refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)

Every call site that touched `browser.*` or `chrome.*` now goes through
`src/shared/browserApi.js`, the only file in the tree that names either.
It exposes lazily-resolved namespace handles for events and synchronous
methods, and promise-returning wrappers for everything that is
callback-shaped on Chrome. Callers await; `runtime.lastError` is gone,
folded into the rejection the wrapper produces on the Chrome path.

`storageGet()` and `storageSet()` reject where `storage.local` is
absent. They carry the wallet: resolving `{}` would make an existing
wallet read back as no wallet, and a no-op write would discard the
user's state with nothing logged. The one caller that genuinely
degrades, `src/shared/phishingDomains.js`, takes `storageLocal()`
directly and keeps its own null check.

The Firefox suite gains the four dApp round trips the issue's definition
of done asks for — `eth_requestAccounts`, `personal_sign`,
`eth_sendTransaction`, and a closed approval window rejecting with
EIP-1193 4001 — driven through the real content script, background page
and approval windows. `--network none` was thought to rule that out
because it leaves no `http://` origin to inject into; loopback survives
it, so the page and a JSON-RPC node are served from 127.0.0.1 inside the
container and the run still reaches nothing but itself.

That harness refutes the premise it was built to verify. On Firefox
153.0.3, `browser.*` honours a trailing Chrome-style callback and does
populate `runtime.lastError`, both measured directly, and all four flows
pass against the unconverted code. So this is a uniformity and coverage
change, not a repair of a broken target; the PR records the measurement
in full, and the comments in `browserApi.js` and the Firefox suite say
that rather than the refuted claim.

An unhandled promise rejection fails a run on both harnesses, measured
by throwing past the first await of the unawaited `approval.show()`:
Firefox reports it from the console-service drain and Chrome as a
`pageerror`. README.md records the demonstration.

One real defect is fixed on the way past: the window id written back
into a pending approval after `windows.create()` was unguarded, so an
approval settled during the open — an address switch will do it —
dereferenced a deleted entry.

.gitea/workflows/e2e.yml

@@ -1,49 +0,0 @@
-name: e2e
-on: [push]
-
-# The browser end-to-end suites, one job per browser, deliberately kept out
-# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
-# script/cibuild is a plain `docker build .` whose Dockerfile runs
-# make check, so folding a browser suite into either would blow that cap
-# and slow the local fast path. Before this workflow every browser-level
-# guarantee in this repo held only when a human remembered to run it.
-#
-# One job per browser rather than two steps in one job, so a Chrome failure
-# does not hide the Firefox result.
-#
-# Each job is one script and nothing else. Both scripts need docker and
-# nothing else — they deliver the repo to the daemon as a build context and
-# build the extension inside the pinned image — which is what makes them
-# runnable here at all: the runner executes the job in a container against
-# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
-# by the host daemon and mounts an empty directory, and the runner image's
-# node is too old to install this repo's dependencies.
-#
-# These jobs REPORT, they do not gate. Whether a check blocks a merge is
-# Gitea branch protection, which this repo does not configure, so a failure
-# here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked on the measured
-# flake in the dApp signing wait -- two of six runs of unmutated code on a
-# loaded machine -- tracked as
-# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
-# random teaches people to merge past red.
-#
-# Nothing here may pass vacuously. There is no continue-on-error and no
-# `|| true`. Both scripts exit non-zero when docker is missing, when the
-# image build fails, and when the browser fails to start; the Chrome
-# harness aborts the suite outright if its network interception is not in
-# effect.
-jobs:
-    e2e-chrome:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e
-
-    e2e-firefox:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e-firefox

README.md

@@ -83,11 +83,10 @@ provide:
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
-- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
+- `script/test-e2e` — run the Chrome browser end-to-end suite (docker required;
-  only prerequisite: it builds a pinned image that carries the repo and a fresh
+  see [End-to-End Tests](#end-to-end-tests))
-  extension build, see [End-to-End Tests](#end-to-end-tests))
+- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (docker
-- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
+  required; builds its own pinned image, see
-  against an image with a pinned Firefox and geckodriver, see
   [End-to-End Tests](#end-to-end-tests))
 - `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
@@ -137,12 +136,11 @@ are outside `make check`.
 
