fix: the private key export screen opens again in the same session (closes #460)

show() found the address line through the element inside it, then
replaced the line's contents with renderAddressHtml(), which deleted
that element, so the next show() in the same popup session threw
before it navigated. The line now carries the export-privkey-address
id itself and is looked up by it. No other view that renders an
address finds its container through a child.

The jest DOM stub now takes an element out of the document when its
parent's contents are replaced, and a new test opens the screen
twice. The #253 e2e case no longer reopens the popup before its
second open.

Model: opus-5-5

.dockerignore

@@ -1,7 +1,77 @@
-# .git is deliberately NOT excluded: build.js shells out to `git rev-parse` for
-# build-info stamping and the Dockerfile runs `make build`, so excluding it
-# would make every built extension report commitHash "unknown".
-node_modules
-.DS_Store
-dist
-release
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
+.claude
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+**/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repo's host-built artifacts: make build writes dist/ and make package
+# writes release/. The image builds its own.
+/dist
+/release

.gitea/workflows/e2e.yml

@@ -2,11 +2,11 @@ name: e2e
 on: [push]
 
 # The browser end-to-end suites, one job per browser, deliberately kept out
-# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
-# script/cibuild is a plain `docker build .` whose Dockerfile runs
-# make check, so folding a browser suite into either would blow that cap
-# and slow the local fast path. Before this workflow every browser-level
-# guarantee in this repo held only when a human remembered to run it.
+# of the check workflow: REPO_POLICIES.md caps make test at 60 seconds and
+# script/cibuild runs script/check, so folding a browser suite into either
+# would blow that cap and slow the local fast path. Before this workflow
+# every browser-level guarantee in this repo held only when a human
+# remembered to run it.
 #
 # One job per browser rather than two steps in one job, so a Chrome failure
 # does not hide the Firefox result.
@@ -35,6 +35,10 @@ on: [push]
 jobs:
     e2e-chrome:
         runs-on: ubuntu-latest
+        # Bounds the image build, a cold cache included, and both Chrome
+        # programs, so a hung browser frees the shared runner. README.md
+        # "In CI" has the measured times.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -42,6 +46,10 @@ jobs:
 
     e2e-firefox:
         runs-on: ubuntu-latest
+        # Bounds the image build, a cold cache included, and both Firefox
+        # programs, so a hung browser frees the shared runner. README.md
+        # "In CI" has the measured times.
+        timeout-minutes: 15
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

.gitignore

@@ -11,14 +11,40 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
 # Node
 node_modules/
 
-# Environment / secrets
-.env
-.env.*
-*.pem
-*.key
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
 
 # Build output
 dist/

.prettierignore

@@ -1,5 +1,2 @@
 node_modules/
 yarn.lock
-dist/
-release/
-.claude/

Dockerfile

@@ -1,41 +1,80 @@
+# Lint phase: ESLint, prettier --check, and script/check-censored. The tools
+# are invoked directly rather than through `make lint` or `script/lint`, which
+# are themselves a docker build and would recurse into a daemon that does not
+# exist in a build step.
+#
 # node:22-slim (22.x LTS), 2026-02-24
-FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS lint
 
 WORKDIR /app
 
-# Marks "already inside the lint container" for script/lint, which otherwise
-# shells out to docker to build the lint stage below. Nothing outside this
-# image sets it.
-ENV AUTISTMASK_LINT_NATIVE=1
-
-# script/test's default 30s bound is the host figure. In here the same suite
-# starts on a cold jest cache and shares the runner with the rest of the build,
-# so 30s is too tight — it killed a healthy suite at 30.6s on a cold CI cache.
-# 180s still catches a hang in three minutes and cannot be tripped by a suite
-# that is merely running on contended hardware.
-ENV AUTISTMASK_TEST_TIMEOUT=180
-
-# script/bootstrap installs all prerequisites (make via apt here; node
-# is already in the base image, yarn comes via corepack) and runs
-# yarn install --frozen-lockfile. Dependency manifests are copied first
-# so the bootstrap layer is cached until they change.
 COPY script/ script/
 COPY package.json yarn.lock ./
 RUN script/bootstrap
 
 COPY . .
 
-# Lint stage — fail fast on static analysis and formatting, before the tests
-# and the build. This is also the stage script/lint builds from a host, which
-# is how linting stays on the pinned ESLint rather than the host's.
-FROM base AS lint
-RUN make lint
+RUN yarn run lint
+RUN script/check-censored
+
+# Test phase, same shape and for the same reason: the jest suite (its worker
+# cap is in package.json), rerun verbose on failure, then
+# script/test-verify-build.
+#
+# node:22-slim (22.x LTS), 2026-02-24
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS test
+
+WORKDIR /app
+
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN timeout 90 yarn run test || \
+    { echo "--- Rerunning with --verbose for details ---"; \
+      timeout 90 yarn run test:verbose; exit 1; }
+RUN script/test-verify-build
+
+# Development environment with the extension built, and the last stage: a
+# plain `docker build .` names no target and so builds this one. Nothing is
+# wanted from the two phases above; the copies are what make BuildKit build
+# them first, so this image cannot be produced unless lint and test passed. A
+# stage appended after this one would drop all three out of a plain build.
+#
+# node:22-slim (22.x LTS), 2026-02-24
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
+
+WORKDIR /app
 
-# Full check and build. The COPY --from is a no-op file copy whose only job is
-# to make BuildKit finish the lint stage before this one starts; without it the
-# stages run in parallel and a lint failure would not fail the build early.
-FROM base AS check
 COPY --from=lint /app/package.json /dev/null
+COPY --from=test /app/package.json /dev/null
 
-RUN make check
-RUN make build
+# script/bootstrap installs all prerequisites, git included. Manifests are
+# copied first so that layer stays cached until dependencies change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /app
+
+COPY . .
+
+# The VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context. With .git
+# present, a version that is still empty, dev or unknown fails the build: git
+# is missing or could not read the checkout, and build.js, which stamps the
+# extension with the commit it was built from, would stamp "unknown".
+ARG VERSION
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
+    fi; \
+    make build
+# A LABEL cannot run git, so it carries the build argument alone; a plain
+# `docker build .` leaves it empty.
+LABEL org.opencontainers.image.version="${VERSION}"

Makefile

@@ -107,6 +107,14 @@ vendor-blocklist:
 clean:
 	@rm -rf dist/ release/
 
+# Run the build make build runs, without the checks that follow it, then run it
+# again after every change to a file under src/, manifest/ or icons/, until
+# interrupted. A failed build is reported, may leave dist/ partly written, and
+# watching carries on. It writes no build receipt, so nothing can verify what it
+# leaves in dist/: anything handed on comes from make build. A release build
+# unless AUTISTMASK_DEBUG=1 is exported. A change anywhere else, package.json
+# and build.js included, starts no build, and a directory created while it runs
+# is not watched; restart it after either.
 dev:
 	@echo "Building in watch mode..."
 	@yarn run build --watch 2>&1

README.md

@@ -222,31 +222,32 @@ provide:
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run the test suite (jest)
+- `script/test` — build the Dockerfile's `test` phase, uncached: the jest suite,
+  stopped after 90 seconds and rerun verbose if it fails, then
+  `script/test-verify-build`
 - `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
   only prerequisite: it builds a pinned image that carries the repo and a fresh
   extension build, see [End-to-End Tests](#end-to-end-tests))
 - `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
   against an image with a pinned Firefox and geckodriver, see
   [End-to-End Tests](#end-to-end-tests))
-- `script/lint` — run ESLint (`eslint.config.js`) and then `prettier --check`,
-  failing on either. It never writes: `--fix` is not in this path, so
-  `make check` stays non-mutating. Linting runs in the container — the script
-  builds the Dockerfile's `lint` stage — because an ESLint result that depends
-  on whichever ESLint the host happens to have is not a result. Docker is
-  therefore required to lint; inside that image `AUTISTMASK_LINT_NATIVE=1` makes
-  the same script lint in place instead of recursing.
-- `script/fmt` — format all files (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run test, test-verify-build, check-censored, lint, and
-  fmt-check
+- `script/lint` — build the Dockerfile's `lint` phase, uncached: ESLint
+  (`eslint.config.js`), `prettier --check`, then `script/check-censored`,
+  failing on any of them. It never writes: `--fix` is not in this path, so
+  `make check` stays non-mutating. Linting runs only in the container, because
+  an ESLint result that depends on whichever ESLint the host happens to have is
+  not a result, so docker is required to lint.
+- `script/fmt` — format all files (writes), on the host
+- `script/fmt-check` — check formatting (read-only), on the host
+- `script/check` — run `script/test`, `script/lint` and `script/fmt-check`
 - `script/check-censored` — assert the competitor name RULES.md bars appears
   nowhere in the working tree or under `dist/` outside its documented
   exceptions: the pinned source reference in `script/vendor-blocklist`, the two
   provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
   on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
-  fails anywhere else. Part of `make check`, which inspects `dist/` when there
-  is one and says loudly when there is not; `make build` re-runs it with
+  fails anywhere else. Run by the `lint` phase, so part of `make check`; it
+  inspects `dist/` when there is one and says loudly when there is not, and the
+  build context of that phase never has one. `make build` re-runs it with
   `--require-dist`, so a build artifact is always covered
 - `script/package` — produce the release artifacts: `make build` first, so the
   archives can only ever be made from a `dist/` that has been verified against
@@ -281,14 +282,23 @@ provide:
   failing and a succeeding release build step, and read the `make build` and
   `make build-debug` recipes back out of `make -n` to check that they pass the
   mode as an argument on a scrubbed environment and wrap only the release path.
-  Part of `make check`; it reads no build artifacts and writes nothing under
-  `dist/`. The cases that depend on file permissions cannot mean anything for a
-  process that is not subject to them, so the harness proves its runner against
-  a mode-000 file before counting them, dropping to an unprivileged user when
-  run as root; if it cannot, it skips those cases and says so in a banner rather
-  than passing them.
-- `script/docker` — build the Docker image tagged via `script/projectname`
-- `script/cibuild` — CI entrypoint: plain `docker build .`
+  Run by the `test` phase, so part of `make check`; it reads no build artifacts
+  and writes nothing under `dist/`. The cases that depend on file permissions
+  cannot mean anything for a process that is not subject to them, so the harness
+  proves its runner against a mode-000 file before counting them, dropping to an
+  unprivileged user when run as root; if it cannot, it skips those cases and
+  says so in a banner rather than passing them.
+- `script/docker` — build the Docker image, uncached and tagged via
+  `script/projectname`: the `lint` and `test` phases, then `make build` in the
+  last stage. It passes what `git describe --tags --always --dirty` prints on
+  the host as the `VERSION` build argument, or `unknown` when that prints
+  nothing, and the last stage fails on `unknown` whenever the build context
+  carries `.git`. Only a build given no `VERSION` at all, such as a plain
+  `docker build .`, runs `git describe` on the `.git` in the build context,
+  which `.dockerignore` sends without its `config`, and fails if git cannot read
+  it
+- `script/cibuild` — CI entrypoint: `script/bootstrap`, `script/check`, then the
+  same image build as `script/docker`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 
@@ -306,7 +316,15 @@ The Makefile shims to those. It also carries a few targets that have no
   debug build, and keeping its `dist/` on failure (see
   [Debug Builds](#debug-builds))
 - `make clean` — remove `dist/` and `release/`
-- `make dev` — build in watch mode
+- `make dev` — run the build `make build` runs, without the checks that follow
+  it, then run it again after every change to a file under `src/`, `manifest/`
+  or `icons/`, until interrupted. A failed build is reported, may leave `dist/`
+  partly written, and watching carries on. It writes no build receipt, so
+  nothing can verify what it leaves in `dist/` (see
+  [Build Receipts](#build-receipts)): anything handed on comes from
+  `make build`. A release build unless `AUTISTMASK_DEBUG=1` is exported. A
+  change anywhere else, `package.json` and `build.js` included, starts no build,
+  and a directory created while it runs is not watched; restart it after either
 
 ## End-to-End Tests
 
@@ -376,6 +394,12 @@ reserve while sitting on the same side of the estimate, so swapping the two in
 what [#154](https://git.eeqj.de/sneak/AutistMask/issues/154) was, and it was
 previously correct by reading only.
 
+It also covers both ways the wait for a sent transaction's receipt ends on the
+error screen: lookups that still find no receipt 60 seconds after the broadcast,
+and six lookups in a row that fail. Each must show its own message, and Done
+must lead back to the address screen. Both wait in real time, about a minute
+each.
+
 It also covers the **dApp approval round trips** — the one place where the
 content script, the inpage provider, the background worker and the approval
 popup all have to work together. A local test page is served by the route
@@ -603,7 +627,7 @@ Two limits are worth knowing, both real differences from the Chrome suite:
   out, but it cannot report which requests were attempted.
 
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
-`make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
+`make test`. `REPO_POLICIES.md` caps `make test` at 60 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
 pick it up either. Run them locally before changing anything under
 `src/popup/views/`.
@@ -612,7 +636,7 @@ pick it up either. Run them locally before changing anything under
 
 `.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
 `e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
-20-second `make test` cap and the local fast path are untouched. Each job is a
+60-second `make test` cap and the local fast path are untouched. Each job is a
 checkout and the matching `script/` entrypoint, nothing else.
 
 Docker is the only thing either job needs from the runner, and that is not an
@@ -637,10 +661,22 @@ Nothing in either job can pass vacuously. There is no `continue-on-error` and no
 build fails, and when the browser fails to start; the Chrome harness aborts the
 suite outright if its network interception is not in effect.
 
-Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
-the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
-once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
-Firefox and geckodriver downloads the same way.
+Measured on this repo's runner in the green runs of early October 2026, from a
+warm docker cache to a cold one: `e2e-chrome` 1m44s to 4m48s, and `e2e-firefox`
+31s to 4m07s. A cold cache adds three to four minutes to each job, spent
+rebuilding its image: reinstalling dependencies and, for `e2e-firefox`,
+installing Firefox, geckodriver and their system libraries. Both scripts now
+build their image with `--no-cache`, so every run pays the cold figure. Those
+`e2e-chrome` runs predate the cases that wait in real time for a receipt to end
+in error. `make test-e2e` took 3m51s locally with its image cached, so with the
+image rebuilt every run, an `e2e-chrome` run comes to about seven minutes.
+
+Each e2e job has a `timeout-minutes` cap, so a hung build or browser ends the
+job instead of holding the shared runner: `e2e-firefox` 15 minutes and
+`e2e-chrome` 20, each over two and a half times the job's slowest cold run. A
+job that reaches its cap has hung; read it as a hang, not as a slow run to
+retry. The `check` job has no cap: `.gitea/workflows/check.yml` is the canonical
+copy from `sneak/prompts`, kept byte-identical.
 
