView: state.currentView,
        selectedWallet: state.selectedWallet,
        selectedAddress: state.selectedAddress,
        selectedToken: state.selectedToken,
        viewData: state.viewData,
        viewStack: state.viewStack,
    };
    await storageApi.set({ autistmask: persisted });
 }
@@ -87,7 +71,6 @@ async function loadState() {
        state.hasWallet = saved.hasWallet;
        state.wallets = saved.wallets || [];
        state.trackedTokens = saved.trackedTokens || [];
        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
        state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
        state.blockscoutUrl =
            saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
@@ -125,13 +108,8 @@ async function loadState() {
            saved.dustThresholdGwei !== undefined
                ? saved.dustThresholdGwei
                : 100000;
        state.utcTimestamps =
            saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
        state.fraudContracts = saved.fraudContracts || [];
        state.tokenHolderCache = saved.tokenHolderCache || {};
        state.theme = saved.theme || "system";
        state.debugMode =
            saved.debugMode !== undefined ? saved.debugMode : false;
        state.currentView = saved.currentView || null;
        state.selectedWallet =
            saved.selectedWallet !== undefined ? saved.selectedWallet : null;
@@ -139,7 +117,6 @@ async function loadState() {
            saved.selectedAddress !== undefined ? saved.selectedAddress : null;
        state.selectedToken = saved.selectedToken || null;
        state.viewData = saved.viewData || {};
        state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
    }
 }
@@ -150,10 +127,4 @@ function currentAddress() {
    return state.wallets[state.selectedWallet].addresses[state.selectedAddress];
 }
-module.exports = {
+module.exports = { state, saveState, loadState, currentAddress };
    state,
    saveState,
    loadState,
    currentAddress,
    currentNetwork,
 };
--- a/src/shared/tokenList.js
+++ b/src/shared/tokenList.js
--- a/src/shared/transactions.js
+++ b/src/shared/transactions.js
@@ -27,9 +27,6 @@ function parseTx(tx, addrLower) {
    // For contract calls, produce a meaningful label instead of "0.0000 ETH"
    let symbol = "ETH";
    let value = formatTxValue(formatEther(rawWei));
    let exactValue = formatEther(rawWei);
    let rawAmount = rawWei;
    let rawUnit = "wei";
    let direction = from.toLowerCase() === addrLower ? "sent" : "received";
    let directionLabel = direction === "sent" ? "Sent" : "Received";
    if (toIsContract && method && method !== "transfer") {
@@ -37,27 +34,10 @@ function parseTx(tx, addrLower) {
        if (token) {
            symbol = token.symbol;
        }
-        // Map known DEX methods to "Swap" for cleaner display
+        const label = method.charAt(0).toUpperCase() + method.slice(1);
        const SWAP_METHODS = new Set([
            "execute",
            "swap",
            "swapExactTokensForTokens",
            "swapTokensForExactTokens",
            "swapExactETHForTokens",
            "swapTokensForExactETH",
            "swapExactTokensForETH",
            "swapETHForExactTokens",
            "multicall",
        ]);
        const label = SWAP_METHODS.has(method)
            ? "Swap"
            : method.charAt(0).toUpperCase() + method.slice(1);
        direction = "contract";
        directionLabel = label;
        value = "";
        exactValue = "";
        rawAmount = "";
        rawUnit = "";
    }
    return {
@@ -67,9 +47,6 @@ function parseTx(tx, addrLower) {
        from: from,
        to: to,
        value: value,
        exactValue: exactValue,
        rawAmount: rawAmount,
        rawUnit: rawUnit,
        valueGwei: Math.floor(Number(BigInt(rawWei) / BigInt(1000000000))),
        symbol: symbol,
        direction: direction,
@@ -86,21 +63,17 @@ function parseTokenTransfer(tt, addrLower) {
    const from = tt.from?.hash || "";
    const to = tt.to?.hash || "";
    const decimals = parseInt(tt.total?.decimals || "18", 10);
-    const rawVal = tt.total?.value || "0";
+    const rawValue = tt.total?.value || "0";
    const direction = from.toLowerCase() === addrLower ? "sent" : "received";
    const sym = tt.token?.symbol || "?";
    return {
        hash: tt.transaction_hash,
        blockNumber: tt.block_number,
        timestamp: Math.floor(new Date(tt.timestamp).getTime() / 1000),
        from: from,
        to: to,
-        value: formatTxValue(formatUnits(rawVal, decimals)),
+        value: formatTxValue(formatUnits(rawValue, decimals)),
        exactValue: formatUnits(rawVal, decimals),
        rawAmount: rawVal,
        rawUnit: sym + " base units (10^-" + decimals + ")",
        valueGwei: null,
-        symbol: sym,
+        symbol: tt.token?.symbol || "?",
        direction: direction,
        directionLabel: direction === "sent" ? "Sent" : "Received",
        isError: false,
@@ -153,40 +126,10 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
    // When a token transfer shares a hash with a normal tx, the normal tx
    // is the contract call (0 ETH) and the token transfer has the real
-    // amount and symbol.  For contract calls (swaps), a single transaction
+    // amount and symbol. Replace the normal tx with the token transfer.
    // can produce multiple token transfers (input, intermediates, output).
    // We consolidate these into the original tx entry using the token
    // transfer where the user *receives* tokens (the swap output), so
    // the transaction list shows the final result rather than confusing
    // intermediate hops.  We preserve the original tx's from/to so the
    // user sees their own address, not a router or Permit2 contract.
    for (const tt of ttJson.items || []) {
        const parsed = parseTokenTransfer(tt, addrLower);
-        const existing = txsByHash.get(parsed.hash);
+        txsByHash.set(parsed.hash, parsed);
        if (existing && existing.direction === "contract") {
            // For contract calls (swaps), consolidate into the original
            // tx entry.  Prefer the "received" transfer (swap output)
            // for the display amount.  If no received transfer exists,
            // fall back to the first "sent" transfer (swap input).
            const isReceived = parsed.direction === "received";
            const needsAmount = !existing.exactValue;
            if (isReceived || needsAmount) {
                existing.value = parsed.value;
                existing.exactValue = parsed.exactValue;
                existing.rawAmount = parsed.rawAmount;
                existing.rawUnit = parsed.rawUnit;
                existing.symbol = parsed.symbol;
                existing.contractAddress = parsed.contractAddress;
                existing.holders = parsed.holders;
            }
            // Keep the original tx's from/to (the user's address and the
            // contract they called), not the token transfer's from/to
            // which may be a router or Permit2 contract.
            continue;
        }
        // Non-contract token transfers get their own entries.
        const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
        txsByHash.set(ttKey, parsed);
    }
    const txs = [...txsByHash.values()];
--- a/src/shared/uniswap.js
+++ b/src/shared/uniswap.js
@@ -1,505 +0,0 @@
 // Decode Uniswap Universal Router execute() calldata into human-readable
 // swap details.  Designed to be extended with other DEX decoders later.
 const { Interface, AbiCoder, getBytes, formatUnits } = require("ethers");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const coder = AbiCoder.defaultAbiCoder();
 const ROUTER_IFACE = new Interface([
    "function execute(bytes commands, bytes[] inputs, uint256 deadline)",
 ]);
 // Universal Router command IDs (lower 5 bits of each command byte)
 const COMMAND_NAMES = {
    0x00: "V3 Swap (Exact In)",
    0x01: "V3 Swap (Exact Out)",
    0x02: "Permit2 Transfer",
    0x03: "Permit2 Permit Batch",
    0x04: "Sweep",
    0x05: "Transfer",
    0x06: "Pay Portion",
    0x08: "V2 Swap (Exact In)",
    0x09: "V2 Swap (Exact Out)",
    0x0a: "Permit2 Permit",
    0x0b: "Wrap ETH",
    0x0c: "Unwrap WETH",
    0x0d: "Permit2 Transfer Batch",
    0x0e: "Balance Check",
    0x10: "V4 Swap",
    0x11: "V3 Position Mgr Permit",
    0x12: "V3 Position Mgr Call",
    0x13: "V4 Initialize Pool",
    0x14: "V4 Position Mgr Call",
    0x21: "Execute Sub-Plan",
 };
 function formatAmount(raw, decimals) {
    const parts = formatUnits(raw, decimals).split(".");
    if (parts.length === 1) return parts[0] + ".0000";
    const dec = (parts[1] + "0000").slice(0, 4);
    return parts[0] + "." + dec;
 }
 function tokenInfo(address) {
    if (!address || address === "0x0000000000000000000000000000000000000000") {
        return { symbol: "ETH", decimals: 18, address: null };
    }
    const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
    if (t) return { symbol: t.symbol, decimals: t.decimals, address };
    return { symbol: null, decimals: 18, address };
 }
 // Decode PERMIT2_PERMIT (command 0x0a) input bytes.
 // ABI: ((address token, uint160 amount, uint48 expiration, uint48 nonce),
 //        address spender, uint256 sigDeadline), bytes signature
 function decodePermit2(input) {
    try {
        const d = coder.decode(
            [
                "tuple(tuple(address,uint160,uint48,uint48),address,uint256)",
                "bytes",
            ],
            input,
        );
        return { token: d[0][0][0], amount: d[0][0][1], spender: d[0][1] };
    } catch {
        return null;
    }
 }
 // Decode BALANCE_CHECK_ERC20 (command 0x0e) input bytes.
 // ABI: (address owner, address token, uint256 minBalance)
 function decodeBalanceCheck(input) {
    try {
        const d = coder.decode(["address", "address", "uint256"], input);
        return { owner: d[0], token: d[1], minBalance: d[2] };
    } catch {
        return null;
    }
 }
 // Decode V2_SWAP_EXACT_IN (command 0x08) input bytes.
 // ABI: (address recipient, uint256 amountIn, uint256 amountOutMin,
 //        address[] path, bool payerIsUser)
 function decodeV2SwapExactIn(input) {
    try {
        const d = coder.decode(
            ["address", "uint256", "uint256", "address[]", "bool"],
            input,
        );
        return {
            amountIn: d[1],
            amountOutMin: d[2],
            tokenIn: d[3][0],
            tokenOut: d[3][d[3].length - 1],
        };
    } catch {
        return null;
    }
 }
 // Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
 // ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
 //        address[] path, bool payerIsUser)
 function decodeV2SwapExactOut(input) {
    try {
        const d = coder.decode(
            ["address", "uint256", "uint256", "address[]", "bool"],
            input,
        );
        return {
            amountOut: d[1],
            amountInMax: d[2],
            tokenIn: d[3][0],
            tokenOut: d[3][d[3].length - 1],
        };
    } catch {
        return null;
    }
 }
 // Decode V3 swap path (packed: token(20) + fee(3) + token(20) ...)
 function decodeV3Path(pathHex) {
    const hex = pathHex.startsWith("0x") ? pathHex.slice(2) : pathHex;
    if (hex.length < 40) return null;
    const tokenIn = "0x" + hex.slice(0, 40);
    const tokenOut = "0x" + hex.slice(-40);
    return { tokenIn, tokenOut };
 }
 // Decode V3_SWAP_EXACT_IN (command 0x00) input bytes.
 // ABI: (address recipient, uint256 amountIn, uint256 amountOutMin,
 //        bytes path, bool payerIsUser)
 function decodeV3SwapExactIn(input) {
    try {
        const d = coder.decode(
            ["address", "uint256", "uint256", "bytes", "bool"],
            input,
        );
        const path = decodeV3Path(d[3]);
        if (!path) return null;
        return {
            amountIn: d[1],
            amountOutMin: d[2],
            tokenIn: path.tokenIn,
            tokenOut: path.tokenOut,
        };
    } catch {
        return null;
    }
 }
 // Decode WRAP_ETH (command 0x0b) input bytes.
 // ABI: (address recipient, uint256 amount)
 function decodeWrapEth(input) {
    try {
        const d = coder.decode(["address", "uint256"], input);
        return { amount: d[1] };
    } catch {
        return null;
    }
 }
 // V4 inner action IDs
 const V4_SWAP_EXACT_IN_SINGLE = 0x06;
 const V4_SWAP_EXACT_IN = 0x07;
 const V4_SWAP_EXACT_OUT_SINGLE = 0x08;
 const V4_SWAP_EXACT_OUT = 0x09;
 const V4_SETTLE = 0x0b;
 const V4_TAKE = 0x0e;
 // Decode V4_SWAP (command 0x10) input bytes.
 // The input is ABI-encoded as (bytes actions, bytes[] params).