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
-`mcr.microsoft.com/playwright` container (pinned by digest in
+`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
-`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
+docker is required and the suite fails loudly rather than skipping if it is
-required and the suite fails loudly rather than skipping if it is unavailable).
+unavailable). The suite lives in `tests/e2e/` and is driven by
-The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
+`playwright-core`, whose version must stay matched to the container's Playwright
-version must stay matched to the container's Playwright version — the browsers
+version — the browsers ship inside the image.
-ship inside the image.
 
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
@@ -255,13 +253,11 @@ runner rather than believed from the extension, and the stub node has to answer
 `eth_sendRawTransaction` with the hash `ethers` computes for the artifact it
 sent, or `provider.broadcastTransaction()` refuses the answer.
 
-Both suites build their own image, each with the repo and a fresh extension
+Unlike the Chrome suite it builds its own container image rather than pulling a
-build baked in; what differs is the base. The Chrome image layers those on top
+published one, because no published image carries both a pinned Firefox and a
-of a published Playwright image, whereas this one is assembled from a `node`
+matching geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external
-base, because no published image carries both a pinned Firefox and a matching
+artifacts by digest — the `node` base image, the Firefox 153.0.3 tarball, and
-geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external artifacts by
+geckodriver 0.36.0 — and the Firefox version in particular must not float:
-digest — the `node` base image, the Firefox 153.0.3 tarball, and geckodriver
-0.36.0 — and the Firefox version in particular must not float:
 `-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
 Without that flag, both navigating to `moz-extension://` and running
 chrome-context script fail with `unsupported operation`. The flag grants the
@@ -350,46 +346,9 @@ Two limits are worth knowing, both real differences from the Chrome suite:
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
-pick it up either. Run them locally before changing anything under
+pick it up either. Neither is wired into the Gitea workflow yet —
-`src/popup/views/`.
+docker-in-docker in CI is a separate question. Run them locally before changing
-
+anything under `src/popup/views/`.
-### In CI
-
-`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
-`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
-20-second `make test` cap and the local fast path are untouched. Each job is a
-checkout and the matching `script/` entrypoint, nothing else.
-
-Docker is the only thing either job needs from the runner, and that is not an
-accident. The runner executes a job inside a container against the **host's**
-docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
-host and mounts an empty directory, and the runner image's node is too old to
-install this repo's dependencies. Both suites therefore ship the repo to the
-daemon as a build context and build the extension inside the image, which works
-identically on a laptop.
-
-The jobs **report, they do not gate.** A failure is a red mark against the
-commit that a reviewer has to account for, not a hard block: whether a check
-blocks a merge is Gitea branch protection, which this repo does not configure.
-
-That is not only a statement about configuration. The Chrome suite is
-**measurably flaky under load** — two of six runs of unmutated code on a busy
-machine lost the approval popup out from under the dApp signing wait, always in
-the `#183` section, tracked as
-[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
-has to be read before it is believed, and that flake is the blocker to ever
-making this a required check. Do not answer it with a retry wrapper: a suite
-that reruns until it is green stops being evidence.
-
-Nothing in either job can pass vacuously. There is no `continue-on-error` and no
-`|| true`; both scripts exit non-zero when docker is missing, when the image
-build fails, and when the browser fails to start; the Chrome harness aborts the
-suite outright if its network interception is not in effect.
-
-Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
-the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
-once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
-Firefox and geckodriver downloads the same way.
 
 ## Rationale
 

TODO.md

@@ -33,8 +33,7 @@ The backlog lives on the
 authoritative; this file does not duplicate it. Full policy file set present.
 Real-browser end-to-end suites (`make test-e2e` for Chrome,
 `make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
-cannot see a runtime `ReferenceError` in a popup view, and
+cannot see a runtime `ReferenceError` in a popup view.
-`.gitea/workflows/e2e.yml` runs both of them on every push.
 