 ### Element id guard (part of `make check`)
 
@@ -806,13 +842,15 @@ discoverable.
   on critical screens and when space is available to allow users to disambiguate
   addresses visually, as a security feature.
 - **Tailwind CSS**: Utility-first CSS via Tailwind. No custom CSS classes for
-  styling. Tailwind is configured with a minimal monochrome palette. This keeps
-  the styling co-located with the markup and eliminates CSS file management. The
-  handful of classes in `styles/main.css` are not styling: `.copy-flash-*`
-  carries the copy feedback animation, and `.am-address` carries the rule that
-  an address never wraps. Both are invariants that hold in every place they
-  appear, and spelling either out as repeated utilities is how one of those
-  places drifts away from the rest.
+  styling, and no `style="..."` attributes, which the
+  [Content Security Policy](#content-security-policy) refuses. Tailwind is
+  configured with a minimal monochrome palette. This keeps the styling
+  co-located with the markup and eliminates CSS file management. The handful of
+  classes in `styles/main.css` are not styling: `.copy-flash-*` carries the copy
+  feedback animation, and `.am-address` carries the rule that an address never
+  wraps. Both are invariants that hold in every place they appear, and spelling
+  either out as repeated utilities is how one of those places drifts away from
+  the rest.
 - **Vanilla JS**: No framework (React, Vue, Svelte, etc.). The popup UI is small
   enough that vanilla JS with simple view switching is sufficient. A framework
   would add bundle size, build complexity, and attack surface for no benefit at
@@ -2180,8 +2218,8 @@ Dev dependencies (not shipped in extension):
 | Package            | Version | License | Purpose                   |
 | ------------------ | ------- | ------- | ------------------------- |
 | `esbuild`          | 0.27.3  | MIT     | JS bundler (inlines deps) |
-| `tailwindcss`      | 4.2.1   | MIT     | CSS compilation           |
-| `@tailwindcss/cli` | 4.2.1   | MIT     | Tailwind CLI              |
+| `tailwindcss`      | 4.3.1   | MIT     | CSS compilation           |
+| `@tailwindcss/cli` | 4.3.1   | MIT     | Tailwind CLI              |
 | `jest`             | 30.2.0  | MIT     | Test runner               |
 | `prettier`         | 3.8.1   | MIT     | Code formatter            |
 
@@ -2205,7 +2243,7 @@ a bare string in `manifest/firefox.json` (MV2):
 
 ```
 default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
-style-src 'self' 'unsafe-inline'; img-src 'self' data:;
+style-src 'self'; img-src 'self' data:;
 connect-src 'self' https: http:; frame-src 'none'; form-action 'none';
 base-uri 'none'
 ```
@@ -2217,15 +2255,17 @@ wallet's own UI. Escaping is the primary fix for that (see
 `src/shared/html.js`); this is the second line, so an escape that does slip
 cannot reach the network.
 
-Four directives are looser than `'self'`, each for a reason that does not
+`style-src 'self'` admits the stylesheet and nothing inline: both browsers
+refuse a `style="..."` attribute and a `<style>` block. So the popup's markup,
+in `src/popup/index.html` and in the HTML the view helpers build, carries
+Tailwind classes and never a `style` attribute. Script that sets `element.style`
+is not affected; that is how the views show and hide their error lines. An
+inline style that slips in anyway is refused with a console error, which fails
+both end-to-end suites.
+
+These directives differ from a plain `'self'`, each for a reason that does not
 generalise:
 
-- `style-src 'unsafe-inline'` — `src/popup/index.html` and the view helpers set
-  presentation through `style="..."` attributes, which CSP blocks without this.
-  Chrome enforces `style-src` on attributes, not only on `<style>` blocks, and
-  Firefox has never implemented `style-src-attr`, so there is no narrower
-  spelling that works on both targets. It permits inline **style**; script stays
-  under `script-src`, which does not allow `'unsafe-inline'`.
 - `img-src data:` — identicons are generated in the popup by
   `ethereum-blockies-base64` and assigned to `img.src` as `data:` PNGs.
 - `connect-src https: http:` — the RPC endpoint is user-configurable and a local

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-10-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,17 +60,28 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  pristine checkout with nothing installed the run dies there, after the
+  containerised gates have passed. **The bootstrap alone is not enough**:
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  source nvm for the pinned node version before invoking it, exactly as
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  docker and git then gets through `script/check`. Four further scripts are our
+  own extensions to the standard: `script/check` runs `script/test`,
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/projectname` (literally that filename) simply outputs the project's
+  name. Scripts that need the name call `script/projectname` — e.g.
+  `script/docker` assembles its image tag from it — so those scripts stay
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -89,87 +100,198 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+  `lint` phase and a `test` phase, with the final stage depending on both so the
+  image cannot be built unless they pass. For non-server repos the final stage
+  brings up a development environment; for server repos it is the runtime image.
+  The gate phases and the build stage start from their pinned base images and
+  install what those images lack either inline, as the canonical Go `Dockerfile`
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  repo's own `Dockerfile` does for its yarn packages. The development
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **Every `docker build` in `script/` is tagged**, here and in
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    image behind on every invocation, on every developer host and every CI
+    runner; a tagged one replaces the previous image.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own cache, its own `TMPDIR` and
+    a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
+  a `COPY` layer only when the copied content changes, so on an unchanged tree
+  the check `RUN` is served from cache, nothing executes, and the build still
+  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
+  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
+  four, and there is no fifth — `script/check` runs the two gate phases and
+  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
+  not evidence that anything ran: a sub-second build reporting success is a
+  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
+  and friends destroy a build cache shared with every other build on the host.
+  When a check is added or changed, prove it works by planting a defect it must
+  catch and watching the run fail on it, then revert the defect. A green run
+  alone shows neither that the check ran nor that it covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
-    RUN make lint
+    RUN golangci-lint run --config .golangci.yml ./...
 
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # image ships and the alpine one does not.
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
     WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
+    RUN go test -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 90s -race -v ./...; exit 1; }
 
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
+    # Build stage. Nothing is wanted from either phase above; the copies
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    COPY --from=lint /src/go.sum /dev/null
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
 
-    # Runtime stage
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
+
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+      both Go and the linter), so nothing needs installing.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+      and a stage nothing depends on is not built at all, so without these two
+      lines a red gate would not fail the build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+    - If the project requires CGO or system libraries for linting, install them
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  That script bootstraps, runs the gate phases, and then builds the image, so a
+  successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build is uncached and so runs the gate phases a second time. That is the
+  price of the rule above, and it is worth paying: the image that ships is built
+  from a run of its own gates rather than from a cache entry. A separate
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  checked by review: to try a change to it, add the feature branch to that list
+  and push, then remove the branch from the list again before merging. Keep any
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -189,14 +311,21 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
+- **The test command should use the conditional verbose rerun pattern.** Run
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  on success (just package/suite summaries) while providing full diagnostic
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -209,11 +338,26 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. That matters on a developer's machine, where this
+    target runs and the directory lasts from one run to the next. The `test`
+    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
+    result for this repo's tests and nothing before its `go test` step runs a
+    test, so there is nothing to replay. `--no-cache` (above) is what makes that
+    step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -239,10 +383,84 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  setting up a new repo. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$(script/projectname)" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -258,9 +476,56 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+  _NEVER_ be modified by an agent: fetch it from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -374,12 +639,14 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  and language-specific config). Everything else goes in a subdirectory.
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -406,3 +673,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

TODO.md

@@ -45,6 +45,136 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-06: The private key export screen opens again in the same popup
+  session ([#460](https://git.eeqj.de/sneak/AutistMask/issues/460)). `show()`
+  found the address line through the element inside it, which its own rendering
+  replaced, so the second open threw before it navigated. The line now carries
+  the `export-privkey-address` id itself. `tests/exportPrivkey.test.js` opens
+  the screen twice, its DOM stub now takes an element out of the document when
+  its parent's contents are replaced, and the `#253` e2e case no longer reopens
+  the popup before its second open.
+
+- 2026-10-06: The canonical files are re-vendored from `sneak/prompts` at
+  `dd4027b` ([#472](https://git.eeqj.de/sneak/AutistMask/issues/472)). The
+  `Dockerfile` has separate `lint` and `test` phases, and its last stage depends
+  on both before it runs `make build`. `script/lint` and `script/test` each
+  build one phase, uncached. `script/check-censored` runs in the `lint` phase
+  and `script/test-verify-build` in the `test` phase. `script/check` runs the
+  two phases and `script/fmt-check`. `script/cibuild` bootstraps, runs
+  `script/check`, then builds the image uncached. Given no `VERSION` build
+  argument, as in a plain `docker build .`, the image build takes one from
+  `git describe` on the `.git` in the build context, which `.dockerignore` now
+  sends without its `config`. The vendored `check.yml` has no `timeout-minutes`,
+  so the `check` job's cap is gone.
+
+- 2026-10-06: Reloading or closing the popup mid-refresh no longer logs the
+  requests that cancels as failures
+  ([#218](https://git.eeqj.de/sneak/AutistMask/issues/218)). Chrome cancels a
+  closing page's open requests just after `pagehide`, and in the page a
+  cancelled `fetch()` fails with the same "Failed to fetch" as a server that
+  cannot be reached, so the home screen's transaction list and the balance
+  refresh logged an error for each, and the e2e suite failed on them. The popup
+  now aborts an `AbortController` on `pagehide`, and those two check its signal
+  before reporting a failure. New e2e tests reload the popup with Blockscout
+  held and require nothing logged, and fail the transaction list for real and
+  require the failure reported; `tests/balanceRefreshCancelled.test.js` covers
+  the balance refresh. The address and token screens and the address scan after
+  a new wallet still log a cancelled request
+  ([#475](https://git.eeqj.de/sneak/AutistMask/issues/475)).
+
+- 2026-10-05: `make build` no longer prints the Node `DEP0205`
+  `module.register()` deprecation warning
+  ([#355](https://git.eeqj.de/sneak/AutistMask/issues/355)). The call came from
+  `@tailwindcss/node`, which the Tailwind CLI loads; `tailwindcss` and
+  `@tailwindcss/cli` are now pinned at 4.3.1, the first release that uses
+  `module.registerHooks()` where Node has it. The compiled CSS computes to the
+  same values; it drops the unused `.start` and `.end` rules and writes
+  `calc(var(--spacing) * 1)` as `var(--spacing)` and `calc(var(--spacing) * 0)`
+  as `0`.
+
+- 2026-10-05: `make dev` watches
+  ([#332](https://git.eeqj.de/sneak/AutistMask/issues/332)). It used to pass
+  `--watch` to a `build.js` that read no arguments, so it built once and exited.
+  `build.js --watch` now builds, then builds again after every change to a file
+  under `src/`, `manifest/` or `icons/`; any other argument fails. It watches
+  each directory rather than using Node's recursive watch, which on Linux stops
+  seeing a file an editor saves by renaming a new copy over it. It writes no
+  build receipt, so nothing can verify what it builds; `make build` remains the
+  way to produce a `dist/` to hand on. `tests/buildWatch.test.js` covers the
+  watch loop against a temp directory.
+
+- 2026-10-05: Every CI job has a `timeout-minutes` cap
+  ([#294](https://git.eeqj.de/sneak/AutistMask/issues/294)): `check` 10 minutes,
+  `e2e-firefox` 15 and `e2e-chrome` 20, each over two and a half times the job's
+  slowest cold-cache run. A hung build or browser now ends its job instead of
+  holding the shared runner for hours.
+
+- 2026-10-05: `PROXY_METHODS` in `src/background/index.js` no longer lists
+  `eth_chainId` and `net_version`
+  ([#326](https://git.eeqj.de/sneak/AutistMask/issues/326)). `handleRpc` answers
+  both itself before its proxy branch, so the list named two methods that are
+  never sent to the RPC endpoint. No other entry is answered earlier.
+  `tests/proxyMethods.test.js` sends every listed method from a page and fails
+  on any that does not reach the RPC endpoint.
+
+- 2026-10-05: The popup's Content Security Policy no longer allows inline style
+  ([#328](https://git.eeqj.de/sneak/AutistMask/issues/328)): `style-src` is
+  `'self'` in both manifests, pinned in `tests/manifest.test.js`. The 42
+  `style="..."` attributes in `src/popup/index.html` and in the markup the view
+  helpers build are now Tailwind classes, each computing to the value it
+  replaced. The 16 address dot colours are written out as whole classes, because
+  Tailwind builds only the classes it finds in the source. The Settings debug
+  well is shown and hidden with the `hidden` class, since clearing an inline
+  `display` no longer uncovers it. Script that sets `element.style` is
+  unaffected.
+
+- 2026-10-05: `.prettierignore` no longer lists an AI vendor's tool directory
+  ([#363](https://git.eeqj.de/sneak/AutistMask/issues/363)). The directory is
+  not tracked, so the line ignored nothing.
+
+- 2026-10-05: The Chrome end-to-end suite drives both ways the wait for a
+  transaction's receipt ends on the error screen
+  ([#315](https://git.eeqj.de/sneak/AutistMask/issues/315)): lookups that still
+  find no receipt 60 seconds after the broadcast end it with the timeout
+  message, and six lookups that fail in a row end it with the message naming the
+  unreachable network. Done then returns to the address screen. Both cases wait
+  in real time, about a minute each. Playwright's clock would apply to every
+  later test in the run and cannot be removed, and moving the stored broadcast
+  time back can be undone by the save the popup makes every ten seconds.
+
+- 2026-10-05: The Chrome end-to-end suite covers the last of the
+  [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
+  [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) items
+  ([#295](https://git.eeqj.de/sneak/AutistMask/issues/295)): a token added on
+  Add Token by its contract address is listed on the address screen;
+  TransactionDetail opened from the token screen leaves that screen on the
+  persisted navigation stack, and Back returns to it; and the token contract row
+  links to the explorer's token page, read off the link rather than followed.
+  The network stub answers `symbol()` and `name()` for the stub token, which
+  adding it reads.
+
+- 2026-10-05: Each control that leads to a signature or to the private key has a
+  test that it refuses a defective wallet before asking for a password
+  ([#254](https://git.eeqj.de/sneak/AutistMask/issues/254)): Send on the main,
+  address and token screens, Export Private Key, and both approval screens, as
+  drawn and as clicked. Send on the confirmation screen refuses it too now,
+  because the popup reopens onto that screen from a saved view. The comments
+  that said the wallet's key cannot be derived now say that
+  `getSignerForAddress` refuses it, and the module comment in
+  `src/shared/walletDefects.js` names both earlier import paths.
+
+- 2026-10-05: The Chrome end-to-end suite drives the private key export screen
+  as it drives the recovery phrase screen
+  ([#253](https://git.eeqj.de/sneak/AutistMask/issues/253)): the correct
+  password shows the key, leaving by the settings gear empties the screen, and
+  leaving while the password is still being checked never puts the key on it.
+  The cases use the imported key wallet rather than the HD one. Leaving drops
+  the address the screen was showing, and an HD wallet's key cannot be derived
+  without it, so on an HD wallet a late decrypt fails by itself and would never
+  exercise the check that discards it. The screen cannot yet be opened twice in
+  one popup session ([#460](https://git.eeqj.de/sneak/AutistMask/issues/460)),
+  so the cases reopen the popup before the second open.
+
 - 2026-10-05: The StateRecovery screen is driven in a real browser under the
   shipped CSP, in both end-to-end suites
   ([#361](https://git.eeqj.de/sneak/AutistMask/issues/361)). A stored record