 // We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
 // and swap amounts from the swap sub-actions.
 function decodeV4Swap(input) {
    try {
        const d = coder.decode(["bytes", "bytes[]"], input);
        const actions = getBytes(d[0]);
        const params = d[1];
        let settleToken = null;
        let takeToken = null;
        let amountIn = null;
        let amountOutMin = null;
        for (let i = 0; i < actions.length; i++) {
            const actionId = actions[i];
            try {
                if (actionId === V4_SETTLE) {
                    // SETTLE: (address currency, uint256 maxAmount, bool payerIsUser)
                    const s = coder.decode(
                        ["address", "uint256", "bool"],
                        params[i],
                    );
                    settleToken = s[0];
                } else if (actionId === V4_TAKE) {
                    // TAKE: (address currency, address recipient, uint256 amount)
                    const t = coder.decode(
                        ["address", "address", "uint256"],
                        params[i],
                    );
                    takeToken = t[0];
                } else if (
                    actionId === V4_SWAP_EXACT_IN ||
                    actionId === V4_SWAP_EXACT_IN_SINGLE
                ) {
                    // Extract amounts from exact-in swap actions
                    if (actionId === V4_SWAP_EXACT_IN) {
                        // ExactInputParams: (address currencyIn,
                        //   tuple(address,uint24,int24,address,bytes)[] path,
                        //   uint128 amountIn, uint128 amountOutMin)
                        try {
                            const s = coder.decode(
                                [
                                    "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                ],
                                params[i],
                            );
                            if (!settleToken) settleToken = s[0][0];
                            const path = s[0][1];
                            if (path.length > 0 && !takeToken) {
                                takeToken = path[path.length - 1][0];
                            }
                            if (!amountIn) amountIn = s[0][2];
                            if (!amountOutMin) amountOutMin = s[0][3];
                        } catch {
                            // Fall through — SETTLE/TAKE will provide tokens
                        }
                    } else {
                        // ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
                        //   bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
                        try {
                            const s = coder.decode(
                                [
                                    "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                ],
                                params[i],
                            );
                            const poolKey = s[0][0];
                            const zeroForOne = s[0][1];
                            if (!settleToken)
                                settleToken = zeroForOne
                                    ? poolKey[0]
                                    : poolKey[1];
                            if (!takeToken)
                                takeToken = zeroForOne
                                    ? poolKey[1]
                                    : poolKey[0];
                            if (!amountIn) amountIn = s[0][2];
                            if (!amountOutMin) amountOutMin = s[0][3];
                        } catch {
                            // Fall through
                        }
                    }
                } else if (
                    actionId === V4_SWAP_EXACT_OUT ||
                    actionId === V4_SWAP_EXACT_OUT_SINGLE
                ) {
                    if (actionId === V4_SWAP_EXACT_OUT) {
                        try {
                            const s = coder.decode(
                                [
                                    "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                ],
                                params[i],
                            );
                            if (!takeToken) takeToken = s[0][0];
                            const path = s[0][1];
                            if (path.length > 0 && !settleToken) {
                                settleToken = path[path.length - 1][0];
                            }
                        } catch {
                            // Fall through
                        }
                    } else {
                        try {
                            const s = coder.decode(
                                [
                                    "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                ],
                                params[i],
                            );
                            const poolKey = s[0][0];
                            const zeroForOne = s[0][1];
                            if (!settleToken)
                                settleToken = zeroForOne
                                    ? poolKey[0]
                                    : poolKey[1];
                            if (!takeToken)
                                takeToken = zeroForOne
                                    ? poolKey[1]
                                    : poolKey[0];
                        } catch {
                            // Fall through
                        }
                    }
                }
            } catch {
                // Skip sub-actions we can't decode
            }
        }
        return {
            tokenIn: settleToken,
            tokenOut: takeToken,
            amountIn,
            amountOutMin,
        };
    } catch {
        return null;
    }
 }
 // Try to decode a Universal Router execute() call.
 // Returns { name, description, details } matching the format used by
 // the approval UI, or null if the calldata is not a recognised execute().
 function decode(data, toAddress) {
    try {
        const parsed = ROUTER_IFACE.parseTransaction({ data });
        if (!parsed) return null;
        const commandsBytes = getBytes(parsed.args[0]);
        const inputs = parsed.args[1];
        const deadline = parsed.args[2];
        let inputToken = null;
        let inputAmount = null;
        let outputToken = null;
        let minOutput = null;
        let hasUnwrapWeth = false;
        const commandNames = [];
        for (let i = 0; i < commandsBytes.length; i++) {
            const cmdId = commandsBytes[i] & 0x1f;
            commandNames.push(
                COMMAND_NAMES[cmdId] ||
                    "Command 0x" + cmdId.toString(16).padStart(2, "0"),
            );
            try {
                if (cmdId === 0x0a) {
                    const p = decodePermit2(inputs[i]);
                    if (p) {
                        inputToken = p.token;
                        inputAmount = p.amount;
                    }
                }
                if (cmdId === 0x0e) {
                    const b = decodeBalanceCheck(inputs[i]);
                    if (b) {
                        outputToken = b.token;
                        minOutput = b.minBalance;
                    }
                }
                if (cmdId === 0x00) {
                    const s = decodeV3SwapExactIn(inputs[i]);
                    if (s) {
                        if (!inputToken) inputToken = s.tokenIn;
                        if (!inputAmount) inputAmount = s.amountIn;
                        // Always update output: in multi-step swaps (V3 → V4),
                        // the last swap step determines the final output token
                        // and minimum received amount.
                        outputToken = s.tokenOut;
                        minOutput = s.amountOutMin;
                    }
                }
                if (cmdId === 0x08) {
                    const s = decodeV2SwapExactIn(inputs[i]);
                    if (s) {
                        if (!inputToken) inputToken = s.tokenIn;
                        if (!inputAmount) inputAmount = s.amountIn;
                        outputToken = s.tokenOut;
                        minOutput = s.amountOutMin;
                    }
                }
                if (cmdId === 0x0b) {
                    const w = decodeWrapEth(inputs[i]);
                    if (w && !inputToken) {
                        inputToken =
                            "0x0000000000000000000000000000000000000000";
                        inputAmount = w.amount;
                    }
                }
                if (cmdId === 0x10) {
                    const v4 = decodeV4Swap(inputs[i]);
                    if (v4) {
                        if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
                        if (!inputAmount && v4.amountIn)
                            inputAmount = v4.amountIn;
                        // Always update output: last swap step wins
                        if (v4.tokenOut) outputToken = v4.tokenOut;
                        if (v4.amountOutMin) minOutput = v4.amountOutMin;
                    }
                }
                if (cmdId === 0x0c) {
                    hasUnwrapWeth = true;
                }
            } catch {
                // Skip commands we can't decode
            }
        }
        // Resolve token info
        const inInfo = tokenInfo(inputToken);
        const outInfo = hasUnwrapWeth
            ? { symbol: "ETH", decimals: 18, address: null }
            : tokenInfo(outputToken);
        const inSymbol = inInfo.symbol;
        const outSymbol = outInfo.symbol;
        const name =
            inSymbol && outSymbol
                ? "Swap " + inSymbol + " \u2192 " + outSymbol
                : "Uniswap Swap";
        const details = [];
        details.push({
            label: "Protocol",
            value: "Uniswap Universal Router",
            address: toAddress,
        });
        if (inputToken && inInfo.address) {
            const label = inSymbol
                ? inSymbol + " (" + inputToken + ")"
                : inputToken;
            details.push({
                label: "Token In",
                value: label,
                address: inputToken,
                isToken: true,
            });
        } else if (inSymbol === "ETH") {
            details.push({ label: "Token In", value: "ETH (native)" });
        }
        if (inputAmount !== null && inputAmount !== undefined) {
            const maxUint160 = BigInt(
                "0xffffffffffffffffffffffffffffffffffffffff",
            );
            const isUnlimited = inputAmount >= maxUint160;
            const amountRaw = isUnlimited
                ? "Unlimited"
                : formatAmount(inputAmount, inInfo.decimals);
            const amountStr = isUnlimited
                ? "Unlimited"
                : amountRaw + (inSymbol ? " " + inSymbol : "");
            details.push({
                label: "Amount",
                value: amountStr,
                rawValue: amountRaw,
            });
        }
        if (outSymbol) {
            if (outInfo.address) {
                const label = outSymbol
                    ? outSymbol + " (" + outputToken + ")"
                    : outputToken;
                details.push({
                    label: "Token Out",
                    value: label,
                    address: outputToken,
                    isToken: true,
                });
            } else {
                details.push({ label: "Token Out", value: outSymbol });
            }
        }
        if (minOutput !== null && minOutput !== undefined) {
            const minStr =
                formatAmount(minOutput, outInfo.decimals) +
                (outSymbol ? " " + outSymbol : "");
            details.push({ label: "Min. received", value: minStr });
        }
        details.push({ label: "Steps", value: commandNames.join(" \u2192 ") });
        const deadlineDate = new Date(Number(deadline) * 1000);
        details.push({
            label: "Deadline",
            value: deadlineDate.toISOString().replace("T", " ").slice(0, 19),
        });
        return {
            name,
            description: "Swap via Uniswap Universal Router",
            details,
        };
    } catch {
        return null;
    }
 }
 module.exports = { decode };
--- a/src/shared/vault.js
+++ b/src/shared/vault.js
@@ -1,75 +1,14 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
 //
 // Backend: WebAssembly, deliberately (#182).
 //
 // libsodium ships one file containing both a WebAssembly build and a
 // wasm2js ("asm.js") translation of it. It tries WASM first and, if
 // instantiation throws, silently swaps in the translation. An extension
 // CSP of plain script-src 'self' refuses WASM, so every popup load used
 // to take that fallback — announced by nothing but an uncaught
 // CompileError in the console.
 //
 // Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
 // MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
 // WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
 // identical either way — it is set by the ops/mem parameters, not by wall
 // time — so the fallback bought no security, it only made every password
 // operation take three and a half seconds, and the wallet asks for the
 // password on every signature.
 //
 // So both manifests declare 'wasm-unsafe-eval' for extension pages. That
 // keyword permits compiling WebAssembly and nothing else: not eval() of
 // strings, not inline script, not remote script. Reaching it requires
 // already executing script in the extension page, which is total
 // compromise on its own. 'unsafe-eval' would be a different matter and is
 // not granted. tests/manifest.test.js pins both policies to exactly
 // "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
 // strictness can drift unnoticed.
 //
 // The fallback still exists, and a wallet that refuses to decrypt is
 // worse than a slow one, so it is not disabled — it is made loud:
 // cryptoBackend() reports which backend this realm can run, ensureReady()
 // logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
 // unit tests exercise the WASM backend, and the end-to-end suite asserts
 // it in the real popup under the real manifest.
 const sodium = require("libsodium-wrappers-sumo");
 const { log } = require("./log");
 // An empty WebAssembly module: the 8-byte magic number and version header,
 // no sections. Compiling it asks the cheapest possible form of the only
 // question that matters here — may this realm compile WebAssembly at all —
 // which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
 // exactly what decides which backend libsodium ends up on.
 const EMPTY_WASM_MODULE = new Uint8Array([
    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
 ]);
 // "wasm" or "asmjs": the libsodium backend in use in this realm.
 async function cryptoBackend() {
    try {
        await WebAssembly.compile(EMPTY_WASM_MODULE);
        return "wasm";
    } catch (_) {
        return "asmjs";
    }
 }
 let ready = false;
 async function ensureReady() {
    if (!ready) {
        await sodium.ready;
        if ((await cryptoBackend()) !== "wasm") {
            log.errorf(
                "libsodium is running on the wasm2js fallback: this realm " +
                    "refuses to compile WebAssembly, so every password " +
                    "derivation costs roughly 20x what it should. See the " +
                    "backend note in src/shared/vault.js.",
            );
        }
        ready = true;
    }
 }
@@ -120,4 +59,4 @@ async function decryptWithPassword(encrypted, password) {
    return sodium.to_string(plaintext);
 }
-module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };
+module.exports = { encryptWithPassword, decryptWithPassword };
--- a/src/shared/wallet.js
+++ b/src/shared/wallet.js
@@ -5,10 +5,6 @@ const { Mnemonic, HDNodeWallet, Wallet } = require("ethers");
 const { DEBUG, DEBUG_MNEMONIC, BIP44_ETH_PATH } = require("./constants");
 function generateMnemonic() {
    // This must stay the compile-time DEBUG constant. Do NOT switch it to
    // isDebug() from log.js: that also ORs in the runtime debugMode flag the
    // settings toggle drives, which would let a user of a release build turn
    // the hardcoded, publicly known test phrase back on for real wallets.
    if (DEBUG) return DEBUG_MNEMONIC;
    const m = Mnemonic.fromEntropy(
        globalThis.crypto.getRandomValues(new Uint8Array(16)),
@@ -28,26 +24,6 @@ function hdWalletFromMnemonic(mnemonic) {
    return { xpub, firstAddress };
 }
 function hdWalletFromXprv(xprv) {
    const root = HDNodeWallet.fromExtendedKey(xprv);
    if (!root.privateKey) {
        throw new Error("Not an extended private key (xprv).");
    }
    const node = root.derivePath("44'/60'/0'/0");
    const xpub = node.neuter().extendedKey;
    const firstAddress = node.deriveChild(0).address;
    return { xpub, firstAddress };
 }
 function isValidXprv(key) {
    try {
        const node = HDNodeWallet.fromExtendedKey(key);
        return !!node.privateKey;
    } catch {
        return false;
    }
 }
 function addressFromPrivateKey(key) {
    const w = new Wallet(key);
    return w.address;
@@ -62,11 +38,6 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
        );
        return node.deriveChild(addrIndex);
    }
    if (walletData.type === "xprv") {
        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
        const node = root.derivePath("44'/60'/0'/0");
        return node.deriveChild(addrIndex);
    }
    return new Wallet(decryptedSecret);
 }
@@ -78,8 +49,6 @@ module.exports = {
    generateMnemonic,
    deriveAddressFromXpub,
    hdWalletFromMnemonic,
    hdWalletFromXprv,
    isValidXprv,
    addressFromPrivateKey,
    getSignerForAddress,
    isValidMnemonic,
--- a/src/shared/walletDelete.js
+++ b/src/shared/walletDelete.js
@@ -1,70 +0,0 @@
 // Wallet deletion state transition, kept out of the view so the selection
 // and broadcast rules are testable without a DOM.
 // Remove wallet `walletIdx` from `state` and repair the derived state.
 //
 // Rules:
 //   - `hasWallet` tracks whether any wallet remains.
 //   - Site permissions are dropped for every address of the deleted wallet.