 # Next Step
 
@@ -46,19 +45,6 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-17: One wording for an empty password field on every screen that asks
-  for one. The private key export screen said "Password is required." where the
-  other five say "Please enter your password.", the same one-condition-two-
-  wordings split that [#172](https://git.eeqj.de/sneak/AutistMask/issues/172)
-  closed for a rejected password. Strings only, no behaviour change.
-  `tests/passwordMessages.test.js` now pins the empty-field guard per call site
-  as well as the decrypt handler, anchored on the `decryptWithPassword` sites so
-  the wallet-creation screen — where an empty field means a password being
-  chosen, a different condition — stays out of the set. Every error container
-  measured at a 360px viewport in the pinned Playwright container: the export
-  screen's container holds at 20px with the following section at the same offset
-  for the old string, the new string and the empty reserved state
-  ([#265](https://git.eeqj.de/sneak/AutistMask/issues/265)).
 - 2026-08-17: One shared extension-API module,
   [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
   the tree that names `browser` or `chrome`. Every call site returns a promise;
@@ -143,24 +129,6 @@ undefined identifiers, which is how
   on the real clipboard, read back after a sentinel write. Each of the four was
   demonstrated failing against a deliberately broken build
   ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
-- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
-  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
-  push, separate from `check`, so `make check` and its 20-second `make test` cap
-  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
-  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
-  gate, the dApp approval round trips — was enforced only when a human
-  remembered to run it by hand. The suites could not run on the runner as they
-  stood: the runner executes a job in a container against the host's docker
-  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
-  and the runner image's node cannot install this repo's dependencies. Both
-  suites now ship the repo to the daemon as a build context and build the
-  extension inside the pinned image, so docker is the only prerequisite on a
-  runner or a laptop, and both run the image by ID rather than by tag so
-  concurrent clones cannot swap it. The jobs report rather than gate — this repo
-  configures no branch protection, and the Chrome suite is measurably flaky
-  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
-  rather than papered over
-  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the
@@ -484,5 +452,9 @@ tracker.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
   input validation) before any 1.0rc tag. Individual filed issues are parts of
   it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` and
+  `make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
+  suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.

script/test-e2e

@@ -7,29 +7,17 @@
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
 # a used-but-not-imported identifier blow up at runtime.
-# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
-# from check so that cap and the local fast path both stay intact.
-#
-# Docker is the only prerequisite. The repo reaches the container as a
-# build context and the extension is built inside it (see
-# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
-# on the machine that starts the run. That is not a convenience: a bind
-# mount cannot work under Gitea Actions, and the runner image's node is too
-# old to install this repo's dependencies.
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-
+#
-IIDFILE=""
+# The playwright-core devDependency is pinned to the matching Playwright
-
+# version (1.56.0) and the two must be bumped together: the browsers ship
-cleanup() {
+# inside this image, and playwright-core looks for the exact browser
-    if [ -n "$IIDFILE" ]; then
+# revision its own version expects. A mismatch fails at launch.
-        rm -f "$IIDFILE"
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
-    fi
-}
 
 main() {
     cd "$ROOT"
@@ -39,23 +27,14 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
+    echo "Building extension for e2e..."
-    trap cleanup EXIT
+    yarn run build 2>&1
-    trap 'cleanup; exit 130' INT TERM
-
-    echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # HOME=/tmp: the image's root home is not a reliable place for the
+    # --user: keep files the suite touches owned by the caller, not root.
-    #   browser profile.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
     #   the MV3 background service worker — including the phishing
@@ -72,10 +51,13 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/run.js
 }
 

script/test-e2e-firefox

@@ -5,17 +5,12 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
+# and a browser suite does not fit.
-# on every push, in a job separate from check.
 #
-# Unlike script/test-e2e this builds its base image locally, because no
+# Unlike script/test-e2e this builds its image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
 # All three external artifacts are pinned by digest inside the Dockerfile;
-# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
+# see tests/e2e/firefox/Dockerfile.
-# the extension build are baked into the image rather than mounted.
-#
-# Docker is the only prerequisite: nothing here depends on the node, yarn
-# or make on the machine that starts the run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -23,14 +18,6 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
 
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -39,20 +26,16 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
+    echo "Building extension for e2e..."
-    trap cleanup EXIT
+    yarn run build 2>&1
-    trap 'cleanup; exit 130' INT TERM
 
-    echo "Building the pinned Firefox e2e image (extension included)..."
+    # The build context is tests/e2e/firefox/ and holds nothing but the
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
+    # Dockerfile: the harness itself arrives over the bind mount below, so
-        -f tests/e2e/firefox/Dockerfile .
+    # editing it never invalidates an image layer.
+    echo "Building the pinned Firefox e2e image..."
+    docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
 
     echo "Running the Firefox e2e suite..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
     # --network none: the suite stubs nothing, so this is what keeps the
     #   run offline and deterministic. The extension swallows its own
@@ -60,8 +43,8 @@ main() {
     #   network note in README.md. Weaker than the Chrome suite's
     #   fixture interception, and honestly so — it proves no request
     #   escaped, but it cannot report which ones were attempted.
-    # HOME=/tmp: the image's root home is not a reliable place for the
+    # --user: keep files the suite touches owned by the caller, not root.
-    #   browser profile.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     #
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
@@ -69,8 +52,11 @@ main() {
     docker run --rm \
         --shm-size=1g \
         --network none \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/firefox/run.js dist/firefox
 }
 