build.js

@@ -15,6 +15,15 @@ const DIST_CHROME = path.join(DIST, "chrome");
 const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 
+// What `make dev` watches: the directories whose files build() bundles,
+// compiles or copies. A change anywhere else, package.json and build.js
+// included, starts no build; restart make dev after one.
+const WATCHED_DIRS = [
+    SRC,
+    path.join(__dirname, "manifest"),
+    path.join(__dirname, "icons"),
+];
+
 // The module whose compiled DEBUG state script/verify-build asserts. Which
 // bundles contain it is derived from esbuild's own dependency graph rather
 // than from a hardcoded list, so it tracks the bundle layout instead of
@@ -31,7 +40,7 @@ const AUDITED_MODULE = "src/shared/constants.js";
 // the build, whether or not a text matcher would have recognized it. A
 // background entry point the table does not name fails as well, so a second
 // worker is protected by default rather than by someone remembering this file.
-// Dockerfile:42 runs `make build`, so it is enforced in CI.
+// The Dockerfile's last stage runs `make build`, so it is enforced in CI.
 
 // The build receipt: every file this build emits, with its sha256 and whether
 // it is one of the audited bundles. script/verify-build is handed this and
@@ -441,6 +450,10 @@ function getBuildInfo() {
 async function build() {
     console.log("Building AutistMask extension...");
 
+    // Under make dev this runs once per rebuild in the same process, and each
+    // build accounts only for what it emits itself.
+    emittedFiles.length = 0;
+
     const receiptPath = receiptTarget();
     if (!receiptPath) {
         console.warn(
@@ -597,27 +610,94 @@ async function build() {
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
 
-// Run only as a program. Required as a module — which is how
-// tests/buildForbiddenInputs.test.js reaches the checks below — this file
-// builds nothing and writes nothing.
-if (require.main === module) {
-    build().catch((err) => {
-        console.error(
-            `Build failed: ${err && err.message ? err.message : err}`,
-        );
-        process.exit(1);
-    });
+// make dev: build, then build again after every change under `dirs`, until
+// interrupted. A failed build is reported and watching carries on, so a
+// half-finished edit does not end it. A change that arrives while a build is
+// running is not lost: it causes one more build as soon as that one finishes.
+// A directory created after this starts is not watched until a restart.
+//
+// make dev sets no AUTISTMASK_BUILD_RECEIPT, so these builds write no receipt
+// and nothing can verify what they leave in dist/.
+//
+// `rebuild` is build() everywhere but tests/buildWatch.test.js, which also
+// closes the returned watchers.
+function watch(dirs, rebuild) {
+    let building = false;
+    let changedAgain = false;
+
+    async function run() {
+        if (building) {
+            changedAgain = true;
+            return;
+        }
+        building = true;
+        do {
+            // Let the rest of one save's events arrive first, so that one
+            // save is one build.
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            changedAgain = false;
+            try {
+                await rebuild();
+            } catch (err) {
+                console.error(
+                    `Build failed: ${err && err.message ? err.message : err}`,
+                );
+            }
+        } while (changedAgain);
+        building = false;
+        console.log("Watching for changes (Ctrl-C to stop)...");
+    }
+
+    // One watcher per directory rather than fs.watch's recursive option: on
+    // Linux, Node's recursive watch watches each file, and stops seeing one
+    // that an editor saves by renaming a new copy over it. A directory's
+    // watcher reports every change to the files in it, however they are saved.
+    const subdirectories = dirs.flatMap((dir) =>
+        fs
+            .readdirSync(dir, { recursive: true, withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => path.join(entry.parentPath, entry.name)),
+    );
+    const watchers = [...dirs, ...subdirectories].map((dir) =>
+        fs.watch(dir, run),
+    );
+    run();
+    return watchers;
 }
 
-// Exported for tests/buildForbiddenInputs.test.js only. The prohibition these
-// three functions enforce is the guarantee behind
-// https://git.eeqj.de/sneak/AutistMask/issues/324, and `make check` does not
-// run `make build` — so they are unit tested against synthetic metafiles
-// rather than being exercised only by CI, where "it ran" is not "it works".
+// Run only as a program. Required as a module — which is how
+// tests/buildForbiddenInputs.test.js and tests/buildWatch.test.js reach the
+// functions below — this file builds nothing and writes nothing.
+if (require.main === module) {
+    const args = process.argv.slice(2);
+    // An argument this file does not know fails rather than being ignored.
+    if (args.length > 1 || (args.length === 1 && args[0] !== "--watch")) {
+        console.error("usage: node build.js [--watch]");
+        process.exit(2);
+    }
+    if (args[0] === "--watch") {
+        watch(WATCHED_DIRS, build);
+    } else {
+        build().catch((err) => {
+            console.error(
+                `Build failed: ${err && err.message ? err.message : err}`,
+            );
+            process.exit(1);
+        });
+    }
+}
+
+// Exported for tests only: watch() for tests/buildWatch.test.js, the rest for
+// tests/buildForbiddenInputs.test.js. The prohibition those enforce is the
+// guarantee behind https://git.eeqj.de/sneak/AutistMask/issues/324, and
+// `make check` does not run `make build` — so they are unit tested against
+// synthetic metafiles rather than being exercised only by CI, where "it ran"
+// is not "it works".
 module.exports = {
     importChain,
     newForbiddenRecord,
     recordBundledInputs,
     assertNoForbiddenInputs,
     assertForbiddenTableCovered,
+    watch,
 };

docs/RELEASE.md

@@ -16,9 +16,9 @@ so the "release commit" throughout is the `main` commit the milestone PR merged.
 ## Procedure
 
 1. **Confirm `main` is green in CI.** The `check` workflow
-   (`.gitea/workflows/check.yml`) runs `script/cibuild`, i.e. `docker build .`,
-   and the `Dockerfile` runs `make check` as a build step, so a green `check`
-   run is a green `make check`. Find the run for the exact release commit on the
+   (`.gitea/workflows/check.yml`) runs `script/cibuild`, which runs
+   `script/check` and then builds the image uncached, so a green `check` run is
+   a green `make check`. Find the run for the exact release commit on the
    tracker's Actions view. _Check:_ that commit's `check` run succeeded; running
    `make check` on a clean checkout of the commit reproduces it and exits 0.
 

manifest/chrome.json

@@ -7,7 +7,7 @@
     "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
     "content_security_policy": {
-        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
+        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
     },
     "icons": {
         "16": "icons/icon16.png",

manifest/firefox.json

@@ -4,7 +4,7 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
+    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
     "icons": {
         "16": "icons/icon16.png",
         "32": "icons/icon32.png",

package.json

@@ -15,14 +15,14 @@
     },
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "@tailwindcss/cli": "^4.2.1",
+        "@tailwindcss/cli": "4.3.1",
         "esbuild": "^0.27.3",
         "eslint": "10.8.1",
         "globals": "17.11.0",
         "jest": "^30.2.0",
         "playwright-core": "1.56.0",
         "prettier": "^3.8.1",
-        "tailwindcss": "^4.2.1"
+        "tailwindcss": "4.3.1"
     },
     "dependencies": {
         "ethereum-blockies-base64": "^1.0.2",

script/check

@@ -1,14 +1,14 @@
 #!/bin/sh
-# script/check: run all checks (test, test-verify-build, lint, fmt-check).
-# Our own extension to scripts-to-rule-them-all. Must not modify any files.
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
     "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/test-verify-build"
-    "$SCRIPT_DIR/check-censored"
     "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
 }

script/check-censored

@@ -1,8 +1,8 @@
 #!/bin/sh
 # script/check-censored: assert that the competitor name RULES.md bars appears
 # nowhere in this repo, and nowhere in the built extension, except where it is
-# deliberate. Our own extension to scripts-to-rule-them-all, run from
-# script/check and from make build.
+# deliberate. Our own extension to scripts-to-rule-them-all, run by the
+# Dockerfile's lint phase and by make build.
 #
 # Where the name is allowed, and why each one is not negotiable away:
 #

script/cibuild

@@ -1,13 +1,28 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs make check, so
-# a successful build implies all checks pass.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build .
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/docker

@@ -1,6 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -8,7 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/fmt

@@ -4,10 +4,29 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     echo "Formatting..."
-    yarn run fmt 2>&1
+    run_yarn run fmt
 }
 
 main "$@"

script/fmt-check

@@ -5,10 +5,29 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     echo "Checking formatting..."
-    yarn run fmt-check 2>&1
+    run_yarn run fmt-check
 }
 
 main "$@"

script/lib/eslint/noStateSingletonInBackground.js

@@ -14,7 +14,7 @@
 // the build when esbuild's own metafile reports src/shared/state.js as an input
 // of a background bundle. That consults the resolution esbuild actually
 // performed, so no specifier syntax and no resolution rule can slip past it,
-// and Dockerfile:42 runs `make build` in CI.
+// and the Dockerfile's last stage runs `make build` in CI.
 //
 // What this rule is: fast local feedback, in the editor and in `make lint`,
 // before a full bundle. It reads sources from disk and matches import

script/lint

@@ -1,51 +1,23 @@
 #!/bin/sh
-# script/lint: run the linter (eslint, then prettier --check).
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# Linting is containerized. ESLint results depend on the ESLint version, and
-# the pinned one is the one in the image; a host's own install must not be
-# able to decide whether this repo is green. From a host this therefore builds
-# the Dockerfile's `lint` stage, which runs this same script inside the image.
-#
-# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
-# what stops the recursion, so `make check` inside the CI build lints in place
-# instead of trying to reach a docker daemon it does not have.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-
-    case "${AUTISTMASK_LINT_NATIVE:-}" in
-    1)
-        echo "Linting..."
-        yarn run lint 2>&1
-        return 0
-        ;;
-    "") ;;
-    *)
-        # Set but not recognized: say so rather than silently taking the
-        # docker path, which would look like the variable had no effect.
-        echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
-            "'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
-        exit 1
-        ;;
-    esac
-
-    if ! command -v docker >/dev/null 2>&1; then
-        echo "lint: docker is required; linting does not run on the host" >&2
-        exit 1
-    fi
-
-    echo "Linting in the pinned container..."
-    # --progress=plain: the default progress renderer collapses the lint
-    # output on success, and a lint run whose output cannot be seen is not
-    # evidence that it ran.
-    #
-    # --output=type=cacheonly: the exit status is the whole result; exporting
-    # an image afterwards costs about ten times the lint itself.
-    docker build --progress=plain --target lint \
-        --output=type=cacheonly . 2>&1
+    docker build --no-cache \
+        --target lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"

script/test

@@ -1,52 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
-#
-# jest runs three worker processes (package.json), not one per CPU core: on a
-# many-core shared host one per core took gigabytes of RAM per run.
-#
-# The timeout bounds a hung suite; it is not a performance budget. On the busy
-# shared build host the suite takes 8-13s with three workers, inside
-# REPO_POLICIES' 20s budget. Inside the image the same suite also pays a cold
-# jest cache and shares the runner with the rest of the build, which is not what
-# that budget describes, so the Dockerfile raises the bound through
-# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
-# produces a red that means nothing, and teaches "just run it again".
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    echo "Running tests (timeout ${TIMEOUT}s)..."
-
-    status=0
-    timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
-    [ "$status" -eq 0 ] && return 0
-
-    # 124 is timeout(1) killing the suite. Say so: a kill is not a failed
-    # assertion, and the verbose rerun would only spend the same wall clock
-    # to be killed again.
-    if [ "$status" -eq 124 ]; then
-        echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
-        echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
-        exit 1
-    fi
-
-    # 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
-    # is not a duration it accepts. The suite never ran, so it neither timed out
-    # nor failed, and the verbose rerun would only reprint the same complaint.
-    if [ "$status" -eq 125 ]; then
-        echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
-        echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
-        exit 1
-    fi
-
-    echo "--- Rerunning with --verbose for details ---"
-    timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
-    # Always fail: the first run already proved the tests are broken, so a
-    # flaky pass on the rerun must not turn the build green.
-    exit 1
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"

script/test-e2e

@@ -4,7 +4,7 @@
 # scripts-to-rule-them-all.
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
-# caps make test at 20 seconds and a browser suite does not fit. Run it
+# caps make test at 60 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views. ESLint's no-undef now catches a
 # used-but-not-imported identifier in make check, but only this suite sees
 # what a view actually does when it runs.
@@ -45,7 +45,10 @@ main() {
     trap 'cleanup; exit 130' INT TERM
 
     echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
+    # --no-cache: the image build runs make build and its checks, and a
+    # cached layer is a check that did not run.
+    docker build --no-cache --iidfile "$IIDFILE" -t "$IMAGE" \
+        -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
     # The image is run by ID, not by tag: where two clones of this repo run

script/test-e2e-firefox

@@ -4,7 +4,7 @@
 # script/test-e2e. Our own extension to scripts-to-rule-them-all.
 #
 # Deliberately NOT called by script/check or script/test, for the same
-# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
+# reason as the Chrome suite: REPO_POLICIES.md caps make test at 60 seconds
 # and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
 # on every push, in a job separate from check.
 #
@@ -44,7 +44,9 @@ main() {
     trap 'cleanup; exit 130' INT TERM
 
     echo "Building the pinned Firefox e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
+    # --no-cache: the image build runs make build and its checks, and a
+    # cached layer is a check that did not run.
+    docker build --no-cache --iidfile "$IIDFILE" -t "$IMAGE" \
         -f tests/e2e/firefox/Dockerfile .
 