 //   - `selectedWallet` follows the splice: it is decremented when a wallet
 //     before it was removed, and falls back to the first remaining wallet's
 //     first address only when the selection itself was deleted.
 //   - `activeAddress` is only moved when it belonged to the deleted wallet;
 //     the fallback is the first remaining wallet's first address, or null
 //     when no wallet remains.
 //
 // Returns whether `activeAddress` changed, so the caller can broadcast it.
 function removeWalletFromState(state, walletIdx) {
    const wallet = state.wallets[walletIdx];
    const addresses = (wallet.addresses || []).map((a) => a.address);
    const previousActive = state.activeAddress;
    const activeWasDeleted =
        previousActive !== null &&
        previousActive !== undefined &&
        addresses.some(
            (a) => a.toLowerCase() === String(previousActive).toLowerCase(),
        );
    state.wallets.splice(walletIdx, 1);
    for (const addr of addresses) {
        delete state.allowedSites[addr];
        delete state.deniedSites[addr];
    }
    state.hasWallet = state.wallets.length > 0;
    const fallbackAddress = state.hasWallet
        ? state.wallets[0].addresses[0]?.address || null
        : null;
    if (!state.hasWallet) {
        state.selectedWallet = null;
        state.selectedAddress = null;
    } else if (state.selectedWallet === walletIdx) {
        state.selectedWallet = 0;
        state.selectedAddress = 0;
    } else if (
        typeof state.selectedWallet === "number" &&
        state.selectedWallet > walletIdx
    ) {
        state.selectedWallet -= 1;
    }
    if (activeWasDeleted || !state.hasWallet) {
        state.activeAddress = fallbackAddress;
    }
    return { activeAddressChanged: state.activeAddress !== previousActive };
 }
 // Tell the background the active address changed, so it re-emits
 // accountsChanged to connected sites. Same call shape as the address
 // switch in the home view.
 function broadcastActiveChanged() {
    const runtime =
        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
    runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
 }
 module.exports = { removeWalletFromState, broadcastActiveChanged };
--- a/tests/approvalVerify.test.js
+++ b/tests/approvalVerify.test.js
@@ -1,355 +0,0 @@
 const { Network, Transaction, Wallet } = require("ethers");
 const {
    verifySignedTx,
    verifySignature,
    sameAddress,
 } = require("../src/shared/approvalVerify");
 const { getSignerForAddress } = require("../src/shared/wallet");
 // Fixed test keys — never used for anything but these tests.
 const SIGNER_KEY =
    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
 const OTHER_KEY =
    "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a";
 const signer = new Wallet(SIGNER_KEY);
 const other = new Wallet(OTHER_KEY);
 const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 const OTHER_RECIPIENT = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
 // Approved parameters as a dApp would supply them over eth_sendTransaction.
 const TX_PARAMS = {
    from: signer.address,
    to: RECIPIENT,
    value: "0x2386f26fc10000",
    data: "0xdeadbeef",
    gas: "0x5208",
 };
 // Build a signable transaction from approved params. The popup does the same
 // thing through populateTransaction(); here the fields are fixed so the test
 // needs no provider.
 function txFor(params) {
    return {
        chainId: 1,
        nonce: 7,
        gasLimit: 100000n,
        maxFeePerGas: 2000000000n,
        maxPriorityFeePerGas: 1000000000n,
        type: 2,
        to: params.to,
        value: params.value === undefined ? 0n : BigInt(params.value),
        data: params.data || "0x",
    };
 }
 async function signedFor(params, withWallet) {
    return (withWallet || signer).signTransaction(txFor(params));
 }
 describe("sameAddress", () => {
    test("compares checksummed and lowercase forms as equal", () => {
        expect(sameAddress(RECIPIENT, RECIPIENT.toLowerCase())).toBe(true);
    });
    test("treats two absent addresses as equal (contract creation)", () => {
        expect(sameAddress(null, undefined)).toBe(true);
        expect(sameAddress("", null)).toBe(true);
    });
    test("treats one absent address as unequal", () => {
        expect(sameAddress(RECIPIENT, null)).toBe(false);
        expect(sameAddress(null, RECIPIENT)).toBe(false);
    });
    test("does not throw on values that are not addresses", () => {
        expect(sameAddress("not-an-address", RECIPIENT)).toBe(false);
    });
 });
 describe("verifySignedTx", () => {
    test("accepts the approved transaction signed by the approved address", async () => {
        const raw = await signedFor(TX_PARAMS);
        const parsed = verifySignedTx(raw, TX_PARAMS, signer.address);
        expect(parsed.from).toBe(signer.address);
        expect(parsed.hash).toBe(Transaction.from(raw).hash);
    });
    test("accepts a contract creation with no recipient", async () => {
        const params = { to: undefined, value: "0x0", data: "0x600160005500" };
        const raw = await signedFor(params);
        expect(() => verifySignedTx(raw, params, signer.address)).not.toThrow();
    });
    test("accepts an absent value as zero", async () => {
        const approved = { to: RECIPIENT, data: "0x" };
        const raw = await signedFor(approved);
        expect(() =>
            verifySignedTx(raw, approved, signer.address),
        ).not.toThrow();
    });
    test("accepts call data whose case differs from the approval", async () => {
        const approved = { to: RECIPIENT, value: "0x0", data: "0xDEADBEEF" };
        const raw = await signedFor(approved);
        expect(() =>
            verifySignedTx(raw, approved, signer.address),
        ).not.toThrow();
    });
    test("rejects a swapped recipient", async () => {
        const raw = await signedFor({
            ...TX_PARAMS,
            to: OTHER_RECIPIENT,
        });
        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
            /approved recipient/,
        );
    });
    test("rejects an inflated value", async () => {
        const raw = await signedFor({
            ...TX_PARAMS,
            value: "0x4563918244f40000",
        });
        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
            /approved value/,
        );
    });
    test("rejects substituted call data", async () => {
        const raw = await signedFor({ ...TX_PARAMS, data: "0xc0ffee" });
        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
            /approved call data/,
        );
    });
    test("rejects a transaction signed by a different address", async () => {
        const raw = await signedFor(TX_PARAMS, other);
        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
            /different address/,
        );
    });
    test("rejects an unsigned transaction", () => {
        const unsigned = Transaction.from(txFor(TX_PARAMS)).unsignedSerialized;
        expect(() =>
            verifySignedTx(unsigned, TX_PARAMS, signer.address),
        ).toThrow(/no valid signature/);
    });
    test("rejects a missing or malformed payload", () => {
        expect(() =>
            verifySignedTx(undefined, TX_PARAMS, signer.address),
        ).toThrow(/missing or malformed/);
        expect(() => verifySignedTx("nope", TX_PARAMS, signer.address)).toThrow(
            /missing or malformed/,
        );
        expect(() =>
            verifySignedTx("0xc0ffee", TX_PARAMS, signer.address),
        ).toThrow(/could not be decoded/);
    });
    test("every rejection message is a full sentence", async () => {
        const raw = await signedFor({ ...TX_PARAMS, to: OTHER_RECIPIENT });
        try {
            verifySignedTx(raw, TX_PARAMS, signer.address);
            throw new Error("expected a rejection");
        } catch (e) {
            expect(e.message).toMatch(/^[A-Z].*\.$/);
        }
    });
 });
 const TYPED_DATA = JSON.stringify({
    domain: {
        name: "AutistMask Test",
        version: "1",
        chainId: 1,
        verifyingContract: OTHER_RECIPIENT,
    },
    primaryType: "Mail",
    types: {
        EIP712Domain: [
            { name: "name", type: "string" },
            { name: "version", type: "string" },
            { name: "chainId", type: "uint256" },
            { name: "verifyingContract", type: "address" },
        ],
        Mail: [
            { name: "from", type: "address" },
            { name: "to", type: "address" },
            { name: "contents", type: "string" },
        ],
    },
    message: {
        from: signer.address,
        to: RECIPIENT,
        contents: "hello",
    },
 });
 describe("verifySignature", () => {
    // "Hello AutistMask" as the hex string a dApp passes to personal_sign.
    const MESSAGE = "0x48656c6c6f204175746973744d61736b";
    const personalParams = {
        method: "personal_sign",
        message: MESSAGE,
        from: signer.address,
    };
    const typedParams = {
        method: "eth_signTypedData_v4",
        typedData: TYPED_DATA,
        from: signer.address,
    };
    async function signPersonal(withWallet) {
        return (withWallet || signer).signMessage(
            Buffer.from(MESSAGE.slice(2), "hex"),
        );
    }
    async function signTyped(withWallet) {
        const { domain, types, message } = JSON.parse(TYPED_DATA);
        delete types.EIP712Domain;
        return (withWallet || signer).signTypedData(domain, types, message);
    }
    test("accepts a personal_sign signature from the approved address", async () => {
        const signature = await signPersonal();
        expect(verifySignature(personalParams, signature, signer.address)).toBe(
            signer.address,
        );
    });
    test("accepts an eth_sign signature the same way", async () => {
        const signature = await signPersonal();
        const params = { ...personalParams, method: "eth_sign" };
        expect(() =>
            verifySignature(params, signature, signer.address),
        ).not.toThrow();
    });
    test("accepts a typed data signature from the approved address", async () => {
        const signature = await signTyped();
        expect(verifySignature(typedParams, signature, signer.address)).toBe(
            signer.address,
        );
    });
    test("does not mutate the approved typed data while verifying", async () => {
        const signature = await signTyped();
        const before = typedParams.typedData;
        verifySignature(typedParams, signature, signer.address);
        expect(typedParams.typedData).toBe(before);
        expect(
            JSON.parse(typedParams.typedData).types.EIP712Domain,
        ).toBeDefined();
    });
    test("rejects a personal_sign signature from a different address", async () => {
        const signature = await signPersonal(other);
        expect(() =>
            verifySignature(personalParams, signature, signer.address),
        ).toThrow(/different address/);
    });
    test("rejects a typed data signature from a different address", async () => {
        const signature = await signTyped(other);
        expect(() =>
            verifySignature(typedParams, signature, signer.address),
        ).toThrow(/different address/);
    });
    test("rejects a signature over a different message", async () => {
        const signature = await signer.signMessage(
            Buffer.from("00112233", "hex"),
        );
        expect(() =>
            verifySignature(personalParams, signature, signer.address),
        ).toThrow(/different address/);
    });
    test("rejects a missing or malformed signature", async () => {
        expect(() =>
            verifySignature(personalParams, undefined, signer.address),
        ).toThrow(/missing or malformed/);
        expect(() =>
            verifySignature(personalParams, "0x1234", signer.address),
        ).toThrow(/could not be verified/);
    });
 });
 // End-to-end over the messaging boundary, without a browser: run the exact
 // sequence the approval popup runs, then hand the artifact to the exact check
 // the background runs before it broadcasts or resolves. Only what the popup
 // puts on the wire is passed along, so this also pins down that the wire
 // payload is sufficient on its own.
 describe("popup signing sequence to background verification", () => {
    // Stand-in for the JSON-RPC provider. populateTransaction only needs the
    // nonce, the gas estimate, the network and the fee data.
    const fakeProvider = {
        getNetwork: async () => Network.from(1),
        getTransactionCount: async () => 7,
        estimateGas: async () => 21000n,
        getFeeData: async () => ({
            gasPrice: 2000000000n,
            maxFeePerGas: 2000000000n,
            maxPriorityFeePerGas: 1000000000n,
        }),
    };
    // A private-key wallet as it is persisted in state, so the test goes
    // through getSignerForAddress() the way the popup does.
    const walletData = { type: "privkey" };
    async function popupSignsTx(txParams) {
        const localSigner = getSignerForAddress(walletData, 0, SIGNER_KEY);
        const connected = localSigner.connect(fakeProvider);
        const populated = await connected.populateTransaction(txParams);
        delete populated.from;
        return connected.signTransaction(populated);
    }
    test("a populated, signed transaction is accepted and broadcastable", async () => {
        const rawSignedTx = await popupSignsTx(TX_PARAMS);
        const parsed = verifySignedTx(rawSignedTx, TX_PARAMS, signer.address);
        expect(parsed.nonce).toBe(7);
        expect(parsed.chainId).toBe(1n);
        expect(parsed.gasLimit).toBe(21000n);
        expect(parsed.to).toBe(RECIPIENT);
        expect(parsed.value).toBe(BigInt(TX_PARAMS.value));
        expect(parsed.data).toBe(TX_PARAMS.data);
        expect(parsed.signature).not.toBeNull();
    });
    test("the wire payload carries no password and no secret", async () => {
        const rawSignedTx = await popupSignsTx(TX_PARAMS);
        const payload = {
            type: "AUTISTMASK_TX_RESPONSE",
            id: "test-approval-id",
            approved: true,
            rawSignedTx,
        };
        expect(Object.keys(payload).sort()).toEqual([
            "approved",
            "id",
            "rawSignedTx",
            "type",
        ]);
        const wire = JSON.stringify(payload).toLowerCase();
        expect(wire).not.toContain("password");
        expect(wire).not.toContain(SIGNER_KEY.slice(2).toLowerCase());
    });
    test("the background rejects a transaction the popup did not approve", async () => {
        const rawSignedTx = await popupSignsTx({
            ...TX_PARAMS,
            to: OTHER_RECIPIENT,
        });
        expect(() =>
            verifySignedTx(rawSignedTx, TX_PARAMS, signer.address),
        ).toThrow(/approved recipient/);
    });
 });
--- a/tests/constants.test.js
+++ b/tests/constants.test.js
@@ -1,6 +1,4 @@
 const {
    DEBUG,
    BUILD_DEBUG_MARKER,
    ETHEREUM_MAINNET_CHAIN_ID,
    DEFAULT_RPC_URL,
    BIP44_ETH_PATH,
@@ -21,24 +19,6 @@ describe("constants", () => {
        expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
    });
    // This does not replace script/verify-build, which is the only thing that
    // can see the compiled DEBUG state of a real bundle. It pins the source
    // invariant that the marker tracks DEBUG, so the two cannot be edited
    // apart and leave verify-build asserting something that is no longer the
    // flag the code branches on.
    test("build debug marker is derived from DEBUG", () => {
        expect(BUILD_DEBUG_MARKER).toBe(
            DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
        );
    });
    // Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
    // must be the safe one.
    test("DEBUG is off when loaded outside a bundle", () => {
        expect(DEBUG).toBe(false);
        expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
    });
    test("exports ERC-20 ABI with expected functions", () => {
        expect(Array.isArray(ERC20_ABI)).toBe(true);
        expect(ERC20_ABI.length).toBeGreaterThan(0);
--- a/tests/e2e/harness.js
+++ b/tests/e2e/harness.js
@@ -1,304 +0,0 @@
 // End-to-end harness: launches a real Chromium with the unpacked MV3
 // build loaded, collects every uncaught page error and console.error, and
 // exposes the popup flows the tests drive.