src/popup/views/exportPrivkey.js

@@ -112,7 +112,7 @@ function show(walletIdx, addrIdx) {
 async function reveal() {
     const password = $("export-privkey-password").value;
     if (!password) {
-        fail("Please enter your password.");
+        fail("Password is required.");
         return;
     }
     if (walletIndex === null) {

tests/e2e/Dockerfile

@@ -1,34 +0,0 @@
-# Chrome end-to-end image: the pinned Playwright image with this repo and a
-# freshly built extension inside it, built by script/test-e2e. The suite is
-# still started with `docker run`, so every runtime flag the harness needs
-# (--ipc=host in particular) applies as before.
-#
-# The repo is baked in rather than bind-mounted because a bind mount does
-# not resolve under Gitea Actions: the runner runs the job in a container
-# against the HOST's docker socket, so the source side of a -v is resolved
-# by the host daemon while the job's checkout lives on a docker volume that
-# is not a host path -- the mount silently succeeds and /work is empty. A
-# build context is streamed to the daemon and so works from anywhere.
-# Building the extension here too means the machine starting a run needs
-# docker and nothing else.
-
-# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-#
-# The playwright-core devDependency is pinned to the matching Playwright
-# version (1.56.0) and the two must be bumped together: the browsers ship
-# inside this image, and playwright-core looks for the exact browser
-# revision its own version expects. A mismatch fails at launch.
-FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
-
-WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build

tests/e2e/firefox/Dockerfile

@@ -1,24 +1,10 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
-# with this repo and a freshly built extension inside it, built by
+# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
-# script/test-e2e-firefox. The harness itself has no dependencies, so
+# harness itself has no dependencies, so nothing is installed for it.
-# nothing is installed for it.
 #
-# The build context is the repo root. The repo is baked in rather than
+# All three external artifacts are pinned by digest. The Firefox version in
-# bind-mounted because a bind mount does not resolve under Gitea Actions:
+# particular must not float: -remote-allow-system-access is mandatory on 153
-# the runner runs the job in a container against the HOST's docker socket,
+# and was not on 142, so the flag the harness passes is version-coupled.
-# so the source side of a -v is resolved by the host daemon while the job's
-# checkout lives on a docker volume that is not a host path -- the mount
-# silently succeeds and /work is empty. Baking the build in is also the
-# only way this suite can have both a built extension and the
-# `--network none` it runs under, since a container with no network cannot
-# install anything.
-#
-# All three external artifacts are pinned by digest, and are fetched in
-# layers above the repo copy, so editing the harness or any source file
-# re-runs only the two cheap layers at the bottom. The Firefox version in
-# particular must not float: -remote-allow-system-access is mandatory on
-# 153 and was not on 142, so the flag the harness passes is
-# version-coupled.
 
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
@@ -62,16 +48,4 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 
 WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build
-
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]

tests/passwordMessages.test.js

@@ -1,4 +1,4 @@
-// One wording for one condition (issues #172 and #265).
+// One wording for one condition (issue #172).
 //
 // Every screen that asks for the password decrypts the vault itself, and
 // each one used to write its own sentence for the same failure: the send
@@ -21,15 +21,6 @@
 // call site is read back to its own catch handler and the prose that
 // handler shows the user must be the canonical sentence and nothing else
 // — which fails on a novel wording, not only on a known-superseded one.
-//
-// The empty-password condition (#265) is pinned the same way and off the
-// same call sites: the private key export screen said "Password is
-// required." where the other five said "Please enter your password." Each
-// decrypt's password variable is walked back to the guard that rejects it
-// when blank, and the prose that guard shows must be the canonical
-// sentence. Anchoring on the decrypt keeps the wallet-creation screen out
-// of the set: an empty field there is a password being CHOSEN, a
-// different condition with its own wording.
 
 const fs = require("fs");
 const path = require("path");
@@ -37,7 +28,6 @@ const path = require("path");
 const SRC = path.join(__dirname, "..", "src");
 
 const CANONICAL = "That password is incorrect. Please try again.";
-const CANONICAL_EMPTY = "Please enter your password.";
 