     echo "Running the Firefox e2e suite..."

script/test-verify-build

@@ -2,7 +2,8 @@
 # script/test-verify-build: exercise every failure mode of
 # script/verify-build, and what make build does with dist/ after one of them
 # (script/discard-dist-on-failure). Our own extension to
-# scripts-to-rule-them-all, run from script/check so make check covers it.
+# scripts-to-rule-them-all, run by the Dockerfile's test phase so make check
+# covers it.
 #
 # Why this exists: verify-build is the build-integrity guard, and four separate
 # reviews of it each found a fresh vacuous pass — the grep exit-2 conflation,

src/background/index.js

@@ -741,11 +741,12 @@ async function handleConnectionRequest(origin) {
     }
 }
 
-// Methods that are safe to proxy directly to the RPC node
+// Methods that are safe to proxy directly to the RPC node. A method handleRpc
+// answers before its proxy branch does not belong here: it would never reach
+// the node. tests/proxyMethods.test.js sends every one of these.
 const PROXY_METHODS = [
     "eth_blockNumber",
     "eth_call",
-    "eth_chainId",
     "eth_estimateGas",
     "eth_gasPrice",
     "eth_getBalance",
@@ -759,7 +760,6 @@ const PROXY_METHODS = [
     "eth_getTransactionReceipt",
     "eth_maxPriorityFeePerGas",
     "eth_sendRawTransaction",
-    "net_version",
     "web3_clientVersion",
     "eth_feeHistory",
     "eth_getBlockTransactionCountByHash",
@@ -1802,3 +1802,5 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         return false;
     }
 });
+
+module.exports = { PROXY_METHODS };

src/popup/index.html

@@ -110,8 +110,7 @@
                     </div>
                     <div
                         id="add-wallet-phrase-warning"
-                        class="text-xs mb-2 border border-border border-dashed p-2"
-                        style="visibility: hidden"
+                        class="text-xs mb-2 border border-border border-dashed p-2 invisible"
                     >
                         Write these words down and keep them safe. Anyone with
                         them can take your funds; if you lose them, your wallet
@@ -262,10 +261,7 @@
 
                 <!-- recent transactions across all addresses -->
                 <div>
-                    <div
-                        class="font-bold bg-section py-1 px-2"
-                        style="margin-left: -0.5rem; margin-right: -0.5rem"
-                    >
+                    <div class="font-bold bg-section py-1 px-2 -mx-2">
                         Recent Transactions
                     </div>
                     <div id="home-tx-list">
@@ -273,7 +269,7 @@
                     </div>
                 </div>
 
-                <div class="py-1" style="margin: 0 -0.5rem">&nbsp;</div>
+                <div class="py-1 -mx-2">&nbsp;</div>
 
                 <div class="text-xs text-muted">
                     <span
@@ -395,22 +391,14 @@
                 ></div>
                 <h2 class="font-bold mb-1">Export Private Key</h2>
                 <p class="text-xs mb-1" id="export-privkey-title"></p>
-                <div class="text-xs mb-3">
-                    <span id="export-privkey-dot"></span>
-                    <span
-                        id="export-privkey-address"
-                        class="cursor-pointer"
-                        title="Click to copy"
-                    ></span>
-                </div>
+                <div id="export-privkey-address" class="text-xs mb-3"></div>
                 <p class="text-xs mb-3 text-muted">
                     Warning: anyone with this private key can access and
                     transfer all funds from this address. Never share it.
                 </p>
                 <div
                     id="export-privkey-flash"
-                    class="text-xs mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <div id="export-privkey-password-section" class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -542,8 +530,7 @@
                     />
                     <div
                         id="send-to-error"
-                        class="text-xs"
-                        style="min-height: 1.25rem; color: #cc0000"
+                        class="text-xs min-h-[1.25rem] text-[#cc0000]"
                     ></div>
                 </div>
                 <div class="mb-2">
@@ -619,7 +606,7 @@
                     <div class="text-xs text-muted mb-1">Your balance</div>
                     <div id="confirm-balance" class="text-xs"></div>
                 </div>
-                <div id="confirm-fee" class="mb-3" style="visibility: hidden">
+                <div id="confirm-fee" class="mb-3 invisible">
                     <div class="text-xs text-muted mb-1">Network fee</div>
                     <div id="confirm-fee-amount" class="text-xs"></div>
                     <!-- Holds its one line of space from the first paint, so
@@ -627,22 +614,13 @@
                     nothing. The placeholder is never seen. -->
                     <div
                         id="confirm-fee-reserve"
-                        class="text-xs text-muted"
-                        style="visibility: hidden"
+                        class="text-xs text-muted invisible"
                     >
                         reserve pending
                     </div>
                 </div>
-                <div
-                    id="confirm-warnings"
-                    class="mb-2"
-                    style="visibility: hidden"
-                ></div>
-                <div
-                    id="confirm-recipient-warning"
-                    class="mb-2"
-                    style="visibility: hidden"
-                >
+                <div id="confirm-warnings" class="mb-2 invisible"></div>
+                <div id="confirm-recipient-warning" class="mb-2 invisible">
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -655,14 +633,9 @@
                 in confirmTx.js sets it. -->
                 <div
                     id="confirm-contract-warning"
-                    class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
-                    style="visibility: hidden"
+                    class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500 invisible"
                 ></div>
-                <div
-                    id="confirm-burn-warning"
-                    class="mb-2"
-                    style="visibility: hidden"
-                >
+                <div id="confirm-burn-warning" class="mb-2 invisible">
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -670,11 +643,7 @@
                         here are permanently destroyed and cannot be recovered.
                     </div>
                 </div>
-                <div
-                    id="confirm-etherscan-warning"
-                    class="mb-2"
-                    style="visibility: hidden"
-                >
+                <div id="confirm-etherscan-warning" class="mb-2 invisible">
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -684,13 +653,11 @@
                 </div>
                 <div
                     id="confirm-errors"
-                    class="mb-2 border border-border border-dashed p-2"
-                    style="visibility: hidden; min-height: 1.25rem"
+                    class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
                 ></div>
                 <div
                     id="confirm-amount-fee-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
                 >
                     Your balance does not cover this amount plus the network
                     fee. Please go back and send a smaller amount.
@@ -699,15 +666,13 @@
                 in confirmTx.js sets it. -->
                 <div
                     id="confirm-gas-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
                 ></div>
                 <!-- Its sentence names why the fee could not be estimated,
                 so show() in confirmTx.js sets it. -->
                 <div
                     id="confirm-fee-unknown-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
@@ -719,8 +684,7 @@
                 </div>
                 <div
                     id="confirm-tx-password-error"
-                    class="text-xs mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <button
                     id="btn-confirm-send"
@@ -835,8 +799,7 @@
                 </button>
                 <div
                     id="receive-erc20-warning"
-                    class="text-xs border border-border border-dashed p-2 mt-3"
-                    style="visibility: hidden"
+                    class="text-xs border border-border border-dashed p-2 mt-3 invisible"
                 ></div>
             </div>
 
@@ -864,8 +827,7 @@
                 </div>
                 <div
                     id="add-token-info"
-                    class="text-xs text-muted mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-muted mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs text-muted"
@@ -1051,8 +1013,7 @@
                             type="text"
                             inputmode="numeric"
                             id="settings-dust-threshold"
-                            class="border border-border p-1 text-xs bg-bg text-fg"
-                            style="width: 10ch"
+                            class="border border-border p-1 text-xs bg-bg text-fg w-[10ch]"
                         />
                         <span class="text-xs text-muted">gwei</span>
                     </div>
@@ -1129,8 +1090,7 @@
 
                 <div
                     id="settings-debug-well"
-                    class="bg-well p-3 mx-1 mb-3"
-                    style="display: none"
+                    class="bg-well p-3 mx-1 mb-3 hidden"
                 >
                     <h3 class="font-bold mb-1">Debug</h3>
                     <label
@@ -1158,8 +1118,7 @@
                 </p>
                 <div
                     id="delete-wallet-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -1232,8 +1191,7 @@
                 </div>
                 <div
                     id="delete-wallet-lost-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <button
                     id="btn-delete-wallet-lost-confirm"
@@ -1288,8 +1246,7 @@
                 </p>
                 <div
                     id="delete-address-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <button
                     id="btn-delete-address-confirm"
@@ -1318,8 +1275,7 @@
                 </div>
                 <div
                     id="show-phrase-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <div id="show-phrase-password-section" class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -1401,8 +1357,7 @@
                     />
                     <div
                         id="settings-addtoken-info"
-                        class="text-xs text-muted mt-1 min-h-[1.25rem]"
-                        style="visibility: hidden"
+                        class="text-xs text-muted mt-1 min-h-[1.25rem] invisible"
                     ></div>
                     <button
                         id="btn-settings-addtoken-manual"
@@ -1635,8 +1590,7 @@
                 </div>
                 <div
                     id="approve-tx-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem]"
-                    style="visibility: hidden"
+                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem] invisible"
                 ></div>
                 <div class="flex justify-between">
                     <button
@@ -1672,15 +1626,7 @@
 
                 <div
                     id="approve-sign-danger-warning"
-                    class="mb-3 p-2 text-xs font-bold"
-                    style="
-                        visibility: hidden;
-                        min-height: 1.25rem;
-                        background: #fee2e2;
-                        color: #991b1b;
-                        border: 2px solid #dc2626;
-                        border-radius: 6px;
-                    "
+                    class="mb-3 p-2 text-xs font-bold invisible min-h-[1.25rem] bg-[#fee2e2] text-[#991b1b] border-2 border-[#dc2626] rounded-[6px]"
                 ></div>
 
                 <div class="mb-3">
@@ -1697,8 +1643,7 @@
                     <div class="text-xs text-muted mb-1">Message</div>
                     <div
                         id="approve-sign-message"
-                        class="text-xs break-all"
-                        style="max-height: 12rem; overflow-y: auto"
+                        class="text-xs break-all max-h-48 overflow-y-auto"
                     ></div>
                 </div>
 
@@ -1706,8 +1651,7 @@
                     <div class="text-xs text-muted mb-1">Raw data</div>
                     <div
                         id="approve-sign-hex"
-                        class="text-xs break-all"
-                        style="max-height: 6rem; overflow-y: auto"
+                        class="text-xs break-all max-h-24 overflow-y-auto"
                     ></div>
                 </div>
 
@@ -1721,8 +1665,7 @@
                 </div>
                 <div
                     id="approve-sign-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem]"
-                    style="visibility: hidden"
+                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem] invisible"
                 ></div>
                 <div class="flex justify-between">
                     <button
@@ -1846,8 +1789,7 @@
                 </div>
                 <div
                     id="state-recovery-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
                 ></div>
                 <button
                     id="btn-state-recovery-reset"

src/popup/index.js

@@ -48,6 +48,14 @@ function renderWalletList() {
     home.render(ctx);
 }
 
+// Aborted when the popup page goes away, closed or reloaded. Chrome then
+// cancels the requests the page still has open, and a cancelled fetch() fails
+// with the same "Failed to fetch" as a server that cannot be reached. pagehide
+// fires first, so code that reports a failed request checks this and stays
+// silent about one the page's own closing cancelled.
+const pageClosed = new AbortController();
+window.addEventListener("pagehide", () => pageClosed.abort());
+
 let refreshInFlight = false;
 
 // The ten-second refresh init() starts, stopped when the popup moves to the
@@ -66,6 +74,7 @@ async function doRefreshAndRender() {
                 state.blockscoutUrl,
                 state.trackedTokens,
                 state.networkId,
+                pageClosed.signal,
             ),
         ]);
         state.lastBalanceRefresh = Date.now();
@@ -87,6 +96,7 @@ async function doRefreshAndRender() {
 const ctx = {
     renderWalletList,
     doRefreshAndRender,
+    pageClosed: pageClosed.signal,
     showAddWalletView: () => {
         pushCurrentView();
         addWallet.show();

src/popup/views/addressDetail.js

@@ -33,8 +33,8 @@ const { walletDefect } = require("../../shared/walletDefects");
 
 // The defect of the wallet the selected address belongs to, or null. Both the
 // send and the private-key export path check it before asking for a password,
-// so a wallet that cannot derive its keys says so instead of failing after the
-// user has typed one in.
+// so a wallet whose key getSignerForAddress refuses says so instead of failing
+// after the user has typed one in.
 function selectedWalletDefect() {
     if (state.selectedWallet === null) return null;
     return walletDefect(state.wallets[state.selectedWallet]);
@@ -181,10 +181,10 @@ function renderTransactions(txs) {
         // it on the line above rather than replacing it.
         const nameStr = escapeHtml(title || ensName || "");
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity:0.5;" : "";
+        const opacity = tx.isError ? " opacity-50" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
+        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, nameStr, amountStr);
         html += `</div>`;
@@ -259,9 +259,10 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
-        // There is no private key to export for an address this wallet
-        // cannot derive. Without this the export screen would take a
-        // password and then report it as wrong.
+        // This address's private key can be derived from the stored key,
+        // but export goes through getSignerForAddress, which refuses a key
+        // that is not a master key. Without this the export screen would
+        // take a password and then report that refusal as a wrong password.
         const defect = selectedWalletDefect();
         if (defect) {
             showFlash(defect.shortMessage);

src/popup/views/addressToken.js

@@ -258,10 +258,10 @@ function renderTransactions(txs) {
         // it on the line above rather than replacing it.
         const nameStr = escapeHtml(title || ensName || "");
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity:0.5;" : "";
+        const opacity = tx.isError ? " opacity-50" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
+        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, nameStr, amountStr);
         html += `</div>`;

src/popup/views/approval.js

@@ -822,9 +822,10 @@ function setSignButtonBusy(busy) {
 }
 
 // Say so on the approval screen itself, and disable the approve button, when
-// the address the approval was raised for belongs to a wallet whose keys
-// cannot be derived. Without this the screen would take a password and fail
-// after deriving it. Reject stays available; the wallet is not touched.
+// the address the approval was raised for belongs to a wallet whose key
+// getSignerForAddress refuses. Without this the screen would take a password
+// and fail after deriving it. Reject stays available; the wallet is not
+// touched.
 // Returns true when it gated.
 function gateOnWalletDefect(errorId, buttonId, address) {
     const owner = findWalletFor(address);

src/popup/views/confirmTx.js

@@ -21,6 +21,7 @@ const {
 } = require("./helpers");
 const { state, currentNetwork } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
+const { walletDefect } = require("../../shared/walletDefects");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
@@ -537,6 +538,15 @@ function init(_ctx) {
     onViewLeave("confirm-tx", clearPassword);
 