 //
 // This runs inside the pinned Playwright container; see script/test-e2e.
 // It is deliberately NOT part of make check — REPO_POLICIES.md caps
 // make test at 20 seconds and a browser suite does not fit.
 "use strict";
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const { chromium } = require("playwright-core");
 const { installNetworkStubs } = require("./network");
 const REPO_ROOT = path.resolve(__dirname, "..", "..");
 const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
 // Page errors that are known, tracked, and deliberately tolerated. Every
 // entry must name the issue that will remove it. This list is the one
 // concession in an otherwise zero-tolerance policy: an uncaught error is
 // how this harness caught issue #150 in the first place.
 //
 // Empty, and worth keeping that way. Its only entry was the WASM
 // CompileError libsodium provoked on every popup load, deleted with #182
 // when both manifests started allowing WASM; the run that used to need it
 // is now the run that proves the fix.
 const ALLOWED_ERRORS = [];
 function isAllowed(text) {
    return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
 }
 // Collects every uncaught page error, console.error and unstubbed
 // request, and hands each one to exactly one reporter.
 //
 // This deliberately has NO window API. It used to expose mark()/since()
 // so a test could ask for "the errors since I started", and that shape
 // produced a green run that proved nothing twice over: first the mark
 // started after test 1, so everything recorded during launch was
 // discarded, then the tail after the final test was never read at all. In
 // both cases a record fell outside somebody's window and vanished, which
 // is the precise failure this harness exists to prevent.
 //
 // So there is no window left to fall outside of. take() is the only
 // reader and it always takes everything outstanding, so successive takes
 // partition the entire record stream with no gaps, and the runner turns
 // every record it reads into a failure.
 //
 // Observation ends when the browser context is closed. Nothing records
 // after that — the route handler and the console listeners are gone with
 // the context — so there is no post-teardown phase to collect, and this
 // class deliberately offers no mechanism pretending to cover one.
 class ErrorCollector {
    constructor() {
        this.entries = [];
        this.taken = 0;
    }
    record(kind, text) {
        const line = kind + ": " + String(text).split("\n")[0];
        if (isAllowed(line)) return;
        this.entries.push(line);
    }
    // Everything recorded since the previous take(). Never yields a
    // record twice and never skips one.
    take() {
        const out = this.entries.slice(this.taken);
        this.taken = this.entries.length;
        return out;
    }
 }
 function attachErrorListeners(ctx, errors) {
    const attachPage = (page) => {
        page.on("pageerror", (err) => {
            errors.record("pageerror", err.message || String(err));
        });
        page.on("console", (msg) => {
            if (msg.type() === "error") {
                errors.record("console.error", msg.text());
            }
        });
    };
    ctx.pages().forEach(attachPage);
    ctx.on("page", attachPage);
    // Per-page listeners only: the context-level "weberror" event covers
    // the same page exceptions and would double-report them. Playwright
    // exposes no error EVENT for service workers, so an uncaught
    // exception in the background worker is not visible here — everything
    // this suite drives lives in the popup page. That is an error-channel
    // gap only: worker NETWORK traffic is intercepted and reported like
    // any other, and assertWorkerTrafficIntercepted() below fails the run
    // if it ever stops being.
 }
 async function serviceWorker(ctx) {
    const [existing] = ctx.serviceWorkers();
    if (existing) return existing;
    return ctx.waitForEvent("serviceworker", { timeout: 30000 });
 }
 // How long to wait for the background worker's first outbound request.
 //
 // The margin that actually decides whether this check is sound is not
 // this timeout — it is whether the route handler is installed before the
 // worker fetches. Measured over several runs: route installation
 // completes 11-23ms after the context comes up, and the worker's
 // blocklist fetch arrives 525-883ms after that, so the route wins by
 // roughly 25-50x. This 30s figure is only slack for a loaded machine on
 // top of that; losing the race fails the run rather than passing it
 // quietly, which was verified by forcing a 3s delay before route
 // installation.
 const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
 // ctx.route() only sees service-worker requests when Playwright runs with
 // PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
 // sets. Without it the worker's traffic — notably the phishing blocklist
 // fetch src/background/index.js issues at startup — goes to the real
 // internet, and nothing says so, because src/shared/phishingDomains.js
 // swallows fetch failures. A harness whose isolation can lapse in silence
 // is worthless, so this does not take the flag on trust: the background
 // worker's own startup fetch has to show up in the route handler, or the
 // suite refuses to run.
 //
 // Deliberately NOT a synthetic probe fetched through worker.evaluate():
 // evaluating in an extension worker this early kills it (the call fails
 // with "Target page, context or browser has been closed" and the worker
 // disappears), which would break the very thing being measured. Observing
 // traffic the extension already generates costs nothing and cannot
 // perturb it.
 async function assertWorkerTrafficIntercepted(stubs) {
    const seen = await stubs.waitForServiceWorkerTraffic(
        WORKER_TRAFFIC_TIMEOUT_MS,
    );
    if (seen) return seen;
    // State the observation, not a conclusion. This fires for at least
    // two quite different causes and the harness cannot tell them apart
    // from here, so guessing one of them in the message sends the reader
    // the wrong way.
    throw new Error(
        "observed no service-worker request in the route handler within " +
            WORKER_TRAFFIC_TIMEOUT_MS +
            "ms. Under working interception the background worker's " +
            "startup blocklist fetch (src/background/index.js) reaches the " +
            "handler about half a second after the route is installed. " +
            "Two causes are plausible and this check cannot distinguish " +
            "them: (1) service-worker interception is not in effect, so " +
            "that traffic went to the real internet unobserved — the suite " +
            "must be run through script/test-e2e, which sets " +
            "PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
            "Playwright upgrade may have dropped or renamed that flag; " +
            "(2) no worker request was made in the first place — the route " +
            "lost the startup race, or the worker no longer fetches at " +
            "startup, in which case this check needs a new anchor because " +
            "there is no longer any worker traffic to observe. Either way " +
            "the fix is a replacement mechanism or an honest downgrade of " +
            "the isolation claims in tests/e2e/network.js and README.md — " +
            "not deleting this check",
    );
 }
 async function launch(routeOpts) {
    if (!fs.existsSync(path.join(EXT_PATH, "manifest.json"))) {
        throw new Error(
            "no unpacked build at " +
                EXT_PATH +
                " — run make build before the e2e suite",
        );
    }
    const userDir = fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-e2e-"));
    const ctx = await chromium.launchPersistentContext(userDir, {
        // channel: "chromium" is load-bearing. The default headless mode
        // uses the headless shell, which silently refuses to load
        // extensions: there is no error at all, the service worker simply
        // never appears. This cost real debugging time once already.
        channel: "chromium",
        headless: true,
        args: [
            "--disable-extensions-except=" + EXT_PATH,
            "--load-extension=" + EXT_PATH,
            // The container runs unprivileged; Chrome's sandbox needs
            // capabilities the harness deliberately does not grant it.
            "--no-sandbox",
            // Belt to the interception braces: nothing that slips past
            // the route handler can resolve a name, so a request that
            // escapes cannot actually reach the internet. Detection is
            // still assertWorkerTrafficIntercepted()'s job — this only
            // bounds the damage while a gap goes unnoticed. Playwright
            // fulfils routed requests without touching the resolver, and
            // it drives the browser over a pipe, so neither is affected.
            "--host-resolver-rules=MAP * ~NOTFOUND",
        ],
    });
    const cleanup = async () => {
        await ctx.close().catch(() => {});
        fs.rmSync(userDir, { recursive: true, force: true });
    };
    try {
        const errors = new ErrorCollector();
        attachErrorListeners(ctx, errors);
        routeOpts.report = (text) => errors.record("network", text);
        const stubs = await installNetworkStubs(ctx, routeOpts);
        await assertWorkerTrafficIntercepted(stubs);
        // The extension id is derived from the unpacked path, so it
        // changes and must never be hardcoded. It is the host part of the
        // service worker URL.
        const sw = await serviceWorker(ctx);
        const id = new URL(sw.url()).host;
        return {
            ctx,
            errors,
            extensionId: id,
            popupUrl: "chrome-extension://" + id + "/src/popup/index.html",
            close: cleanup,
        };
    } catch (e) {
        // Anything that fails after the browser is up has to tear it down
        // on the way out: an orphaned context keeps node alive forever,
        // turning a clean failure into a hung run.
        await cleanup();
        throw e;
    }
 }
 // ---------------------------------------------------------------- flows
 const PASSWORD = "e2e-harness-password";
 async function visible(page, selector, timeout = 15000) {
    await page.waitForSelector(selector, { state: "visible", timeout });
 }
 // An empty WebAssembly module: magic number and version header, no
 // sections. Compiling it in the popup asks the one question that decides
 // libsodium's backend — may this realm compile WebAssembly — of the real
 // page under the real shipped manifest, which is the only place the
 // answer can be observed. Kept independent of src/shared/vault.js on
 // purpose: a bundle asked to grade itself proves less than an outside
 // observation of the same realm.
 const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
 async function pageCompilesWasm(page) {
    return page.evaluate(async (bytes) => {
        try {
            await WebAssembly.compile(new Uint8Array(bytes));
            return true;
        } catch (_) {
            return false;
        }
    }, EMPTY_WASM_MODULE);
 }
 async function openPopup(ctx, popupUrl) {
    const page = await ctx.newPage();
    await page.goto(popupUrl);
    return page;
 }
 // Full wallet creation through the real UI: BIP-39 generation, libsodium
 // vault encryption and extension storage persistence, for real.
 async function createWallet(page) {
    await page.click("#btn-welcome-add");
    await visible(page, "#view-add-wallet");
    await page.click("#btn-generate-phrase");
    await page.waitForFunction(() => {
        const el = document.getElementById("wallet-mnemonic");
        return el && el.value.trim().split(/\s+/).length >= 12;
    });
    await page.fill("#add-wallet-password", PASSWORD);
    await page.fill("#add-wallet-password-confirm", PASSWORD);
    await page.click("#btn-add-wallet-confirm");
    await visible(page, "#view-main", 60000);
 }
 // Reach the address detail screen from wherever the popup restored to.
 // Clicking .address-row does not open it; the [info] button does.
 async function openAddressDetail(page) {
    const onAddress = await page.isVisible("#view-address");
    if (!onAddress) {
        await visible(page, "#view-main");
        await page.click("#wallet-list .btn-addr-info");
    }
    await visible(page, "#view-address");
 }
 module.exports = {
    createWallet,
    launch,
    openAddressDetail,
    openPopup,
    pageCompilesWasm,
    visible,
 };
--- a/tests/e2e/network.js
+++ b/tests/e2e/network.js
@@ -1,334 +0,0 @@
 // Browser-level network interception for the end-to-end suite.
 //
 // Every http(s) request the extension makes — from the popup page AND
 // from the MV3 background service worker — is fulfilled from these
 // fixtures, so the suite is deterministic and runs entirely offline. The
 // probe that motivated this harness (see issue #181) observed live calls
 // to Blockscout returning 401 inside the container, which would make any
 // assertion about rendered transaction data worthless.
 //
 // Service-worker coverage is not free: ctx.route() only sees worker
 // traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
 // the environment, which script/test-e2e does. Without it the phishing
 // blocklist fetch that src/background/index.js issues at worker startup
 // silently reaches raw.githubusercontent.com on the open internet, and
 // src/shared/phishingDomains.js swallows the failure so nothing surfaces
 // it. That is not left to trust: waitForServiceWorkerTraffic() below
 // backs the launch-time canary in harness.js, which fails the entire
 // suite if worker requests stop being visible here.
 //
 // Anything not explicitly stubbed here is aborted AND reported to the
 // error collector, so a newly added outbound call shows up as a test
 // failure rather than as intermittent flakiness.