 // Wordings this repo has actually shipped for the same condition. This is
 // a secondary, whole-file sweep for stragglers outside a decrypt handler;
@@ -46,7 +36,6 @@ const CANONICAL_EMPTY = "Please enter your password.";
 const SUPERSEDED = [
     "Wrong password.",
     "That password is not correct. Please try again.",
-    "Password is required.",
 ];
 
 function jsFilesUnder(dir) {
@@ -160,71 +149,6 @@ function handlerMessages(file, callOffset, label) {
         .filter((v) => v.includes(" "));
 }
 
-// The identifier a decrypt call passes as its password, which is what the
-// empty-field guard for that screen tests.
-function passwordArg(masked, callOffset, label) {
-    const open = callOffset + "decryptWithPassword".length;
-    const args = [];
-    let depth = 0;
-    let start = open + 1;
-    for (let i = open; i < masked.length; i++) {
-        const c = masked[i];
-        if (c === "(" || c === "[" || c === "{") depth += 1;
-        else if (c === ")" || c === "]" || c === "}") {
-            depth -= 1;
-            if (depth === 0) {
-                args.push(masked.slice(start, i));
-                break;
-            }
-        } else if (c === "," && depth === 1) {
-            args.push(masked.slice(start, i));
-            start = i + 1;
-        }
-    }
-    const arg = (args[1] ?? "").trim();
-    if (!/^[A-Za-z_$][\w$]*$/.test(arg))
-        throw new Error(`${label}: password argument is not a name: ${arg}`);
-    return arg;
-}
-
-// Innermost block enclosing the decrypt that also declares its password
-// variable — the handler the screen's submit button runs, which is where
-// the empty-field guard lives.
-function declaringBlock(masked, callOffset, ident, label) {
-    const declared = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*=`);
-    let at = callOffset;
-    for (;;) {
-        const open = enclosingBlockStart(masked, at);
-        if (open === -1) throw new Error(`${label}: nothing declares ${ident}`);
-        const end = blockEnd(masked, open);
-        if (declared.test(masked.slice(open, end))) return [open, end];
-        at = open - 1;
-    }
-}
-
-// The prose the empty-field guard puts in front of the user. Exactly one
-// guard per handler is required: two would mean the condition is answered
-// in more than one place and this would be pinning only one of them.
-function emptyGuardMessages(file, callOffset, label) {
-    const { masked, strings } = scan(fs.readFileSync(file, "utf8"));
-    const ident = passwordArg(masked, callOffset, label);
-    const [from, to] = declaringBlock(masked, callOffset, ident, label);
-    const guard = new RegExp(`if\\s*\\(\\s*!\\s*${ident}\\s*\\)\\s*\\{`, "g");
-    const opens = [];
-    let m;
-    while ((m = guard.exec(masked.slice(from, to))) !== null)
-        opens.push(from + m.index + m[0].length - 1);
-    if (opens.length !== 1)
-        throw new Error(
-            `${label}: expected one empty-${ident} guard, found ${opens.length}`,
-        );
-    const close = blockEnd(masked, opens[0]);
-    return strings
-        .filter((s) => s.offset >= opens[0] && s.offset < close)
-        .map((s) => s.value)
-        .filter((v) => v.includes(" "));
-}
-
 // The call sites are found, not listed: the file layout moves (the private
 // key export was in addressDetail.js when #172 was filed and is its own
 // view now), and a hardcoded list would quietly stop covering a screen it
@@ -263,9 +187,8 @@ describe("password failure messages", () => {
         });
     });
 
-    test("the canonical messages are full sentences", () => {
+    test("the canonical message is a full sentence", () => {
         expect(CANONICAL).toMatch(/^[A-Z][^]*\.$/);
-        expect(CANONICAL_EMPTY).toMatch(/^[A-Z][^]*\.$/);
     });
 
     // Exact equality, per call site: a message that is merely different
@@ -280,15 +203,6 @@ describe("password failure messages", () => {
         },
     );
 
-    test.each(sites.map((s) => [s.label, s]))(
-        "%s answers an empty password field with the canonical sentence",
-        (label, site) => {
-            expect(emptyGuardMessages(site.file, site.offset, label)).toEqual([
-                CANONICAL_EMPTY,
-            ]);
-        },
-    );
-
     test.each(files.map((f) => [path.relative(SRC, f), f]))(
         "%s carries no superseded wording",
         (_rel, file) => {