     $("btn-confirm-send").addEventListener("click", async () => {
+        const wallet = state.wallets[state.selectedWallet];
+        // Every Send button refuses a defective wallet before this screen,
+        // but the popup also reopens onto it from a saved view.
+        const defect = walletDefect(wallet);
+        if (defect) {
+            showError("confirm-tx-password-error", defect.shortMessage);
+            return;
+        }
+
         const password = $("confirm-tx-password").value;
         if (!password) {
             showError(
@@ -546,7 +556,6 @@ function init(_ctx) {
             return;
         }
 
-        const wallet = state.wallets[state.selectedWallet];
         let decryptedSecret;
         hideError("confirm-tx-password-error");
 

src/popup/views/exportPrivkey.js

@@ -98,7 +98,7 @@ function show(walletIdx, addrIdx) {
 
     $("export-privkey-title").textContent =
         wallet.name + " — Address " + (addrIdx + 1);
-    const addrContainer = $("export-privkey-dot").parentElement;
+    const addrContainer = $("export-privkey-address");
     addrContainer.innerHTML = renderAddressHtml(addr.address);
     attachCopyHandlers(addrContainer);
 

src/popup/views/helpers.js

@@ -335,7 +335,7 @@ function balanceLine(symbol, amount, price, tokenId) {
         : "";
     return (
         `<div class="flex text-xs${clickClass}"${tokenAttr}>` +
-        `<span class="flex justify-between" style="width:42ch;max-width:100%">` +
+        `<span class="flex justify-between w-[42ch] max-w-full">` +
         `<span>${escapeHtml(displaySymbol(symbol))}</span>` +
         `<span>${qty}</span>` +
         `</span>` +
@@ -430,23 +430,26 @@ function truncateMiddle(str, maxLen) {
 
 // 16 colors evenly spaced around the hue wheel (22.5° apart),
 // all at HSL saturation 70%, lightness 50% for uniform vibrancy.
+// Each is a whole Tailwind class: Tailwind builds only the classes it finds
+// written out in the source, so the class name cannot be put together at
+// runtime.
 const ADDRESS_COLORS = [
-    "#d92626",
-    "#d96926",
-    "#d9ac26",
-    "#c2d926",
-    "#80d926",
-    "#3dd926",
-    "#26d953",
-    "#26d996",
-    "#26d9d9",
-    "#2696d9",
-    "#2653d9",
-    "#3d26d9",
-    "#8026d9",
-    "#c226d9",
-    "#d926ac",
-    "#d92669",
+    "bg-[#d92626]",
+    "bg-[#d96926]",
+    "bg-[#d9ac26]",
+    "bg-[#c2d926]",
+    "bg-[#80d926]",
+    "bg-[#3dd926]",
+    "bg-[#26d953]",
+    "bg-[#26d996]",
+    "bg-[#26d9d9]",
+    "bg-[#2696d9]",
+    "bg-[#2653d9]",
+    "bg-[#3d26d9]",
+    "bg-[#8026d9]",
+    "bg-[#c226d9]",
+    "bg-[#d926ac]",
+    "bg-[#d92669]",
 ];
 
 function addressColor(address) {
@@ -456,12 +459,12 @@ function addressColor(address) {
 
 function addressDotHtml(address) {
     const color = addressColor(address);
-    return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
+    return `<span class="inline-block w-[8px] h-[8px] rounded-[50%] ${color} mr-[4px] align-middle shrink-0"></span>`;
 }
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${escapeHtml(src)}" width="48" height="48" class="inline-block rounded-[50%] [image-rendering:pixelated]">`;
 }
 
 // Look up an address across all wallets and return its title
@@ -571,7 +574,7 @@ function timeAgo(timestamp) {
 
 // Shared external-link icon SVG used across all views.
 const EXT_ICON =
-    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<span class="inline-block w-[10px] h-[10px] ml-[4px] align-middle">` +
     `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
     `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +

src/popup/views/home.js

@@ -131,10 +131,10 @@ function renderHomeTxList(ctx) {
         const title = addressTitle(counterparty, state.wallets);
         const titleStr = title ? escapeHtml(title) : "";
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity:0.5;" : "";
+        const opacity = tx.isError ? " opacity-50" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="home-tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
+        html += `<div class="home-tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, titleStr, amountStr);
         html += `</div>`;
@@ -225,6 +225,9 @@ async function loadHomeTxs(ctx) {
         homeTxs = merged.slice(0, 25);
         renderHomeTxList(ctx);
     } catch (e) {
+        // Cancelled by the popup closing, not failed: see pageClosed in
+        // src/popup/index.js.
+        if (ctx.pageClosed.aborted) return;
         log.errorf("loadHomeTxs failed:", e.message);
         const list = $("home-tx-list");
         if (list) {
@@ -241,7 +244,7 @@ function walletListHtml() {
     state.wallets.forEach((wallet, wi) => {
         const defect = walletDefect(wallet);
         html += `<div>`;
-        html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
+        html += `<div class="flex justify-between items-center bg-section py-1 px-2 -mx-2">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
         // No "+" on a defective wallet: deriving another address from that
         // xpub would only add one more address the key does not produce
@@ -255,12 +258,12 @@ function walletListHtml() {
         wallet.addresses.forEach((addr, ai) => {
             html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
             const isActive = state.activeAddress === addr.address;
-            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
+            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg p-0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
             // Only where a wallet can spare the address: a wallet holding a
             // single address has no remove control, because its last address
             // is never removable.
             const removeBtn = canRemoveAddress(wallet)
-                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1" style="padding:0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
+                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1 p-0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
                 : "";
             const dot = addressDotHtml(addr.address);
             const titleBold = isActive ? "font-bold" : "";

src/popup/views/settings.js

@@ -213,12 +213,7 @@ function show() {
     versionClickCount = 0;
 
     // Show debug well if debug mode is already enabled
-    const debugWell = $("settings-debug-well");
-    if (state.debugMode) {
-        debugWell.style.display = "";
-    } else {
-        debugWell.style.display = "none";
-    }
+    $("settings-debug-well").classList.toggle("hidden", !state.debugMode);
     $("settings-debug-mode").checked = state.debugMode;
 
     showView("settings");
@@ -434,7 +429,7 @@ function init(ctx) {
         if (versionClickCount >= 10) {
             versionClickCount = 0;
             clearTimeout(versionClickTimer);
-            $("settings-debug-well").style.display = "";
+            $("settings-debug-well").classList.remove("hidden");
         }
     });
 

src/shared/balances.js

@@ -87,7 +87,15 @@ function rawUnits(value) {
 // way `holders` already is. Absence is never filled in here: this is the
 // upstream of every screen that displays a token amount, so a value invented
 // at this point is indistinguishable from a real one everywhere below it.
-async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
+//
+// `signal`, passed by the popup, is aborted when the popup closes; a request
+// that fails after that was cancelled by the closing and is not logged.
+async function fetchTokenBalances(
+    address,
+    blockscoutUrl,
+    trackedTokens,
+    signal,
+) {
     try {
         const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -190,18 +198,22 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
         }
         return balances;
     } catch (e) {
-        log.errorf("fetchTokenBalances failed:", e.message);
+        if (!signal?.aborted) {
+            log.errorf("fetchTokenBalances failed:", e.message);
+        }
         return null;
     }
 }
 
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// `signal` is as for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
     blockscoutUrl,
     trackedTokens,
     networkId,
+    signal,
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
@@ -220,6 +232,7 @@ async function refreshBalances(
                         log.debugf("ETH balance", addr.address, addr.balance);
                     })
                     .catch((e) => {
+                        if (signal?.aborted) return;
                         log.errorf(
                             "ETH balance failed",
                             addr.address,
@@ -243,6 +256,7 @@ async function refreshBalances(
                         );
                     })
                     .catch((e) => {
+                        if (signal?.aborted) return;
                         log.errorf(
                             "ENS reverse failed",
                             addr.address,
@@ -258,6 +272,7 @@ async function refreshBalances(
                     addr.address,
                     blockscoutUrl,
                     trackedTokens,
+                    signal,
                 ).then((balances) => {
                     if (balances !== null) {
                         addr.tokenBalances = balances;

src/shared/walletDefects.js

@@ -13,11 +13,17 @@ const NON_MASTER_XPRV = "non-master-xprv";
 
 // An "xprv" wallet stores the neutered BIP-44 Ethereum node, four levels below
 // the key that was imported: the current import path derives the absolute
-// m/44'/60'/0'/0 from a depth-0 key, and the pre-#210 path derived the same
-// four levels as a relative path beneath whatever depth it was given. A master
-// import therefore stores a depth-4 xpub and a depth-d import stores depth
-// d + 4, which makes the stored xpub an exact read on the imported key's
-// depth — and it is readable without the password, unlike the key itself.
+// m/44'/60'/0'/0 from a depth-0 key, and the path before #210 (57959b7)
+// derived the same four levels as a relative path beneath whatever depth it
+// was given. A master import therefore stores a depth-4 xpub and a depth-d
+// import stores depth d + 4, which makes the stored xpub an exact read on the
+// imported key's depth — and it is readable without the password, unlike the
+// key itself.
+//
+// The first import path (7a7f9c5) does not fit: it stored the imported key's
+// own xpub with no derivation, so a wallet it wrote is judged wrongly here (a
+// master import as defective, a depth-4 import as sound). 57959b7 replaced it
+// in the same push, and no tag contains it.
 const BIP44_ETH_XPUB_DEPTH = 4;
 
 const DEFECTS = {

tests/balanceLineEscaping.test.js

@@ -5,7 +5,7 @@
 //
 // The browser half of the same claim — that a real Chrome renders that
 // string as text and puts no iframe in the popup DOM — is in
-// tests/e2e/run.js. This half runs inside the 20-second make test cap.
+// tests/e2e/run.js. This half runs inside the 60-second make test cap.
 
 "use strict";
 

tests/balanceRefreshCancelled.test.js

@@ -0,0 +1,67 @@
+// The balance refresh does not report a request the popup's own closing
+// cancelled, and still reports one that failed while the popup was open
+// (https://git.eeqj.de/sneak/AutistMask/issues/218).
+//
+// In the popup a cancelled fetch() fails with the same "Failed to fetch" as a
+// server that cannot be reached, so every request here fails that way, and
+// only the signal the popup aborts on pagehide tells the two cases apart.
+
+const { FetchRequest } = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
+const ADDRESS = "0x1111111111111111111111111111111111111111";
+
+const realFetch = globalThis.fetch;
+let logged;
+
+beforeEach(() => {
+    logged = [];
+    jest.spyOn(console, "error").mockImplementation((...args) => {
+        logged.push(args.map(String).join(" "));
+    });
+    const failedToFetch = async () => {
+        throw new TypeError("Failed to fetch");
+    };
+    // The RPC calls (ETH balance, ENS name) and the explorer request (token
+    // balances) all fail the same way.
+    FetchRequest.registerGetUrl(failedToFetch);
+    globalThis.fetch = jest.fn(failedToFetch);
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    jest.restoreAllMocks();
+});
+
+function refresh(signal) {
+    const wallets = [{ addresses: [{ address: ADDRESS }] }];
+    return refreshBalances(
+        wallets,
+        RPC_URL,
+        EXPLORER_URL,
+        [],
+        "mainnet",
+        signal,
+    );
+}
+
+test("a failure while the popup is open is reported", async () => {
+    await refresh(new AbortController().signal);
+    for (const label of [
+        "ETH balance failed",
+        "ENS reverse failed",
+        "fetchTokenBalances failed: Failed to fetch",
+    ]) {
+        expect(logged.some((line) => line.includes(label))).toBe(true);
+    }
+});
+
+test("a failure once the popup has closed is not", async () => {
+    const pageClosed = new AbortController();
+    pageClosed.abort();
+    await refresh(pageClosed.signal);
+    expect(logged).toEqual([]);
+});

tests/buildWatch.test.js

@@ -0,0 +1,104 @@
+// `make dev` runs `node build.js --watch`
+// (https://git.eeqj.de/sneak/AutistMask/issues/332). These drive build.js's
+// watch() over a temp directory with a stand-in for build(), so nothing here
+// builds or writes dist/.
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const { watch } = require("../build");
+
+let dir;
+let watchers = [];
+
+beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-watch-"));
+    fs.mkdirSync(path.join(dir, "nested"));
+    jest.spyOn(console, "log").mockImplementation(() => {});
+    jest.spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+    for (const watcher of watchers) watcher.close();
+    watchers = [];
+    fs.rmSync(dir, { recursive: true, force: true });
+    jest.restoreAllMocks();
+});
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Wait until `condition()` holds; fail the test if it has not within 3s.
+async function until(condition) {
+    const deadline = Date.now() + 3000;
+    while (!condition()) {
+        if (Date.now() > deadline) throw new Error("timed out waiting");
+        await sleep(10);
+    }
+}
+
+// Save the way many editors do: write a new copy, then rename it over the
+// original, so the file at that path is a different one afterwards.
+function saveByRename(file, contents) {
+    fs.writeFileSync(`${file}.tmp`, contents);
+    fs.renameSync(`${file}.tmp`, file);
+}
+
+test("builds at start, then once per change to a file in a subdirectory", async () => {
+    const file = path.join(dir, "nested", "a.js");
+    fs.writeFileSync(file, "1");
+    let builds = 0;
+    watchers = watch([dir], async () => {
+        builds++;
+    });
+    await until(() => builds === 1);
+
+    fs.writeFileSync(file, "2");
+    await until(() => builds === 2);
+    await sleep(300);
+    expect(builds).toBe(2);
+});
+
+test("keeps seeing a file that is saved by renaming a new copy over it", async () => {
+    const file = path.join(dir, "nested", "a.js");
+    fs.writeFileSync(file, "1");
+    let builds = 0;
+    watchers = watch([dir], async () => {
+        builds++;
+    });
+    await until(() => builds === 1);
+
+    saveByRename(file, "2");
+    await until(() => builds === 2);
+    saveByRename(file, "3");
+    await until(() => builds === 3);
+});
+
+test("a failed build is reported and watching carries on", async () => {
+    let builds = 0;
+    watchers = watch([dir], async () => {
+        builds++;
+        if (builds === 1) throw new Error("unexpected token");
+    });
+    await until(() => console.error.mock.calls.length === 1);
+    expect(console.error).toHaveBeenCalledWith(
+        "Build failed: unexpected token",
+    );
+
+    fs.writeFileSync(path.join(dir, "a.js"), "1");
+    await until(() => builds === 2);
+});
+
+test("a change made while a build runs causes one more build after it", async () => {
+    let builds = 0;
+    watchers = watch([dir], async () => {
+        builds++;
+        if (builds === 1) {
+            fs.writeFileSync(path.join(dir, "a.js"), "1");
+            await sleep(200);
+        }
+    });
+    await until(() => builds === 2);
+    await sleep(300);
+    expect(builds).toBe(2);
+});