 "use strict";
 // Fictional ERC-20 used to seed the transaction-detail test. The symbol
 // must not collide with any entry in src/shared/tokenList.js, or
 // isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
 // symbol-spoofing attempt; holders_count must be >= 1000 or the default
 // hideLowHolderTokens filter drops it. Either would make the test pass
 // vacuously by never rendering a row at all.
 const STUB_TOKEN = {
    address: "0xe2e0000000000000000000000000000000000e2e",
    symbol: "E2E",
    name: "End To End Test Token",
    decimals: "6",
    holders: "12345",
 };
 const STUB_COUNTERPARTY = "0xc0ffee0000000000000000000000000000c0ffee";
 const STUB_TX_HASH =
    "0xe2e0000000000000000000000000000000000000000000000000000000000e2e";
 const STUB_BLOCK_NUMBER = 21000000;
 // Fixed instant so timeAgo() output is stable across runs.
 const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
 // A 32-byte zero word. Returned for every eth_call, which is what makes
 // ethers' ENS reverse lookup resolve to "no resolver set" and return null
 // instead of throwing. A throw would be logged by src/shared/ens.js via
 // log.errorf(), i.e. console.error, which fails the run on its own.
 const ZERO_WORD = "0x" + "0".repeat(64);
 const RPC_RESULTS = {
    eth_chainId: "0x1",
    net_version: "1",
    eth_blockNumber: "0x1406f40",
    eth_getBalance: "0x0",
    eth_call: ZERO_WORD,
    eth_gasPrice: "0x3b9aca00",
    eth_estimateGas: "0x5208",
    eth_getTransactionCount: "0x0",
    eth_maxPriorityFeePerGas: "0x3b9aca00",
 };
 function tokenObject() {
    return {
        address_hash: STUB_TOKEN.address,
        address: STUB_TOKEN.address,
        symbol: STUB_TOKEN.symbol,
        name: STUB_TOKEN.name,
        decimals: STUB_TOKEN.decimals,
        holders_count: STUB_TOKEN.holders,
        type: "ERC-20",
    };
 }
 // One received ERC-20 transfer of 1.5 E2E to the address under test.
 function tokenTransferItems(address) {
    return [
        {
            transaction_hash: STUB_TX_HASH,
            block_number: STUB_BLOCK_NUMBER,
            timestamp: STUB_TX_TIMESTAMP,
            from: { hash: STUB_COUNTERPARTY },
            to: { hash: address },
            total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
            token: tokenObject(),
        },
    ];
 }
 // Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
 // decoder short-circuits; the on-chain detail fields still populate.
 function transactionDetails() {
    return {
        hash: STUB_TX_HASH,
        block_number: STUB_BLOCK_NUMBER,
        nonce: 7,
        gas_used: "51000",
        gas_price: "1000000000",
        fee: { value: "51000000000000" },
        raw_input: "0x",
        status: "ok",
    };
 }
 function jsonResponse(route, body) {
    return route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(body),
    });
 }
 // Extract the address from a Blockscout /addresses/<addr>/... path.
 function blockscoutAddress(pathname) {
    const m = pathname.match(/\/addresses\/(0x[0-9a-fA-F]{40})\//);
    return m ? m[1] : null;
 }
 function handleRpc(route, postData, report) {
    let payload;
    try {
        payload = JSON.parse(postData || "null");
    } catch {
        report("unstubbed RPC: unparseable body " + String(postData));
        return route.abort();
    }
    // ethers batches by default, so the body may be an array.
    const batch = Array.isArray(payload) ? payload : [payload];
    // Anything that is not a JSON-RPC object, or a batch of them, is not
    // RPC at all and must be reported like any other unrecognised
    // outbound traffic rather than dereferenced. request.postData()
    // returns null both for a bodyless POST and for a body Playwright
    // cannot decode as UTF-8 (sendBeacon with a Blob, or any binary
    // payload), so this is not an empty-string special case: it rejects
    // every non-object payload, exactly as the catch above rejects every
    // unparseable one.
    if (
        payload === null ||
        typeof payload !== "object" ||
        !batch.every((req) => req !== null && typeof req === "object")
    ) {
        report("unstubbed request: POST " + route.request().url());
        return route.abort();
    }
    const replies = batch.map((req) => {
        const result = RPC_RESULTS[req.method];
        if (result === undefined) {
            report("unstubbed RPC method: " + req.method);
            return {
                jsonrpc: "2.0",
                id: req.id,
                error: { code: -32601, message: "unstubbed in e2e harness" },
            };
        }
        return { jsonrpc: "2.0", id: req.id, result };
    });
    return jsonResponse(route, Array.isArray(payload) ? replies : replies[0]);
 }
 const TRACE_TRUE = ["1", "true", "yes", "on"];
 const TRACE_FALSE = ["", "0", "false", "no", "off"];
 // Whether E2E_TRACE_NETWORK asks for the request trace.
 //
 // A set-but-unrecognised value is a hard error rather than a quiet
 // "off": E2E_TRACE_NETWORK=true asking for a trace and getting silence
 // is the operator being lied to about what the harness is doing, which
 // is the whole failure mode this suite exists to eliminate. Refusing to
 // guess costs one line and one obvious error message.
 function traceEnabled(raw) {
    if (raw === undefined || raw === null) return false;
    const v = String(raw).trim().toLowerCase();
    if (TRACE_TRUE.includes(v)) return true;
    if (TRACE_FALSE.includes(v)) return false;
    throw new Error(
        "E2E_TRACE_NETWORK is set to " +
            JSON.stringify(String(raw)) +
            ", which is not a recognised on/off value. Use one of " +
            TRACE_TRUE.join(", ") +
            " to enable the request trace, or one of " +
            TRACE_FALSE.slice(1).join(", ") +
            " to disable it. Refusing to guess: a diagnostic that silently " +
            "does nothing is worse than one that is not there",
    );
 }
 /**
 * Route every http(s) request through local fixtures.
 *
 * @param {import("playwright-core").BrowserContext} ctx
 * @param {object} opts
 * @param {(text: string) => void} opts.report  called for unstubbed traffic
 * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
 *   transfer. Read at request time, so a test can flip it on the same
 *   options object without re-registering the route.
 * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
 *   Promise<string|null>}>}
 */
 async function installNetworkStubs(ctx, opts) {
    const report = opts.report;
    // First request seen that originated in a service worker, and the
    // resolver waiting for it. This is what proves worker interception is
    // actually in force; see waitForServiceWorkerTraffic below.
    let firstWorkerRequest = null;
    let announceWorkerRequest = null;
    // E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
    // tagged [sw] when it originated in the background service worker.
    // It exists so the isolation claim above can be re-checked by anyone
    // in one command, without editing files: the phishing blocklist fetch
    // showing up with an [sw] tag is the proof that the worker really is
    // intercepted and that the raw.githubusercontent.com stub below is
    // live code rather than decoration.
    const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
    // Regex rather than a glob so chrome-extension:// resource loads are
    // never touched — routing those would break the popup itself.
    await ctx.route(/^https?:\/\//, async (route) => {
        const req = route.request();
        const url = new URL(req.url());
        const p = url.pathname;
        const fromWorker = !!req.serviceWorker();
        if (fromWorker && !firstWorkerRequest) {
            firstWorkerRequest = req.method() + " " + req.url();
            if (announceWorkerRequest)
                announceWorkerRequest(firstWorkerRequest);
        }
        if (trace) {
            const origin = fromWorker ? "[sw] " : "[page] ";
            console.log("# routed " + origin + req.method() + " " + req.url());
        }
        // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
        if (req.method() === "POST") {
            return handleRpc(route, req.postData(), report);
        }
        // Blockscout v2
        if (p.includes("/api/v2/")) {
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
                return jsonResponse(route, { items: [] });
            }
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
                const addr = blockscoutAddress(p);
                return jsonResponse(route, {
                    items:
                        opts.seedTokenTransfer && addr
                            ? tokenTransferItems(addr)
                            : [],
                });
            }
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
                return jsonResponse(route, []);
            }
            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
                return jsonResponse(route, transactionDetails());
            }
        }
        // CoinDesk price tick
        if (url.hostname.endsWith("coindesk.com")) {
            return jsonResponse(route, { Data: {} });
        }
        // MetaMask phishing blocklist
        if (
            url.hostname === "raw.githubusercontent.com" ||
            p.endsWith("/eth-phishing-detect/main/src/config.json")
        ) {
            return jsonResponse(route, {
                version: 2,
                tolerance: 2,
                fuzzylist: [],
                whitelist: [],
                blacklist: [],
            });
        }
        // Best-effort Etherscan address labels: served as an empty page.
        if (url.hostname.endsWith("etherscan.io")) {
            return route.fulfill({
                status: 200,
                contentType: "text/html",
                body: "<html><body></body></html>",
            });
        }
        report("unstubbed request: " + req.method() + " " + req.url());
        return route.abort();
    });
    return {
        /**
         * Resolve with the first service-worker-originated request this
         * handler saw, or null if none arrives within `ms`.
         *
         * The background worker fetches the phishing blocklist at
         * startup, unconditionally, within about a second of the context
         * coming up — so under working interception this resolves almost
         * immediately. Nothing arriving means worker traffic is bypassing
         * the handler entirely and going to the real internet, which the
         * caller turns into a hard failure of the whole suite.
         */
        waitForServiceWorkerTraffic(ms) {
            if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
            return new Promise((resolve) => {
                const timer = setTimeout(() => {
                    announceWorkerRequest = null;
                    resolve(null);
                }, ms);
                announceWorkerRequest = (req) => {
                    clearTimeout(timer);
                    announceWorkerRequest = null;
                    resolve(req);
                };
            });
        },
    };
 }
 module.exports = {
    installNetworkStubs,
    STUB_TOKEN,
    STUB_TX_HASH,
 };
--- a/tests/e2e/run.js
+++ b/tests/e2e/run.js
@@ -1,286 +0,0 @@
 // End-to-end suite entrypoint. Run via script/test-e2e (which builds
 // dist/chrome/ and starts the pinned container); running it directly
 // requires a Chromium that playwright-core can find.
 //
 // A plain runner rather than jest on purpose: jest's default testMatch
 // would pull these files into script/test, and browser tests do not fit
 // inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
 // here is named *.test.js for the same reason.
 "use strict";
 const {
    createWallet,
    launch,
    openAddressDetail,
    openPopup,
    pageCompilesWasm,
    visible,
 } = require("./harness");
 const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
 const TEST_TIMEOUT_MS = 120000;
 // How long to keep collecting after the final test returns; see the
 // trailing drain in main().
 const TRAILING_WATCH_MS = 1500;
 const tests = [];
 function test(name, fn) {
    tests.push({ name, fn });
 }
 function assert(cond, message) {
    if (!cond) throw new Error(message);
 }
 function withTimeout(promise, name) {
    let timer;
    const timeout = new Promise((_, reject) => {
        timer = setTimeout(
            () =>
                reject(new Error("timed out after " + TEST_TIMEOUT_MS + "ms")),
            TEST_TIMEOUT_MS,
        );
    });
    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
 // ----------------------------------------------------------------- tests
 test("popup loads and reaches the welcome view", async (env) => {
    env.page = await openPopup(env.ctx, env.popupUrl);
    await visible(env.page, "#view-welcome");
    const title = await env.page.title();
    assert(title === "AutistMask", "unexpected popup title: " + title);
 });
 // The empirical half of #182. The manifest change is only a claim about
 // what the CSP permits; this is the observation. Two things have to hold
 // together, and the run covers both: the popup realm compiles WASM (here),
 // and no WASM refusal or abort is recorded anywhere in the run — the
 // harness allowlist that used to excuse exactly that error is now empty,
 // so a recurrence fails whichever test it lands in rather than being
 // tolerated. Since libsodium's WASM module is embedded in the bundle and
 // needs no fetch, a realm that compiles WASM is a realm where libsodium
 // takes the WASM path, and the next test drives a real vault encryption
 // through it.
 test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
    const ok = await pageCompilesWasm(env.page);
    assert(
        ok,
        "the popup refused to compile WebAssembly. The shipped manifest CSP " +
            "has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
            "fallback and every password derivation costs roughly 20x what it " +
            "should — see the backend note in src/shared/vault.js",
    );
 });
 test("wallet creation through the UI reaches the main view", async (env) => {
    await createWallet(env.page);
    const addrCount = await env.page
        .locator("#wallet-list .btn-addr-info")
        .count();
    assert(addrCount > 0, "no addresses rendered in the wallet list");
 });
 test("add token screen opens from address detail (#150)", async (env) => {
    await openAddressDetail(env.page);
    await env.page.click("#btn-add-token");
    await visible(env.page, "#view-add-token");
    const quickPicks = await env.page
        .locator("#common-token-list .common-token")
        .count();
    assert(quickPicks > 0, "no common-token quick-pick buttons rendered");
 });
 test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
    // Serve the stubbed token transfer from here on, then reload so the
    // address detail screen refetches its transaction list.
    env.routeOpts.seedTokenTransfer = true;
    await env.page.reload();
    await openAddressDetail(env.page);
    await visible(env.page, "#tx-list .tx-row");
    const rowText = await env.page
        .locator("#tx-list .tx-row")
        .first()
        .innerText();
    assert(
        rowText.includes(STUB_TOKEN.symbol),
        "token transfer row missing symbol " +
            STUB_TOKEN.symbol +
            ", got: " +
            JSON.stringify(rowText),
    );
    await env.page.locator("#tx-list .tx-row").first().click();
    await visible(env.page, "#view-transaction");
    const hash = await env.page.locator("#tx-detail-hash").innerText();
    assert(
        hash.includes(STUB_TX_HASH),
        "transaction detail shows the wrong hash: " + hash,
    );
    // The token contract row is the field that crashes when
    // addressDotHtml is not imported: it renders only for transfers with
    // a contractAddress, which is every ERC-20 transfer.
    await visible(env.page, "#tx-detail-token-contract-section");
    const contract = env.page.locator("#tx-detail-token-contract");
    const contractText = await contract.innerText();
    assert(
        contractText.toLowerCase().includes(STUB_TOKEN.address),
        "token contract row missing the contract address, got: " +
            JSON.stringify(contractText),
    );
    const dots = await contract.locator('span[style*="border-radius"]').count();
    assert(dots > 0, "token contract row rendered without its colour dot");
 });
 // ---------------------------------------------------------------- runner
 async function main() {
    // A suite that runs nothing must never report success. If a refactor
    // drops the registrations above, or a require() of this file stops
    // reaching them, the only honest outcome is a red run — reporting
    // "0/0 passed" and exiting 0 is the same vacuous-check failure this
    // whole harness exists to prevent.
    if (tests.length === 0) {
        console.log("1..0");
        console.log("# FAILED: the e2e suite registered no tests");
        process.exitCode = 1;
        return;
    }
    const routeOpts = { seedTokenTransfer: false };
    let session;
    try {
        session = await launch(routeOpts);
    } catch (e) {
        // Never skip and report success: a browser we cannot start, or
        // one whose network interception is not in force, is a failure of
        // the suite, not an absent one.
        console.error("e2e: cannot run the suite: " + e.message);
        process.exitCode = 1;
        return;
    }
    console.log("# extension id: " + session.extensionId);
    console.log("1.." + tests.length);
    const env = {
        ctx: session.ctx,
        popupUrl: session.popupUrl,
        routeOpts,
        page: null,
    };
    // Attribution of collected errors is total. session.errors has no
    // window API at all: take() always drains everything outstanding, so
    // successive takes partition the whole stream, and the phases below
    // cover the entire life of the run. Nothing the collector holds can
    // go unread.
    //
    //   launch .. end of test 1     -> test 1 (so the worker's startup
    //                                  fetches land on a test, not
    //                                  nowhere)
    //   end of test k .. end of k+1 -> test k+1
    //   last test .. teardown       -> the suite, via the trailing drain
    //
    // Those three phases cover the entire life of the browser context.
    // There is no fourth: once the context is closed nothing can record,
    // because the route handler and the console listeners died with it.
    // Traffic that a test defers past the trailing drain is therefore
    // never observed at all — a real limit of this design, stated in the
    // README, and not one any post-teardown hook could close.
    //
    // Two green-but-vacuous runs on this harness were the same shape: a
    // record falling outside somebody's window and being dropped. First
    // the mark started after test 1, discarding launch-time records;
    // then the tail after the last test was never read. Patching a
    // second boundary would have invited a third, so the window concept
    // is gone rather than fixed.
    let failed = 0;
    let n = 0;
    for (const t of tests) {
        n += 1;
        let failure = null;
        try {
            await withTimeout(t.fn(env), t.name);
        } catch (e) {
            failure = e.message;
        }
        // Any uncaught page error, console.error or unstubbed request
        // fails the test that provoked it, whether or not its assertions
        // passed. This is the mechanism that caught #150.
        const newErrors = session.errors.take();
        if (!failure && newErrors.length > 0) {
            failure = "uncaught browser errors during this test";
        }
        if (failure) {
            failed += 1;
            console.log("not ok " + n + " - " + t.name);
            console.log("  " + failure);
            for (const line of newErrors) {
                console.log("  " + line);
            }
        } else {
            console.log("ok " + n + " - " + t.name);
        }
    }
    // Keep watching after the last test returns, before tearing the
    // browser down. A request a test fires without awaiting is still in
    // flight when its function resolves; measured here it reaches the
    // route handler about 10ms later, but closing the context does not
    // wait for it — with no window at all the request dies unobserved
    // and the run goes green, which is exactly how escaping traffic
    // stays invisible.
    //
    // A fixed bounded window rather than a quiescence poll on purpose:
    // the collector being quiet is not evidence, because a request that
    // has not been dispatched yet has recorded nothing to be quiet
    // about. Playwright offers no "is anything in flight" question to
    // ask either — the route handler is the only observation point — so
    // a grace period is the mechanism available, and this one is ~150x
    // the measured latency for 1.5s on a ~25s suite.
    await new Promise((resolve) => setTimeout(resolve, TRAILING_WATCH_MS));
    await session.close();
    // The tail. These cannot be blamed on any single test, so they are
    // reported against the suite rather than guessed at — but they are
    // reported, and they fail the run.
    const trailing = session.errors.take();
    console.log(
        "# " + (tests.length - failed) + "/" + tests.length + " tests passed",
    );
    if (trailing.length > 0) {
        console.log(
            "# " +
                trailing.length +
                " browser error(s) recorded after the last test finished, " +
                "not attributable to any single test:",
        );
        for (const line of trailing) {
            console.log("#   " + line);
        }
    }
    if (failed > 0 || trailing.length > 0) {
        console.log("# FAILED");
        process.exitCode = 1;
    }
 }
 main().catch((e) => {
    console.error("e2e: " + (e && e.stack ? e.stack : e));
    process.exitCode = 1;
 });
--- a/tests/etherscanLabels.test.js
+++ b/tests/etherscanLabels.test.js
@@ -1,100 +0,0 @@
 const { parseEtherscanPage } = require("../src/shared/etherscanLabels");
 describe("etherscanLabels", () => {
    describe("parseEtherscanPage", () => {
        test("detects Fake_Phishing label in title", () => {
            const html = `<html><head><title>Fake_Phishing184810 | Address: 0x00000c07...3ea470000 | Etherscan</title></head><body></body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("Fake_Phishing184810");
            expect(result.isPhishing).toBe(true);
            expect(result.warning).toContain("Fake_Phishing184810");
            expect(result.warning).toContain("Phish/Hack");
        });
        test("detects Fake_Phishing with different number", () => {
            const html = `<html><head><title>Fake_Phishing5169 | Address: 0x3e0defb8...99a7a8a74 | Etherscan</title></head><body></body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("Fake_Phishing5169");
            expect(result.isPhishing).toBe(true);
        });
        test("detects Exploiter label", () => {
            const html = `<html><head><title>Exploiter 42 | Address: 0xabcdef...1234 | Etherscan</title></head><body></body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("Exploiter 42");
            expect(result.isPhishing).toBe(true);
        });
        test("detects scam warning in body text", () => {
            const html =
                `<html><head><title>Address: 0xabcdef...1234 | Etherscan</title></head>` +
                `<body>There are reports that this address was used in a Phishing scam.</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBeNull();
            expect(result.isPhishing).toBe(true);
            expect(result.warning).toContain("phishing/scam");
        });
        test("detects scam warning with label in body", () => {
            const html =
                `<html><head><title>SomeScammer | Address: 0xabcdef...1234 | Etherscan</title></head>` +
                `<body>There are reports that this address was used in a scam.</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("SomeScammer");
            expect(result.isPhishing).toBe(true);
            expect(result.warning).toContain("SomeScammer");
        });
        test("returns clean result for legitimate address", () => {
            const html = `<html><head><title>vitalik.eth | Address: 0xd8dA6BF2...37aA96045 | Etherscan</title></head><body>Overview</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("vitalik.eth");
            expect(result.isPhishing).toBe(false);
            expect(result.warning).toBeNull();
        });
        test("returns clean result for unlabeled address", () => {
            const html = `<html><head><title>Address: 0x1234567890...abcdef | Etherscan</title></head><body>Overview</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBeNull();
            expect(result.isPhishing).toBe(false);
            expect(result.warning).toBeNull();
        });
        test("handles exchange labels correctly (not phishing)", () => {
            const html = `<html><head><title>Coinbase 10 | Address: 0xa9d1e08c...b81d3e43 | Etherscan</title></head><body>Overview</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("Coinbase 10");
            expect(result.isPhishing).toBe(false);
        });
        test("handles contract names correctly (not phishing)", () => {
            const html = `<html><head><title>Beacon Deposit Contract | Address: 0x00000000...03d7705Fa | Etherscan</title></head><body>Overview</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBe("Beacon Deposit Contract");
            expect(result.isPhishing).toBe(false);
        });
        test("handles empty HTML gracefully", () => {
            const result = parseEtherscanPage("");
            expect(result.label).toBeNull();
            expect(result.isPhishing).toBe(false);
            expect(result.warning).toBeNull();
        });
        test("handles malformed title tag", () => {
            const html = `<html><head><title></title></head><body></body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.label).toBeNull();
            expect(result.isPhishing).toBe(false);
        });
        test("detects wallet drainer warning", () => {
            const html =
                `<html><head><title>Address: 0xabc...def | Etherscan</title></head>` +
                `<body>This is a known wallet drainer contract.</body></html>`;
            const result = parseEtherscanPage(html);
            expect(result.isPhishing).toBe(true);
        });
    });
 });
--- a/tests/manifest.test.js
+++ b/tests/manifest.test.js
@@ -1,100 +0,0 @@
 // The shipped Content Security Policy, pinned in both directions.
 //
 // This is the anti-regression check for #182. libsodium decides its
 // backend by trying to compile WebAssembly and catching the failure, so a
 // CSP that refuses WASM demotes the vault to the wasm2js translation —
 // roughly 20x slower per Argon2id derivation — and says so only in a
 // console message nobody reads. Dropping 'wasm-unsafe-eval' from either
 // manifest therefore has to fail a check, not a log line.
 //
 // It is equally a check against loosening. 'wasm-unsafe-eval' is granted
 // deliberately and narrowly (see the backend note in src/shared/vault.js);
 // 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
 // an exact match on the token set is what keeps the next edit from
 // smuggling one in alongside.
 //
 // build.js copies these files to dist/<target>/manifest.json verbatim, so
 // what is asserted here is what ships.
 const fs = require("fs");
 const path = require("path");
 const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
 const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
 const EXPECTED_OBJECT_SRC = ["'self'"];
 const FORBIDDEN_SOURCES = [
    "'unsafe-eval'",
    "'unsafe-inline'",
    "http:",
    "https:",
    "data:",
    "blob:",
    "*",
 ];
 function readManifest(name) {
    return JSON.parse(
        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
    );
 }
 // "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
 function parseCsp(policy) {
    const directives = {};
    for (const part of policy.split(";")) {
        const tokens = part.trim().split(/\s+/).filter(Boolean);
        if (tokens.length === 0) continue;
        directives[tokens[0]] = tokens.slice(1);
    }
    return directives;
 }
 function assertPolicy(policy) {
    const directives = parseCsp(policy);
    expect(Object.keys(directives).sort()).toEqual([
        "object-src",
        "script-src",
    ]);
    expect(directives["script-src"].slice().sort()).toEqual(
        EXPECTED_SCRIPT_SRC,
    );
    expect(directives["object-src"].slice().sort()).toEqual(
        EXPECTED_OBJECT_SRC,
    );
    for (const source of FORBIDDEN_SOURCES) {
        expect(directives["script-src"]).not.toContain(source);
        expect(directives["object-src"]).not.toContain(source);
    }
 }
 describe("shipped Content Security Policy", () => {
    // MV3 takes an object and applies extension_pages to the popup and the
    // background service worker, which is where libsodium runs.
    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
        const csp = readManifest("chrome").content_security_policy;
        expect(typeof csp).toBe("object");
        expect(Object.keys(csp)).toEqual(["extension_pages"]);
        assertPolicy(csp.extension_pages);
    });
    // MV2 takes the policy as a bare string, and Firefox 102 and later
    // require 'wasm-unsafe-eval' for extension pages exactly as Chrome
    // does. Same policy, different manifest shape.
    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
        const csp = readManifest("firefox").content_security_policy;
        expect(typeof csp).toBe("string");
        assertPolicy(csp);
    });
    // The two targets share one codebase and one crypto path; a policy
    // that drifts apart between them means one of the two builds is
    // running a backend nothing tests.
    test("both targets ship the same policy", () => {
        const chrome =
            readManifest("chrome").content_security_policy.extension_pages;
        const firefox = readManifest("firefox").content_security_policy;
        expect(firefox).toBe(chrome);
    });
 });
--- a/tests/phishingDomains.test.js
+++ b/tests/phishingDomains.test.js
@@ -1,205 +0,0 @@
 // Provide a localStorage mock for Node.js test environment.
 // Must be set before requiring the module since it calls loadDeltaFromStorage()
 // at module load time.
 const localStorageStore = {};
 global.localStorage = {
    getItem: (key) =>
        Object.prototype.hasOwnProperty.call(localStorageStore, key)
            ? localStorageStore[key]
            : null,
    setItem: (key, value) => {
        localStorageStore[key] = String(value);
    },
    removeItem: (key) => {
        delete localStorageStore[key];
    },
 };
 const {
    isPhishingDomain,
    loadConfig,
    getBlocklistSize,
    getDeltaSize,
    hostnameVariants,
    _reset,
    _getVendoredBlacklistSize,
    _getDeltaBlacklist,
 } = require("../src/shared/phishingDomains");
 // Reset delta state before each test to avoid cross-test contamination.