tests/contractCreation.test.js

@@ -301,7 +301,7 @@ describe.each([
     test("a contract creation's row says so, with no colour dot and no address line", async () => {
         const html = await rowsFor(historyTx(""));
         expect(html).toContain(SENTENCE);
-        expect(html).not.toContain("background:");
+        expect(html).not.toContain("bg-[#");
         expect(html).not.toContain("am-address");
         expect(html).not.toContain("undefined");
     });
@@ -309,7 +309,7 @@ describe.each([
     test("a transaction with a recipient shows its colour dot and address", async () => {
         const html = await rowsFor(historyTx(RECIPIENT));
         expectAddressLine(html);
-        expect(html).toContain("background:#");
+        expect(html).toContain("bg-[#");
         expect(html).toContain(`<div class="am-address">${RECIPIENT}</div>`);
     });
 });

tests/dustThreshold.test.js

@@ -105,7 +105,7 @@ describe("the flash line the message is shown in", () => {
     // "a rejected dust threshold shifts no layout (#233)" and "an over-long
     // flash message keeps to one line (#252)" in tests/e2e/run.js, run by
     // make test-e2e. They are not in make check because REPO_POLICIES.md
-    // caps make test at 20 seconds and a browser suite does not fit.
+    // caps make test at 60 seconds and a browser suite does not fit.
     test("reserves its height in the markup", () => {
         const flashLine = POPUP_HTML.match(
             /<div\s+id="flash-msg"\s+class="([^"]*)"/,

tests/e2e/firefox/run.js

@@ -8,7 +8,7 @@
 //   node tests/e2e/firefox/run.js [dist/firefox]
 //
 // Deliberately not part of script/check, and deliberately not named
-// *.test.js: REPO_POLICIES.md caps make test at 20 seconds and a browser
+// *.test.js: REPO_POLICIES.md caps make test at 60 seconds and a browser
 // suite does not fit.
 //
 // This shares no driver layer with the Chrome suite in tests/e2e/, and the

tests/e2e/harness.js

@@ -4,7 +4,7 @@
 //
 // This runs inside the pinned Playwright container; see script/test-e2e.
 // It is deliberately NOT part of make check — REPO_POLICIES.md caps
-// make test at 20 seconds and a browser suite does not fit.
+// make test at 60 seconds and a browser suite does not fit.
 
 "use strict";
 

tests/e2e/network.js

@@ -22,7 +22,7 @@
 
 "use strict";
 
-const { Transaction } = require("ethers");
+const { AbiCoder, Transaction } = require("ethers");
 
 // Fictional ERC-20 used to seed the transaction-detail test. The symbol
 // must not collide with any entry in src/shared/tokenList.js, or
@@ -244,12 +244,16 @@ function latestBlock() {
     };
 }
 
-// keccak("decimals()")[0:4].
+// keccak("decimals()")[0:4], and the same for symbol() and name().
 const SELECTOR_DECIMALS = "0x313ce567";
+const SELECTOR_SYMBOL = "0x95d89b41";
+const SELECTOR_NAME = "0x06fdde03";
 
-// Every eth_call still answers with a zero word except decimals() on the
-// stub token, which the wallet reads back at signing time to compare with
-// the scale the confirmation screen rendered (issue #305).
+// Every eth_call still answers with a zero word except decimals(), symbol()
+// and name() on the stub token. The wallet reads decimals() back at signing
+// time to compare with the scale the confirmation screen rendered (issue
+// #305). Adding the token by its contract address reads all three (issue
+// #295); symbol() and name() answer what the explorer reports for it.
 //
 // opts.tokenDecimalsOverride is the lying contract: set it and decimals()
 // answers something other than the value this same fixture reports through
@@ -263,9 +267,17 @@ function ethCallResult(req, opts) {
     if (!call || typeof call !== "object") return ZERO_WORD;
     const data = String(call.data || call.input || "").toLowerCase();
     const to = String(call.to || "").toLowerCase();
-    if (data.startsWith(SELECTOR_DECIMALS) && to === STUB_TOKEN.address) {
+    if (to !== STUB_TOKEN.address) return ZERO_WORD;
+    if (data.startsWith(SELECTOR_DECIMALS)) {
         return word(opts.tokenDecimalsOverride ?? STUB_TOKEN.decimals);
     }
+    const abi = AbiCoder.defaultAbiCoder();
+    if (data.startsWith(SELECTOR_SYMBOL)) {
+        return abi.encode(["string"], [tokenObject(opts).symbol]);
+    }
+    if (data.startsWith(SELECTOR_NAME)) {
+        return abi.encode(["string"], [tokenObject(opts).name]);
+    }
     return ZERO_WORD;
 }
 
@@ -406,27 +418,23 @@ function sleep(ms) {
 const HOLD_POLL_MS = 25;
 const HOLD_MAX_MS = 30000;
 
-// Hold a gas estimate open for as long as the test asks.
+// Hold a reply open for as long as the test asks: until opts[name] is false.
 //
-// opts.holdGasEstimate is read here rather than captured, so a test flips it
-// on the same options object the route was registered with — the same
-// pattern as seedTokenTransfer. This is the only way to observe the
-// confirmation screen while its estimate is genuinely in flight; sampling
-// the screen and hoping to win a race against the network would assert
-// nothing on a slow machine.
+// The switch (holdGasEstimate or holdBlockscout) is read here rather than
+// captured, so a test flips it on the same options object the route was
+// registered with — the same pattern as seedTokenTransfer. This is the only way
+// to observe a screen while its request is genuinely in flight; sampling the
+// screen and hoping to win a race against the network would assert nothing on
+// a slow machine.
 //
 // It never gives up quietly. A hold that outlives the bound is reported like
 // any other harness fault, because a "pending" state that stopped being
 // pending on its own is a green assertion about the wrong screen.
-async function awaitRelease(opts, report) {
+async function awaitRelease(opts, name, report) {
     const started = Date.now();
-    while (opts.holdGasEstimate) {
+    while (opts[name]) {
         if (Date.now() - started > HOLD_MAX_MS) {
-            report(
-                "held gas estimate was never released after " +
-                    HOLD_MAX_MS +
-                    "ms",
-            );
+            report(name + " was never released after " + HOLD_MAX_MS + "ms");
             return;
         }
         await sleep(HOLD_POLL_MS);
@@ -448,6 +456,16 @@ function rpcReply(req, opts, report) {
         return Object.assign(envelope, { result: ethCallResult(req, opts) });
     }
     if (req.method === "eth_getTransactionReceipt") {
+        // A lookup that fails, which the wait screen counts differently from
+        // one that answers "not mined yet" (README.md, WaitTx).
+        if (opts.failReceiptLookup) {
+            return Object.assign(envelope, {
+                error: {
+                    code: -32000,
+                    message: "e2e fixture: receipt lookup failed",
+                },
+            });
+        }
         const hash = Array.isArray(req.params) ? req.params[0] : null;
         return Object.assign(envelope, {
             result: opts.seedReceipt && hash ? transactionReceipt(hash) : null,
@@ -540,7 +558,7 @@ async function handleRpc(route, postData, opts, report) {
         return route.abort();
     }
     if (batch.some((req) => req.method === "eth_estimateGas")) {
-        await awaitRelease(opts, report);
+        await awaitRelease(opts, "holdGasEstimate", report);
     }
 
     const replies = batch.map((req) => rpcReply(req, opts, report));
@@ -596,6 +614,10 @@ function traceEnabled(raw) {
  *   node-side refusal.
  * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
  *   eth_estimateGas until this is cleared again.
+ * @param {boolean} [opts.holdBlockscout]  hold every Blockscout request until
+ *   this is cleared again.
+ * @param {boolean} [opts.failTransactionList]  fail every request for an
+ *   address's transaction list as a network error; read at request time.
  * @param {string[]} [opts.broadcastTransactions]  every raw signed
  *   transaction handed to eth_sendRawTransaction, appended in order.
  * @param {number|string|null} [opts.tokenDecimalsOverride]  the scale
@@ -607,6 +629,8 @@ function traceEnabled(raw) {
  *   symbol is markup; read at request time.
  * @param {boolean} [opts.seedReceipt]  answer eth_getTransactionReceipt with a
  *   confirmed receipt instead of null, so a wait screen resolves.
+ * @param {boolean} [opts.failReceiptLookup]  answer eth_getTransactionReceipt
+ *   with an error, so every receipt lookup fails; read at request time.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -669,7 +693,12 @@ async function installNetworkStubs(ctx, opts) {
 
         // Blockscout v2
         if (p.includes("/api/v2/")) {
+            await awaitRelease(opts, "holdBlockscout", report);
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
+                // Aborted rather than answered with an error status: to the
+                // page this is a server that cannot be reached, and fetch()
+                // rejects with "Failed to fetch".
+                if (opts.failTransactionList) return route.abort();
                 const addr = blockscoutAddress(p);
                 return jsonResponse(route, {
                     items:

tests/e2e/run.js

@@ -4,7 +4,7 @@
 //
 // A plain runner rather than jest on purpose: jest's default testMatch
 // would pull these files into script/test, and browser tests do not fit
-// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
+// inside the 60-second cap REPO_POLICIES.md puts on make test. Nothing
 // here is named *.test.js for the same reason.
 
 "use strict";
@@ -311,7 +311,7 @@ test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
         "token contract row missing the contract address, got: " +
             JSON.stringify(contractText),
     );
-    const dots = await contract.locator('span[style*="border-radius"]').count();
+    const dots = await contract.locator('span[class*="rounded-[50%]"]').count();
     assert(dots > 0, "token contract row rendered without its colour dot");
 });
 
@@ -596,6 +596,162 @@ test("tap-to-copy on the transaction detail screen copies the address (#151)", a
     );
 });
 
+// ------------------------- the last of the #150 and #151 items (#295)
+//
+// Add Token's confirm button, TransactionDetail opened from the token screen
+// and Back from it, and the explorer link on the token contract row.
+
+// The stub token stays tracked for the rest of the run: the next test reaches
+// its token screen through the balance row this one adds.
+test("a token added by its contract address is listed on the address screen (#150)", async (env) => {
+    await leaveTransactionDetail(env.page);
+    await env.page.click("#btn-add-token");
+    await visible(env.page, "#view-add-token");
+
+    await env.page.fill("#add-token-address", STUB_TOKEN.address);
+    await env.page.click("#btn-add-token-confirm");
+    await visible(env.page, "#view-address");
+
+    // No wait: the confirm renders the balance list before it shows the
+    // screen, and nothing renders the list again while the screen is up.
+    const row = env.page.locator(
+        '#address-balances [data-token="' + STUB_TOKEN.address + '"]',
+        { hasText: STUB_TOKEN.symbol },
+    );
+    const balances = await env.page.locator("#address-balances").innerText();
+    assert(
+        (await row.count()) === 1,
+        "the balance list has no " +
+            STUB_TOKEN.symbol +
+            " row for the token just added: " +
+            JSON.stringify(balances),
+    );
+});
+
+// TransactionDetail looks the same from either entry point. Only the
+// persisted stack says which one opened it, so that is what is asserted: from
+// the token screen it ends in "address-token", and Back has to land there
+// rather than on the address screen beneath it.
+test("transaction detail opened from the token screen goes Back to it (#151)", async (env) => {
+    await goHome(env.page);
+    const base = await persistedViewStack(env.page);
+
+    await env.page.locator("#wallet-list .btn-addr-info").first().click();
+    await visible(env.page, "#view-address");
+    await env.page
+        .locator('#address-balances [data-token="' + STUB_TOKEN.address + '"]')
+        .click();
+    await visible(env.page, "#view-address-token");
+
+    const row = env.page.locator("#address-token-tx-list .tx-row").first();
+    await row.waitFor({ state: "visible", timeout: 30000 });
+    await row.click();
+    await visible(env.page, "#view-transaction");
+    await waitForPersisted(
+        env.page,
+        "viewStack",
+        base.concat("main", "address", "address-token"),
+        "on transaction detail opened from the token screen",
+    );
+
+    // The stack is checked before the screen, so a Back that lands on the
+    // wrong screen fails by saying what the stack holds.
+    await env.page.click("#btn-tx-back");
+    await waitForPersisted(
+        env.page,
+        "viewStack",
+        base.concat("main", "address"),
+        "after Back from transaction detail",
+    );
+    await visible(env.page, "#view-address-token");
+
+    // Onto the address screen, which the next test starts from.
+    await env.page.click("#btn-address-token-back");
+    await visible(env.page, "#view-address");
+});
+
+// Read off the anchor rather than followed: where it points is all the popup
+// decides, and following it would only load the explorer's page. The suite is
+// on mainnet until the Settings section.
+test("the token contract row links to the explorer's token page (#151)", async (env) => {
+    await leaveTransactionDetail(env.page);
+    const row = env.page
+        .locator("#tx-list .tx-row")
+        .filter({ hasText: STUB_TOKEN.symbol });
+    await row.waitFor({ state: "visible", timeout: 30000 });
+    await row.click();
+    await visible(env.page, "#view-transaction");
+    await visible(env.page, "#tx-detail-token-contract-section");
+
+    const href = await env.page
+        .locator("#tx-detail-token-contract a")
+        .getAttribute("href");
+    const expected = "https://etherscan.io/token/" + STUB_TOKEN.address;
+    assert(
+        href === expected,
+        "the token contract row links to " +
+            JSON.stringify(href) +
+            ", expected " +
+            expected,
+    );
+});
+
+// ------------------------------------------- reload mid-refresh (#218)
+//
+// Reloading or closing the popup makes Chrome cancel the requests it still has
+// open, and in the page a cancelled fetch() fails with the same "Failed to
+// fetch" as a server that cannot be reached. Here rather than straight after
+// wallet creation because a reload also cancels the address scan that follows
+// it, which still logs (#475).
+
+// Blockscout is held, so the home screen's transaction list and token balances
+// cannot have been answered when the popup reloads. The assertion is the
+// harness's own: a console.error from the page being reloaded fails this test.
+test("reloading the popup mid-refresh reports no failure (#218)", async (env) => {
+    await goHome(env.page);
+    env.routeOpts.holdBlockscout = true;
+    try {
+        const inFlight = Promise.all([
+            env.page.waitForRequest((r) => r.url().endsWith("/transactions")),
+            env.page.waitForRequest((r) => r.url().endsWith("/token-balances")),
+        ]);
+        await env.page.reload();
+        await inFlight;
+        await env.page.reload();
+    } finally {
+        env.routeOpts.holdBlockscout = false;
+    }
+    await visible(env.page, "#view-main");
+});
+
+// The same "Failed to fetch" from a server that really cannot be reached is
+// still reported, so it still fails the run unless a test declares it. Chrome
+// reports the failed request itself as well, which a cancelled one does not.
+test("a transaction list that cannot be fetched is still reported (#218)", async (env) => {
+    env.errors.expect(
+        "loadHomeTxs failed",
+        /loadHomeTxs failed: Failed to fetch/,
+    );
+    env.errors.expect(
+        "Chrome's report of the failed request",
+        /Failed to load resource: net::ERR_FAILED/,
+    );
+    env.routeOpts.failTransactionList = true;
+    try {
+        // Drawn again by the next ten-second refresh.
+        await env.page.waitForFunction(
+            () =>
+                document
+                    .getElementById("home-tx-list")
+                    .textContent.includes("Failed to load transactions."),
+            null,
+            { timeout: 15000 },
+        );
+    } finally {
+        env.routeOpts.failTransactionList = false;
+    }
+});
+
 // -------------------------------------------- recovery phrase (#161)
 