 // Note: vendored sets are immutable and always present.
 beforeEach(() => {
    _reset();
    // Clear localStorage mock between tests
    for (const key of Object.keys(localStorageStore)) {
        delete localStorageStore[key];
    }
 });
 describe("phishingDomains", () => {
    describe("vendored blocklist", () => {
        test("vendored blacklist is loaded from bundled JSON", () => {
            // The vendored blocklist should have a large number of entries
            expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
        });
        test("detects domains from vendored blacklist", () => {
            // These are well-known phishing domains in the vendored list
            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
            expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
        });
        test("getBlocklistSize includes vendored entries", () => {
            expect(getBlocklistSize()).toBeGreaterThan(100000);
        });
    });
    describe("hostnameVariants", () => {
        test("returns exact hostname plus parent domains", () => {
            const variants = hostnameVariants("sub.evil.com");
            expect(variants).toEqual(["sub.evil.com", "evil.com"]);
        });
        test("returns just the hostname for a bare domain", () => {
            const variants = hostnameVariants("example.com");
            expect(variants).toEqual(["example.com"]);
        });
        test("handles deep subdomain chains", () => {
            const variants = hostnameVariants("a.b.c.d.com");
            expect(variants).toEqual([
                "a.b.c.d.com",
                "b.c.d.com",
                "c.d.com",
                "d.com",
            ]);
        });
        test("lowercases hostnames", () => {
            const variants = hostnameVariants("Evil.COM");
            expect(variants).toEqual(["evil.com"]);
        });
    });
    describe("delta computation via loadConfig", () => {
        test("loadConfig computes delta of new entries not in vendored list", () => {
            loadConfig({
                blacklist: [
                    "brand-new-scam-site-xyz123.com",
                    "hopprotocol.pro", // already in vendored
                ],
            });
            // Only the new domain should be in the delta
            expect(
                _getDeltaBlacklist().has("brand-new-scam-site-xyz123.com"),
            ).toBe(true);
            expect(_getDeltaBlacklist().has("hopprotocol.pro")).toBe(false);
            expect(getDeltaSize()).toBe(1);
        });
        test("re-loading config replaces previous delta", () => {
            loadConfig({
                blacklist: ["first-scam-xyz.com"],
            });
            expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
            loadConfig({
                blacklist: ["second-scam-xyz.com"],
            });
            expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
            expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
        });
        test("getBlocklistSize includes both vendored and delta", () => {
            const baseSize = getBlocklistSize();
            loadConfig({
                blacklist: ["delta-only-scam-xyz.com"],
            });
            expect(getBlocklistSize()).toBe(baseSize + 1);
        });
    });
    describe("isPhishingDomain with delta + vendored", () => {
        test("detects domain from delta blacklist", () => {
            loadConfig({
                blacklist: ["fresh-scam-xyz.com"],
            });
            expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
        });
        test("detects domain from vendored blacklist", () => {
            // No delta loaded — vendored still works
            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
        });
        test("returns false for clean domains", () => {
            expect(isPhishingDomain("etherscan.io")).toBe(false);
            expect(isPhishingDomain("example.com")).toBe(false);
        });
        test("detects subdomain of blacklisted domain (vendored)", () => {
            expect(isPhishingDomain("app.hopprotocol.pro")).toBe(true);
        });
        test("detects subdomain of blacklisted domain (delta)", () => {
            loadConfig({
                blacklist: ["delta-phish-xyz.com"],
            });
            expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
        });
        test("case-insensitive matching", () => {
            loadConfig({
                blacklist: ["Delta-Scam-XYZ.COM"],
            });
            expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
            expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
        });
        test("returns false for empty/null hostname", () => {
            expect(isPhishingDomain("")).toBe(false);
            expect(isPhishingDomain(null)).toBe(false);
        });
        test("handles config with no blacklist key", () => {
            loadConfig({});
            expect(getDeltaSize()).toBe(0);
            // Vendored list still works
            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
        });
    });
    describe("localStorage persistence", () => {
        test("saveDeltaToStorage persists delta under 256KiB", () => {
            loadConfig({
                blacklist: ["persisted-scam-xyz.com"],
            });
            const stored = localStorage.getItem("phishing-delta");
            expect(stored).not.toBeNull();
            const data = JSON.parse(stored);
            expect(data.blacklist).toContain("persisted-scam-xyz.com");
        });
        test("delta is cleared on _reset", () => {
            loadConfig({
                blacklist: ["temp-scam-xyz.com"],
            });
            expect(getDeltaSize()).toBe(1);
            _reset();
            expect(getDeltaSize()).toBe(0);
        });
    });
    describe("real-world blocklist patterns", () => {
        test("detects known phishing domains from vendored list", () => {
            expect(isPhishingDomain("uniswap-trade.web.app")).toBe(true);
            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
            expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
        });
        test("does not flag legitimate domains", () => {
            expect(isPhishingDomain("opensea.io")).toBe(false);
            expect(isPhishingDomain("etherscan.io")).toBe(false);
        });
    });
 });
--- a/tests/transactions.test.js
+++ b/tests/transactions.test.js
--- a/tests/uniswap.test.js
+++ b/tests/uniswap.test.js
@@ -1,356 +0,0 @@
 const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
 const USDT_ADDR = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
 const WETH_ADDR = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2";
 const USDC_ADDR = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
 const USER_ADDR = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 // AutistMask's first-ever swap, 2026-02-27.
 // Swapped USDT for ETH via Uniswap V4 Universal Router.
 // https://etherscan.io/tx/0x6749f50c4e8f975b6d14780d5f539cf151d1594796ac49b7d6a5348ba0735e77
 const FIRST_SWAP_CALLDATA =
    "0x3593564c" +
    "000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a0" +
    "0000000000000000000000000000000000000000000000000000000069a1550f00000000000000000000000000000000000000000000000000000000000000020a10000000000000000000000000000000000000000000000000000000000000" +
    "0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000001c0" +
    "0000000000000000000000000000000000000000000000000000000000000160000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7000000000000000000000000ffffffffffffffffffffffffffffffffffffffff" +
    "0000000000000000000000000000000000000000000000000000000069c8daf6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066a9893cc07d91d95644aedd05d03f95e1dba8af" +
    "0000000000000000000000000000000000000000000000000000000069a154fe00000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000041" +
    "230249bb7133205db7b2389b587c723cc182302907b9545dc40c59c33ad1d53078a65732f4182fedbc0d9d85c51d580bdc93db3556fac38f18e140da47d0eb631c00000000000000000000000000000000000000000000000000000000000000" +
    "00000000000000000000000000000000000000000000000000000000000003c0000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000003" +
    "070b0e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000220" +
    "00000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7" +
    "0000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000007a1200000000000000000000000000000000000000000000000000000dcb050d338e7" +
    "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064" +
    "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0" +
    "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +
    "dac17f958d2ee523a2206206994597c13d831ec70000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +
    "66133e8ea0f5d1d612d2502a968757d1048c214a0000000000000000000000000000000000000000000000000000000000000000756e6978000000000012";
 const coder = AbiCoder.defaultAbiCoder();
 const routerIface = new Interface([
    "function execute(bytes commands, bytes[] inputs, uint256 deadline)",
 ]);
 // Helper: build a minimal execute() calldata from commands + inputs
 function buildExecute(commands, inputs, deadline) {
    return routerIface.encodeFunctionData("execute", [
        commands,
        inputs,
        deadline,
    ]);
 }
 // Helper: encode a PERMIT2_PERMIT input (command 0x0a)
 function encodePermit2(token, amount, spender) {
    return coder.encode(
        [
            "tuple(tuple(address,uint160,uint48,uint48),address,uint256)",
            "bytes",
        ],
        [[[token, amount, 0, 0], spender, 9999999999], "0x1234"],
    );
 }
 // Helper: encode a BALANCE_CHECK_ERC20 input (command 0x0e)
 function encodeBalanceCheck(owner, token, minBalance) {
    return coder.encode(
        ["address", "address", "uint256"],
        [owner, token, minBalance],
    );
 }
 // Helper: encode a WRAP_ETH input (command 0x0b)
 function encodeWrapEth(recipient, amount) {
    return coder.encode(["address", "uint256"], [recipient, amount]);
 }
 // Helper: encode a V2_SWAP_EXACT_IN input (command 0x08)
 function encodeV2SwapExactIn(recipient, amountIn, amountOutMin, pathAddrs) {
    return coder.encode(
        ["address", "uint256", "uint256", "address[]", "bool"],
        [recipient, amountIn, amountOutMin, pathAddrs, true],
    );
 }
 // Helper: encode a V3_SWAP_EXACT_IN input (command 0x00)
 function encodeV3SwapExactIn(recipient, amountIn, amountOutMin, pathTokens) {
    // V3 path: token(20) + fee(3) + token(20) ...
    let pathHex = pathTokens[0].slice(2).toLowerCase();
    for (let i = 1; i < pathTokens.length; i++) {
        pathHex += "000bb8"; // fee 3000 = 0x000bb8
        pathHex += pathTokens[i].slice(2).toLowerCase();
    }
    return coder.encode(
        ["address", "uint256", "uint256", "bytes", "bool"],
        [recipient, amountIn, amountOutMin, "0x" + pathHex, true],
    );
 }
 // Helper: encode a V4_SWAP input (command 0x10) — just a passthrough blob
 function encodeV4Swap(actions, params) {
    return coder.encode(["bytes", "bytes[]"], [actions, params]);
 }
 describe("uniswap decoder", () => {
    test("returns null for non-execute calldata", () => {
        expect(uniswap.decode("0x", ROUTER_ADDR)).toBeNull();
        expect(uniswap.decode("0xdeadbeef", ROUTER_ADDR)).toBeNull();
        expect(uniswap.decode(null, ROUTER_ADDR)).toBeNull();
    });
    test("decodes first-ever AutistMask swap (PERMIT2_PERMIT + V4_SWAP)", () => {
        const result = uniswap.decode(FIRST_SWAP_CALLDATA, ROUTER_ADDR);
        expect(result).not.toBeNull();
        expect(result.name).toBe("Swap USDT \u2192 ETH");
        expect(result.description).toContain("Uniswap");
        const labels = result.details.map((d) => d.label);
        expect(labels).toContain("Protocol");
        expect(labels).toContain("Token In");
        expect(labels).toContain("Steps");
        expect(labels).toContain("Deadline");
        const tokenIn = result.details.find((d) => d.label === "Token In");
        expect(tokenIn.value).toContain("USDT");
        expect(tokenIn.address.toLowerCase()).toBe(USDT_ADDR.toLowerCase());
        const steps = result.details.find((d) => d.label === "Steps");
        expect(steps.value).toContain("Permit2 Permit");
        expect(steps.value).toContain("V4 Swap");
    });
    test("decodes V2_SWAP_EXACT_IN with known tokens", () => {
        const data = buildExecute(
            "0x08", // V2_SWAP_EXACT_IN
            [
                encodeV2SwapExactIn(
                    USER_ADDR,
                    1000000n, // 1 USDT (6 decimals)
                    500000000000000n, // 0.0005 ETH
                    [USDT_ADDR, WETH_ADDR],
                ),
            ],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        expect(result.name).toBe("Swap USDT \u2192 WETH");
        const amount = result.details.find((d) => d.label === "Amount");
        expect(amount.value).toBe("1.0000 USDT");
        const minOut = result.details.find((d) => d.label === "Min. received");
        expect(minOut.value).toContain("WETH");
    });
    test("decodes V3_SWAP_EXACT_IN with known tokens", () => {
        const data = buildExecute(
            "0x00", // V3_SWAP_EXACT_IN
            [
                encodeV3SwapExactIn(
                    USER_ADDR,
                    2000000n, // 2 USDT
                    1000000000000000n, // 0.001 ETH
                    [USDT_ADDR, WETH_ADDR],
                ),
            ],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        expect(result.name).toBe("Swap USDT \u2192 WETH");
    });
    test("decodes WRAP_ETH as ETH input", () => {
        const data = buildExecute(
            "0x0b", // WRAP_ETH
            [encodeWrapEth(ROUTER_ADDR, 1000000000000000000n)],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        const tokenIn = result.details.find((d) => d.label === "Token In");
        expect(tokenIn.value).toBe("ETH (native)");
        const amount = result.details.find((d) => d.label === "Amount");
        expect(amount.value).toContain("1.0000");
        expect(amount.value).toContain("ETH");
    });
    test("decodes UNWRAP_WETH as ETH output", () => {
        const data = buildExecute(
            solidityPacked(["uint8", "uint8"], [0x08, 0x0c]),
            [
                encodeV2SwapExactIn(USER_ADDR, 1000000n, 500000000000000n, [
                    USDT_ADDR,
                    WETH_ADDR,
                ]),
                encodeWrapEth(USER_ADDR, 0n), // UNWRAP_WETH same encoding
            ],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        // UNWRAP_WETH means output is native ETH
        expect(result.name).toBe("Swap USDT \u2192 ETH");
    });
    test("decodes BALANCE_CHECK_ERC20 for min output", () => {
        const data = buildExecute(
            solidityPacked(["uint8", "uint8"], [0x0b, 0x0e]),
            [
                encodeWrapEth(ROUTER_ADDR, 1000000000000000000n),
                encodeBalanceCheck(USER_ADDR, USDT_ADDR, 2000000n),
            ],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        const minOut = result.details.find((d) => d.label === "Min. received");
        expect(minOut).toBeDefined();
        expect(minOut.value).toContain("2.0000");
        expect(minOut.value).toContain("USDT");
    });
    test("shows command names in steps", () => {
        const data = buildExecute(
            solidityPacked(["uint8", "uint8", "uint8"], [0x0a, 0x10, 0x0c]),
            [
                encodePermit2(USDT_ADDR, 1000000n, ROUTER_ADDR),
                encodeV4Swap("0x07", ["0x"]),
                encodeWrapEth(USER_ADDR, 0n), // reusing for UNWRAP_WETH
            ],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        const steps = result.details.find((d) => d.label === "Steps");
        expect(steps.value).toBe(
            "Permit2 Permit \u2192 V4 Swap \u2192 Unwrap WETH",
        );
    });
    test("formats permit amount when not unlimited", () => {
        const data = buildExecute(
            "0x0a",
            [encodePermit2(USDT_ADDR, 5000000n, ROUTER_ADDR)],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        const amount = result.details.find((d) => d.label === "Amount");
        expect(amount.value).toBe("5.0000 USDT");
    });
    // This test validates the decodeV4Swap() fix: a V4 ERC20→ERC20 swap
    // (USDT→USDC) where the token addresses are ONLY discoverable inside
    // the V4_SWAP sub-actions (SETTLE/TAKE). Before decodeV4Swap() was added,
    // command 0x10 was opaque and this would decode as "Uniswap Swap" with
    // no token info (or "ETH → ETH"). Now it correctly shows "USDT → USDC".
    test("decodes V4_SWAP ERC20→ERC20 tokens via SETTLE/TAKE (regression: #59)", () => {
        // Build a V4_SWAP input with SETTLE(USDT) + SWAP_EXACT_IN_SINGLE + TAKE(USDC)
        const V4_SETTLE = 0x0b;
        const V4_SWAP_EXACT_IN_SINGLE = 0x06;
        const V4_TAKE = 0x0e;
        // actions: SETTLE, SWAP_EXACT_IN_SINGLE, TAKE
        const actions = new Uint8Array([
            V4_SETTLE,
            V4_SWAP_EXACT_IN_SINGLE,
            V4_TAKE,
        ]);
        // SETTLE params: (address currency, uint256 maxAmount, bool payerIsUser)
        const settleParam = coder.encode(
            ["address", "uint256", "bool"],
            [USDT_ADDR, 5000000n, true],
        );
        // SWAP_EXACT_IN_SINGLE params:
        // (tuple(address,address,uint24,int24,address) poolKey, bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
        const swapParam = coder.encode(
            [
                "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
            ],
            [
                [
                    [
                        USDT_ADDR,
                        USDC_ADDR,
                        100, // fee
                        1, // tickSpacing
                        "0x0000000000000000000000000000000000000000", // hooks
                    ],
                    true, // zeroForOne
                    5000000n, // amountIn (5 USDT)
                    4900000n, // amountOutMin (4.9 USDC)
                    "0x", // hookData
                ],
            ],
        );
        // TAKE params: (address currency, address recipient, uint256 amount)
        const takeParam = coder.encode(
            ["address", "address", "uint256"],
            [USDC_ADDR, USER_ADDR, 0n],
        );
        // Encode the V4_SWAP input: (bytes actions, bytes[] params)
        const v4Input = coder.encode(
            ["bytes", "bytes[]"],
            [actions, [settleParam, swapParam, takeParam]],
        );
        // Build execute() with PERMIT2_PERMIT (0x0a) + V4_SWAP (0x10)
        // The permit provides the input token, but V4_SWAP must provide
        // the OUTPUT token — without decodeV4Swap, output would be unknown.
        const data = buildExecute(
            solidityPacked(["uint8", "uint8"], [0x0a, 0x10]),
            [encodePermit2(USDT_ADDR, 5000000n, ROUTER_ADDR), v4Input],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        // Before decodeV4Swap fix: name would be "Swap USDT → ETH" or "Uniswap Swap"
        // After fix: correctly identifies both tokens from V4 sub-actions
        expect(result.name).toBe("Swap USDT \u2192 USDC");
        const tokenIn = result.details.find((d) => d.label === "Token In");
        expect(tokenIn.value).toContain("USDT");
        const steps = result.details.find((d) => d.label === "Steps");
        expect(steps.value).toContain("V4 Swap");
    });
    test("handles unknown tokens gracefully", () => {
        const fakeToken = "0x1111111111111111111111111111111111111111";
        const data = buildExecute(
            "0x0a",
            [encodePermit2(fakeToken, 1000000000000000000n, ROUTER_ADDR)],
            9999999999n,
        );
        const result = uniswap.decode(data, ROUTER_ADDR);
        expect(result).not.toBeNull();
        expect(result.name).toBe("Uniswap Swap");
        const tokenIn = result.details.find((d) => d.label === "Token In");
        expect(tokenIn.value).toContain(fakeToken);
    });
 });
--- a/tests/vaultBackend.test.js
+++ b/tests/vaultBackend.test.js
@@ -1,52 +0,0 @@
 // The unit tests must exercise the libsodium backend that actually ships
 // (#182). Before this, they could not: node compiles WebAssembly happily,
 // the extension CSP refused it, and so the browser silently ran the
 // wasm2js translation while every test ran the WASM build.
 //
 // With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
 // hold that agreement in place from the node side. tests/manifest.test.js
 // holds up the CSP end of it, and the end-to-end suite observes the real
 // popup.
 const { cryptoBackend } = require("../src/shared/vault");
 // The module libsodium-wrappers-sumo itself requires and drives. Not a new
 // dependency: it is inspected here, never used to perform crypto, because
 // it is the only thing that can say which backend is loaded.
 const SODIUM_CORE = "libsodium-sumo";
 describe("libsodium backend", () => {
    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
        await expect(cryptoBackend()).resolves.toBe("wasm");
    });
    test("libsodium did not swap in the wasm2js fallback", async () => {
        const core = require(SODIUM_CORE);
        await require("libsodium-wrappers-sumo").ready;
        // useBackupModule is the entry point to the fallback; taking it
        // replaces the module's exports with the translation's, and the
        // entry point goes with them. Still present after ready means the
        // WASM module is the one in place. The test below is what keeps
        // that inference honest.
        expect(typeof core.useBackupModule).toBe("function");
    });
    // Deliberately last, and deliberately destructive: it takes the
    // fallback, which replaces the loaded module for the rest of this
    // file. Jest gives each test file its own module registry, so nothing
    // outside sees it.
    //
    // Without this, the check above would be a claim about libsodium's
    // internals with nothing holding it to account: if a future version
    // kept useBackupModule on the fallback module too, the marker would
    // quietly become true in both backends and the test would pass while
    // measuring nothing. Forcing the fallback and watching the marker
    // disappear is what makes its presence mean something.
    test("the fallback marker distinguishes the two backends", async () => {
        const core = require(SODIUM_CORE);
        await require("libsodium-wrappers-sumo").ready;
        expect(typeof core.useBackupModule).toBe("function");
        await core.useBackupModule();
        expect(typeof core.useBackupModule).toBe("undefined");
    });
 });
--- a/tests/wallet.test.js
+++ b/tests/wallet.test.js
@@ -1,94 +0,0 @@
 // Tests for the DEBUG build flag as it gates mnemonic generation.
 //
 // The modules read the __BUILD_DEBUG__ global that esbuild replaces at bundle
 // time. Under jest the global is absent, which is exactly the release-build
 // case; the debug-build case is exercised by defining the global and
 // re-requiring the modules with a fresh registry.
 const WORDS_IN_12_WORD_PHRASE = 12;
 function loadWallet() {
    const constants = require("../src/shared/constants");
    const wallet = require("../src/shared/wallet");
    const log = require("../src/shared/log");
    return { constants, wallet, log };
 }
 describe("generateMnemonic in a release build", () => {
    beforeEach(() => {
        jest.resetModules();
        delete globalThis.__BUILD_DEBUG__;
    });
    test("DEBUG defaults to false when the build define is absent", () => {
        const { constants } = loadWallet();
        expect(constants.DEBUG).toBe(false);
    });
    test("returns fresh, valid 12-word phrases that are not the test phrase", () => {
        const { constants, wallet } = loadWallet();
        const first = wallet.generateMnemonic();
        const second = wallet.generateMnemonic();
        expect(first).not.toBe(second);
        for (const phrase of [first, second]) {
            expect(wallet.isValidMnemonic(phrase)).toBe(true);
            expect(phrase.split(" ")).toHaveLength(WORDS_IN_12_WORD_PHRASE);
            expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
        }
    });
    test("derives a usable HD wallet from the generated phrase", () => {
        const { wallet } = loadWallet();
        const { xpub, firstAddress } = wallet.hdWalletFromMnemonic(
            wallet.generateMnemonic(),
        );
        expect(xpub.startsWith("xpub")).toBe(true);
        expect(firstAddress).toMatch(/^0x[0-9a-fA-F]{40}$/);
    });
    test("the runtime debug toggle cannot re-enable the test phrase", () => {
        const { constants, wallet, log } = loadWallet();
        // What the settings easter-egg toggle does at runtime.
        log.setRuntimeDebug(true);
        expect(log.isDebug()).toBe(true);
        const phrase = wallet.generateMnemonic();
        expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
        expect(wallet.isValidMnemonic(phrase)).toBe(true);
        expect(phrase).not.toBe(wallet.generateMnemonic());
        log.setRuntimeDebug(false);
    });
 });
 describe("generateMnemonic in a debug build", () => {
    beforeEach(() => {
        jest.resetModules();
        globalThis.__BUILD_DEBUG__ = true;
    });
    afterEach(() => {
        delete globalThis.__BUILD_DEBUG__;
    });
    test("DEBUG is true and the test phrase is returned", () => {
        const { constants, wallet } = loadWallet();
        expect(constants.DEBUG).toBe(true);
        expect(wallet.generateMnemonic()).toBe(constants.DEBUG_MNEMONIC);
    });
    test("the test phrase is itself a valid 12-word BIP-39 phrase", () => {
        const { constants, wallet } = loadWallet();
        expect(wallet.isValidMnemonic(constants.DEBUG_MNEMONIC)).toBe(true);
        expect(constants.DEBUG_MNEMONIC.split(" ")).toHaveLength(
            WORDS_IN_12_WORD_PHRASE,
        );
    });
 });
--- a/tests/walletDelete.test.js
+++ b/tests/walletDelete.test.js
@@ -1,129 +0,0 @@
 const {
    removeWalletFromState,
    broadcastActiveChanged,
 } = require("../src/shared/walletDelete");
 // Fixed addresses — never used for anything but these tests.
 const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
 const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
 const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
 function wallet(name, addresses) {
    return {
        name,
        addresses: addresses.map((address) => ({ address })),
    };
 }
 // A three-wallet state; wallet A is an HD wallet with two addresses.
 function makeState(overrides = {}) {
    return {
        hasWallet: true,
        wallets: [wallet("A", [A0, A1]), wallet("B", [B0]), wallet("C", [C0])],
        selectedWallet: 0,
        selectedAddress: 0,
        activeAddress: A0,
        allowedSites: {
            [A0]: ["a.example"],
            [A1]: ["b.example"],
            [B0]: ["c.example"],
        },
        deniedSites: { [A1]: ["d.example"], [C0]: ["e.example"] },
        ...overrides,
    };
 }
 describe("removeWalletFromState", () => {
    test("deleting the last wallet clears hasWallet", () => {
        const state = makeState({
            wallets: [wallet("A", [A0])],
            allowedSites: { [A0]: ["a.example"] },
            deniedSites: {},
        });
        const { activeAddressChanged } = removeWalletFromState(state, 0);
        expect(state.hasWallet).toBe(false);
        expect(state.wallets).toEqual([]);
        expect(state.selectedWallet).toBeNull();
        expect(state.selectedAddress).toBeNull();
        expect(state.activeAddress).toBeNull();
        expect(activeAddressChanged).toBe(true);
    });
    test("deleting a non-selected wallet leaves the selection intact", () => {
        const state = makeState({
            selectedWallet: 2,
            selectedAddress: 0,
            activeAddress: C0,
        });
        const { activeAddressChanged } = removeWalletFromState(state, 1);
        // Wallet C moved from index 2 to index 1 by the splice.
        expect(state.wallets.map((w) => w.name)).toEqual(["A", "C"]);
        expect(state.selectedWallet).toBe(1);
        expect(state.selectedAddress).toBe(0);
        expect(state.activeAddress).toBe(C0);
        expect(activeAddressChanged).toBe(false);
        expect(state.hasWallet).toBe(true);
    });
    test("deleting a wallet after the selection does not shift it", () => {
        const state = makeState({
            selectedWallet: 1,
            selectedAddress: 0,
            activeAddress: B0,
        });
        const { activeAddressChanged } = removeWalletFromState(state, 2);
        expect(state.selectedWallet).toBe(1);
        expect(state.activeAddress).toBe(B0);
        expect(activeAddressChanged).toBe(false);
    });
    test("deleting the active wallet falls back to the first remaining address", () => {
        const state = makeState({
            selectedWallet: 0,
            selectedAddress: 1,
            activeAddress: A1,
        });
        const { activeAddressChanged } = removeWalletFromState(state, 0);
        expect(state.wallets.map((w) => w.name)).toEqual(["B", "C"]);
        expect(state.selectedWallet).toBe(0);
        expect(state.selectedAddress).toBe(0);
        expect(state.activeAddress).toBe(B0);
        expect(activeAddressChanged).toBe(true);
        expect(state.hasWallet).toBe(true);
    });
    test("site permissions are dropped for every address of the wallet", () => {
        const state = makeState();
        removeWalletFromState(state, 0);
        expect(state.allowedSites).toEqual({ [B0]: ["c.example"] });
        expect(state.deniedSites).toEqual({ [C0]: ["e.example"] });
    });
 });
 describe("broadcastActiveChanged", () => {
    afterEach(() => {
        delete global.chrome;
    });
    test("sends AUTISTMASK_ACTIVE_CHANGED to the background", () => {
        const sendMessage = jest.fn();
        global.chrome = { runtime: { sendMessage } };
        broadcastActiveChanged();
        expect(sendMessage).toHaveBeenCalledWith({
            type: "AUTISTMASK_ACTIVE_CHANGED",
        });
    });
 });
--- a/yarn.lock
+++ b/yarn.lock