 // The gear toggles, so pressing it while Settings is already up leaves it.
@@ -606,22 +762,26 @@ async function openSettings(page) {
     await visible(page, "#view-settings");
 }
 
-// Everything the recovery phrase screen is holding, read straight out of
+// Everything a screen that shows a secret is holding, read straight out of
 // the DOM whether or not that screen is the one on top. Reading it while it
 // is hidden is the point: "cleared on leave" means the node is empty, not
-// merely off-screen.
-async function phraseScreenState(page) {
-    return page.evaluate(() => ({
-        value: document.getElementById("show-phrase-value").textContent,
-        error: document.getElementById("show-phrase-flash").textContent,
-        html: document.getElementById("view-show-phrase").innerHTML,
-        resultHidden: document
-            .getElementById("show-phrase-result")
-            .classList.contains("hidden"),
-        viewHidden: document
-            .getElementById("view-show-phrase")
-            .classList.contains("hidden"),
-    }));
+// merely off-screen. `view` is "show-phrase" or "export-privkey"; the two
+// screens name their elements the same way.
+async function secretScreenState(page, view) {
+    return page.evaluate(
+        (v) => ({
+            value: document.getElementById(v + "-value").textContent,
+            error: document.getElementById(v + "-flash").textContent,
+            html: document.getElementById("view-" + v).innerHTML,
+            resultHidden: document
+                .getElementById(v + "-result")
+                .classList.contains("hidden"),
+            viewHidden: document
+                .getElementById("view-" + v)
+                .classList.contains("hidden"),
+        }),
+        view,
+    );
 }
 
 async function openPhraseScreen(page) {
@@ -636,12 +796,12 @@ async function revealPhrase(page) {
     await visible(page, "#show-phrase-result", 60000);
 }
 
-function assertWiped(st, phrase, where) {
-    assert(st.value === "", "phrase still in the DOM " + where);
+function assertWiped(st, secret, where) {
+    assert(st.value === "", "the secret is still in the DOM " + where);
     assert(st.resultHidden, "result section still shown " + where);
     assert(
-        !st.html.includes(phrase),
-        "the recovery phrase is still somewhere in the screen markup " + where,
+        !st.html.includes(secret),
+        "the secret is still somewhere in the screen markup " + where,
     );
 }
 
@@ -663,7 +823,8 @@ test("only an HD wallet is offered the recovery phrase action (#161)", async (en
 // The other half of the gate, against the real UI: a wallet holding a bare
 // private key has no phrase to show, so no row of it may offer the action.
 // The key is generated here rather than committed — the repo holds no
-// private keys, test ones included.
+// private keys, test ones included. It is kept on env for the private key
+// export tests (#253).
 test("a key wallet is not offered the recovery phrase action (#161)", async (env) => {
     const { Wallet } = require("ethers");
 
@@ -671,10 +832,8 @@ test("a key wallet is not offered the recovery phrase action (#161)", async (env
     await env.page.click("#btn-main-add-wallet");
     await visible(env.page, "#view-add-wallet");
     await env.page.click("#tab-privkey");
-    await env.page.fill(
-        "#import-private-key",
-        Wallet.createRandom().privateKey,
-    );
+    env.privateKey = Wallet.createRandom().privateKey;
+    await env.page.fill("#import-private-key", env.privateKey);
     await env.page.fill("#add-wallet-password", PASSWORD);
     await env.page.fill("#add-wallet-password-confirm", PASSWORD);
     await env.page.click("#btn-add-wallet-confirm");
@@ -696,7 +855,7 @@ test("a key wallet is not offered the recovery phrase action (#161)", async (env
 
 test("the recovery phrase screen holds nothing before the password (#161)", async (env) => {
     await openPhraseScreen(env.page);
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     assertWiped(st, env.phrase, "before any password was entered");
     const passwordShown = await env.page.isVisible(
         "#show-phrase-password-section",
@@ -714,7 +873,7 @@ test("a wrong password reveals nothing (#161)", async (env) => {
         { timeout: 60000 },
     );
 
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     assertWiped(st, env.phrase, "after a wrong password");
     assert(
         /^[A-Z].*\.$/.test(st.error.trim()),
@@ -730,7 +889,7 @@ test("the correct password reveals the full phrase, and nothing logs it (#161)",
     try {
         await revealPhrase(env.page);
 
-        const st = await phraseScreenState(env.page);
+        const st = await secretScreenState(env.page, "show-phrase");
         assert(
             st.value === env.phrase,
             "the displayed phrase is not the wallet's phrase, verbatim",
@@ -761,7 +920,7 @@ test("the correct password reveals the full phrase, and nothing logs it (#161)",
 test('"Back" wipes the revealed phrase (#161)', async (env) => {
     await env.page.click("#btn-show-phrase-back");
     await visible(env.page, "#view-settings");
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     assert(st.viewHidden, "the recovery phrase screen is still on top");
     assertWiped(st, env.phrase, "after Back");
 });
@@ -773,7 +932,7 @@ test("leaving by the settings gear wipes it too (#161)", async (env) => {
     await revealPhrase(env.page);
     await env.page.click("#btn-settings");
     await visible(env.page, "#view-settings");
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     assertWiped(st, env.phrase, "after leaving via the settings gear");
 });
 
@@ -810,7 +969,7 @@ test("leaving while the decrypt is in flight reveals nothing (#161)", async (env
     );
     await sleep(2000);
 
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     // Printed on every run, pass or fail: "the phrase is not there" is
     // worth more as a measurement than as a silent assertion, and the
     // same line read from a build without the guard is what this test
@@ -847,11 +1006,139 @@ test("reopening the popup never lands on the phrase screen (#161)", async (env)
     env.page = await openPopup(env.ctx, env.popupUrl);
     await visible(env.page, "#view-main");
 
-    const st = await phraseScreenState(env.page);
+    const st = await secretScreenState(env.page, "show-phrase");
     assert(st.viewHidden, "the popup reopened onto the recovery phrase screen");
     assertWiped(st, env.phrase, "after reopening the popup");
 });
 
+// ------------------------------------------ private key export (#253)
+
+// The recovery phrase cases above, on the private key export screen. They run
+// against the key wallet imported above, not the HD wallet: leaving the screen
+// drops the address it was showing, and without one an HD wallet's key cannot
+// be derived, so there a decrypt that finished late would fail on its own and
+// the liveness check would go untested.
+
+// From Home to the export screen of the key wallet's one address. The key
+// wallet is the second wallet in the list.
+async function openPrivkeyScreen(page) {
+    await visible(page, "#view-main");
+    await page.click('#wallet-list .btn-addr-info[data-wallet="1"]');
+    await visible(page, "#view-address");
+    await page.click("#btn-more-menu");
+    await page.click("#btn-export-privkey");
+    await visible(page, "#view-export-privkey");
+}
+
+async function revealPrivkey(page) {
+    await page.fill("#export-privkey-password", PASSWORD);
+    await page.click("#btn-export-privkey-confirm");
+    await visible(page, "#export-privkey-result", 60000);
+}
+
+// Leave the export screen, or the Settings screen the gear left it for, for
+// Home. The gear put the export screen on the Back stack, so from Settings the
+// way home passes through it, already emptied
+// (https://git.eeqj.de/sneak/AutistMask/issues/461).
+async function leavePrivkeyScreen(page) {
+    if (await page.isVisible("#view-settings")) {
+        await page.click("#btn-settings-back");
+        await visible(page, "#view-export-privkey");
+    }
+    if (await page.isVisible("#view-export-privkey")) {
+        await page.click("#btn-export-privkey-back");
+        await visible(page, "#view-address");
+    }
+    if (await page.isVisible("#view-address")) {
+        await page.click("#btn-address-back");
+    }
+    await visible(page, "#view-main");
+}
+
+test("the correct password reveals the private key, and nothing logs it (#253)", async (env) => {
+    const console_ = [];
+    const listener = (msg) => console_.push(msg.text());
+    env.page.on("console", listener);
+    try {
+        await openPrivkeyScreen(env.page);
+        await revealPrivkey(env.page);
+
+        const st = await secretScreenState(env.page, "export-privkey");
+        assert(
+            st.value === env.privateKey,
+            "the displayed key is not the wallet's private key, verbatim",
+        );
+        const promptShown = await env.page.isVisible(
+            "#export-privkey-password-section",
+        );
+        assert(!promptShown, "the password prompt is still shown after unlock");
+
+        const title = await env.page.getAttribute(
+            "#export-privkey-value",
+            "title",
+        );
+        assert(title === "Click to copy", "the key is not click-to-copy");
+
+        const leaked = console_.filter((line) => line.includes(env.privateKey));
+        assert(
+            leaked.length === 0,
+            "the private key reached the console: " + JSON.stringify(leaked),
+        );
+    } finally {
+        env.page.off("console", listener);
+    }
+});
+
+test("leaving by the settings gear wipes the private key (#253)", async (env) => {
+    await visible(env.page, "#export-privkey-result");
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+    const st = await secretScreenState(env.page, "export-privkey");
+    assertWiped(st, env.privateKey, "after leaving via the settings gear");
+});
+
+// The same interleaving as the recovery phrase case above, and for the same
+// reason: both clicks in one page task, so the leave and its wipe run while
+// the decrypt is still awaited. Reveal stays disabled while the decrypt runs,
+// so reading it after the gear click shows the leave really came mid-decrypt.
+test("leaving while the decrypt is in flight reveals no private key (#253)", async (env) => {
+    try {
+        await leavePrivkeyScreen(env.page);
+        // The second open in this popup session
+        // (https://git.eeqj.de/sneak/AutistMask/issues/460).
+        await openPrivkeyScreen(env.page);
+        await env.page.fill("#export-privkey-password", PASSWORD);
+        const inFlight = await env.page.evaluate(() => {
+            const reveal = document.getElementById(
+                "btn-export-privkey-confirm",
+            );
+            reveal.click();
+            document.getElementById("btn-settings").click();
+            return reveal.disabled;
+        });
+        assert(
+            inFlight,
+            "the decrypt was not running when the screen was left",
+        );
+        await visible(env.page, "#view-settings");
+
+        // Reveal is re-enabled in the same continuation that would have
+        // written the key, so once it is back the decrypt has finished.
+        await env.page.waitForFunction(
+            () =>
+                !document.getElementById("btn-export-privkey-confirm").disabled,
+            null,
+            { timeout: 60000 },
+        );
+
+        const st = await secretScreenState(env.page, "export-privkey");
+        assert(st.viewHidden, "the private key screen is still on top");
+        assertWiped(st, env.privateKey, "after leaving mid-decrypt");
+    } finally {
+        await leavePrivkeyScreen(env.page);
+    }
+});
+
 // ------------------------------- Back after reopening the popup (#268)
 
 // A reopened popup renders the wallet list and the view it restores onto,
@@ -1874,10 +2161,9 @@ function quantity(wei) {
 
 // Wait on the main view until a changed balance fixture has been picked up.
 //
-// Deliberately not a reload: the popup re-refreshes on a 10-second timer by
-// itself, and reloading aborts whatever fetch the home screen has open at
-// that instant, which the extension reports through log.errorf and the
-// harness — correctly — fails the run on.
+// Not a reload: the popup re-refreshes on a 10-second timer by itself, and a
+// reload on the address screen still logs the transaction list it cancels
+// (#475).
 //
 // It also deliberately settles on MAIN rather than on the address screen.
 // The address screen builds the send screen's token dropdown once, from the
@@ -2566,6 +2852,84 @@ test("a token that lies about decimals() at signing time broadcasts nothing (#30
     }
 });
 
+// ------------------------------ the wait for a receipt ending in error (#315)
+//
+// README.md (WaitTx) documents two ways the wait ends on the error screen: a
+// lookup that answers "no receipt" 60 seconds or more after the broadcast, and
+// six lookups in a row that fail. They are different facts with different
+// messages, so each is driven to its own.
+//
+// Both wait in real time, about a minute each. The wait reads the popup's own
+// clock and its own ten-second timer. Playwright's clock would move both, but
+// it is installed on the whole browser context and cannot be removed, so every
+// later test would run on it. Moving the stored broadcast time back instead can
+// be undone by the save the popup makes every ten seconds.
+
+// Send ETH from the address screen and stop on the wait for its receipt.
+async function sendEthToWait(env) {
+    await goToConfirm(env.page, {
+        token: "ETH",
+        balance: FUNDED_ETH_TEXT + " ETH",
+        amount: COMFORTABLE_AMOUNT,
+    });
+    await waitForEstimate(env.page);
+    await fillPasswordAndSend(env.page);
+    await visible(env.page, "#view-wait-tx", 60000);
+}
+
+test("a wait still without a receipt after 60 seconds ends on the timeout message (#315)", async (env) => {
+    try {
+        await sendEthToWait(env);
+        // Lookups run every ten seconds and answer "no receipt", so the one
+        // that ends the wait comes about 60 seconds after the broadcast.
+        await visible(env.page, "#view-error-tx", 90000);
+        const message = (
+            await env.page.locator("#error-tx-message").innerText()
+        ).trim();
+        assert(
+            message ===
+                "Transaction was not confirmed within 60 seconds. It may still confirm later — check Etherscan.",
+            "the wait did not end on the timeout message: " +
+                JSON.stringify(message),
+        );
+        await env.page.click("#btn-error-tx-done");
+        await visible(env.page, "#view-address");
+    } finally {
+        await backToAddressAfterSend(env);
+    }
+});
+
+test("six failed receipt lookups in a row end on the unreachable-network message (#315)", async (env) => {
+    // Each failed lookup is logged through log.errorf, i.e. console.error.
+    // Exactly six are declared: a wait that ended sooner leaves one unmatched,
+    // and one that went on logs a seventh, and either fails this test.
+    for (let i = 1; i <= 6; i++) {
+        env.errors.expect(
+            "failed receipt lookup " + i + " of 6",
+            /poll receipt failed/,
+        );
+    }
+    env.routeOpts.failReceiptLookup = true;
+    try {
+        await sendEthToWait(env);
+        await visible(env.page, "#view-error-tx", 90000);
+        const message = (
+            await env.page.locator("#error-tx-message").innerText()
+        ).trim();
+        assert(
+            message ===
+                "The network could not be reached to check this transaction — 6 lookups failed in a row. Check the RPC URL in Settings. The transaction may still have confirmed — check Etherscan.",
+            "the wait did not end on the unreachable-network message: " +
+                JSON.stringify(message),
+        );
+        await env.page.click("#btn-error-tx-done");
+        await visible(env.page, "#view-address");
+    } finally {
+        env.routeOpts.failReceiptLookup = false;
+        await backToAddressAfterSend(env);
+    }
+});
+
 // ------------------------------------------- hostile token symbol (#307)
 //
 // The reproduction from the issue, in the real browser against the real
@@ -4159,6 +4523,10 @@ async function main() {
         ethBalanceWei: null,
         failGasEstimate: false,
         holdGasEstimate: false,
+        // Whether Blockscout requests are held unanswered, and whether an
+        // address's transaction list fails as a network error (#218).
+        holdBlockscout: false,
+        failTransactionList: false,
         // What decimals() answers for the stub token, when it is to answer
         // something other than the value the same fixture reports through
         // Blockscout. The token that lies about its scale (#305).
@@ -4169,6 +4537,8 @@ async function main() {
         // Whether eth_getTransactionReceipt confirms a transaction rather than
         // answering "not mined yet".
         seedReceipt: false,
+        // Whether eth_getTransactionReceipt fails instead of answering (#315).
+        failReceiptLookup: false,
         // Every raw signed transaction handed to eth_sendRawTransaction, in
         // order. The dApp transaction round trip asserts against these bytes
         // rather than against anything the extension reported about them.
@@ -4201,6 +4571,9 @@ async function main() {
         // The recovery phrase of the wallet created in test 2, so later
         // tests can assert on the real secret rather than its shape.
         phrase: null,
+        // The private key of the key wallet imported by the recovery phrase
+        // tests (#161), asserted on by the private key export tests (#253).
+        privateKey: null,
         // What the Settings section (#229) actually observed. A guard test
         // at the end of that section demands the full set, so a skipped or
         // silently shortened assertion reddens the run instead of shrinking

tests/exportPrivkey.test.js

@@ -58,7 +58,20 @@ function makeElement(id, withParent) {
         remove: () => {},
         querySelectorAll: () => [],
     };
-    el.parentElement = withParent ? makeElement(id + "-parent", false) : null;
+    el.parentElement = null;
+    if (withParent) {
+        // As in a browser, replacing the parent's contents takes this
+        // element out of the document: getElementById no longer finds it.
+        el.parentElement = makeElement(id + "-parent", false);
+        let html = "";
+        Object.defineProperty(el.parentElement, "innerHTML", {
+            get: () => html,
+            set: (value) => {
+                html = value;
+                el.removed = true;
+            },
+        });
+    }
     return el;
 }
 
@@ -70,7 +83,8 @@ function makeDocument() {
             // is the state a non-debug, non-testnet popup is in.
             if (id === "debug-banner") return null;
             if (!els.has(id)) els.set(id, makeElement(id, true));
-            return els.get(id);
+            const el = els.get(id);
+            return el.removed ? null : el;
         },
         createElement: () => makeElement("created", false),
         addEventListener: () => {},
@@ -300,6 +314,28 @@ describe("leaving the screen after the key is on it", () => {
     });
 });
 
+describe("opening the screen again in the same popup session", () => {
+    // https://git.eeqj.de/sneak/AutistMask/issues/460: show() found the
+    // address line through an element inside it, which its own rendering
+    // deleted, so the second open threw before it navigated.
+    test("shows it for the address chosen the second time", async () => {
+        const { state, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+        await click("btn-export-privkey-back");
+        expect(state.currentView).toBe("address");
+
+        exportPrivkey.show(0, 1);
+
+        expect(state.currentView).toBe(VIEW);
+        expect(node("export-privkey-title").textContent).toBe(
+            "Wallet 1 — Address 2",
+        );
+        expect(node("export-privkey-address").innerHTML).toContain(
+            "0x" + "22".repeat(20),
+        );
+    });
+});
+
 describe("views the popup may reopen onto", () => {
     // Restoring onto this screen would put a private key on display with no
     // password prompt in front of it, on a popup reopened by accident.

tests/manifest.test.js

@@ -21,15 +21,14 @@
 // escaping in src/shared/html.js is the primary fix; default-src is what
 // stops the next escape that slips from reaching the network.
 //
-// Every directive below is pinned exactly, because each of the four
+// And for #328: style-src is 'self' alone, so the browser refuses every
+// style="..." attribute in the popup's markup, including one an escape lets
+// through. The popup styles with classes; script setting element.style is
+// not affected.
+//
+// Every directive below is pinned exactly, because each of the three
 // loosenings is load-bearing and none of them may grow:
 //
-//   style-src 'unsafe-inline'  src/popup/index.html and the view helpers
-//                              use style="..." attributes throughout, which
-//                              CSP blocks without it. Chrome enforces this
-//                              on attributes, not just <style> blocks, and
-//                              Firefox has never implemented style-src-attr,
-//                              so there is no narrower spelling available.
 //   img-src data:              blockies are data: PNGs assigned to img.src.
 //   connect-src https: http:   the RPC endpoint is user-configurable, and a
 //                              local node over http://127.0.0.1 is a
@@ -58,7 +57,7 @@ const EXPECTED_DIRECTIVES = {
     "default-src": ["'self'"],
     "script-src": ["'self'", "'wasm-unsafe-eval'"],
     "object-src": ["'self'"],
-    "style-src": ["'self'", "'unsafe-inline'"],
+    "style-src": ["'self'"],
     "img-src": ["'self'", "data:"],
     "connect-src": ["'self'", "http:", "https:"],
     "frame-src": ["'none'"],

tests/phishingDomains.test.js

@@ -45,9 +45,9 @@ describe("vendored blocklist", () => {
         // than loudly, so the ordering the search depends on is asserted here
         // against the committed file rather than assumed of the generator.
         // One assertion at the end rather than one per entry: 100k+ expect()
-        // calls cost seconds, and make test is capped at 30 for the whole
-        // suite. The index of the first offender is reported, so a failure
-        // still says where.
+        // calls cost seconds, and make test is capped at 60 seconds for the
+        // whole suite. The index of the first offender is reported, so a
+        // failure still says where.
         let previous = "";
         let outOfOrderAt = -1;
         for (let i = 0; i < vendored.count; i++) {

tests/proxyMethods.test.js

@@ -0,0 +1,89 @@
+// Every method in PROXY_METHODS is sent to the RPC node.
+//
+// handleRpc answers some methods itself before it reaches its proxy branch. A
+// method listed in PROXY_METHODS but answered earlier never reaches the node,
+// so the list would name a method that is not proxied
+// (https://git.eeqj.de/sneak/AutistMask/issues/326). Each method is sent from
+// a page here and must come back with what the node answered.
+
+const { makeStorageStub } = require("./support/storageStub");
+
+async function settle() {
+    for (let i = 0; i < 50; i++) await Promise.resolve();
+}
+
+afterEach(() => {
+    delete global.chrome;
+    delete global.fetch;
+});
+
+test("every method in PROXY_METHODS reaches the RPC node", async () => {
+    jest.resetModules();
+
+    jest.doMock("../src/shared/balances", () => ({
+        getProvider: () => ({}),
+        refreshBalances: jest.fn(async () => {}),
+    }));
+    jest.doMock("../src/shared/phishingDomains", () => ({
+        isPhishingDomain: () => false,
+    }));
+    jest.doMock("../src/shared/alarms", () => ({
+        BALANCE_REFRESH_ALARM: "balance",
+        BALANCE_REFRESH_PERIOD_MINUTES: 1,
+        ensureRecurringAlarms: jest.fn(async () => {}),
+        registerAlarmHandlers: jest.fn(),
+    }));
+
+    // The node answers each method with a value naming that method.
+    global.fetch = jest.fn(async (url, opts) => ({
+        status: 200,
+        json: async () => ({
+            jsonrpc: "2.0",
+            id: 1,
+            result: "node answered " + JSON.parse(opts.body).method,
+        }),
+    }));
+
+    let messageListener = null;
+    global.chrome = {
+        storage: makeStorageStub({
+            autistmask: {
+                networkId: "mainnet",
+                wallets: [],
+                allowedSites: {},
+                deniedSites: {},
+            },
+        }),
+        runtime: {
+            getURL: (path) => "chrome-extension://autistmask/" + path,
+            onMessage: {
+                addListener: (fn) => {
+                    messageListener = fn;
+                },
+            },
+            onConnect: { addListener: () => {} },
+            lastError: null,
+        },
+        windows: { onRemoved: { addListener: () => {} } },
+        action: { setPopup: () => {} },
+    };
+
+    const { PROXY_METHODS } = require("../src/background/index");
+
+    const answers = {};
+    const expected = {};
+    for (const method of PROXY_METHODS) {
+        messageListener(
+            { type: "AUTISTMASK_RPC", method, params: [] },
+            { origin: "https://dapp.example" },
+            (r) => {
+                answers[method] = r;
+            },
+        );
+        await settle();
+        expected[method] = { result: "node answered " + method };
+    }
+
+    expect(PROXY_METHODS.length).toBeGreaterThan(0);
+    expect(answers).toEqual(expected);
+});

tests/vault.test.js

@@ -12,8 +12,8 @@
 // interactive parameters, which the module hardcodes. The parameters are not
 // weakened or overridden anywhere in this file — they are pinned by the "key
 // derivation cost" tests, since they are the vault's only defence against an
-// offline attack on a stolen blob. The suite is kept inside script/test's
-// 30-second budget by sharing one encrypted fixture across the tamper cases
+// offline attack on a stolen blob. The suite is kept inside the 60-second
+// make test cap by sharing one encrypted fixture across the tamper cases
 // instead of re-encrypting per test.
 
 const sodium = require("libsodium-wrappers-sumo");

tests/walletDefects.test.js

@@ -4,8 +4,16 @@
 // already in storage: the import that created it ran before the refusal
 // existed. Such a wallet used to sign for the wrong tree and now throws on the
 // send screen instead. These tests pin down that it is named and explained in
-// the wallet list, that nothing on the way there throws, and that a wallet
-// imported from a real master key is untouched by any of it.
+// the wallet list, that every control leading to a signature or to the private
+// key refuses it before asking for a password, that nothing on the way there
+// throws, and that a wallet imported from a real master key is untouched by
+// any of it.
+
+// Mocked so that no password has to be hashed: the controls below are checked
+// for whether they decrypt at all.
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+}));
 
 const { HDNodeWallet, Mnemonic } = require("ethers");
 
@@ -237,6 +245,290 @@ describe("the wallet list", () => {
     });
 });
 
+// A minimal DOM for driving the popup views: any element exists on first
+// lookup, and click() runs the listeners a view attached to it.
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        title: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        addEventListener: () => {},
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+function click(id) {
+    return Promise.all((node(id).listeners.click || []).map((fn) => fn()));
+}
+
+// getSignerForAddress refuses this wallet's key, but only once the password
+// has been typed and spent, and the screens report that refusal as a wrong
+// password or a failed send. So every control that leads to it refuses first.
+describe("every way to a signature or the private key refuses a defective wallet first", () => {
+    const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+    let state;
+    let decryptWithPassword;
+    let home;
+    let addressDetail;
+    let addressToken;
+    let approval;
+    let confirmTx;
+
+    let address;
+    let shortMessage;
+    // What the background answers when the approval window asks which
+    // approval it was opened for, and every message the popup sent it.
+    let approvalDetails;
+    let sent;
+
+    beforeAll(() => {
+        state = require("../src/shared/state").state;
+        decryptWithPassword =
+            require("../src/shared/vault").decryptWithPassword;
+        home = require("../src/popup/views/home");
+        addressDetail = require("../src/popup/views/addressDetail");
+        addressToken = require("../src/popup/views/addressToken");
+        approval = require("../src/popup/views/approval");
+        confirmTx = require("../src/popup/views/confirmTx");
+    });
+
+    beforeEach(() => {
+        const broken = brokenXprvWallet();
+        // A balance, so that no Send button's zero-balance refusal can stand
+        // in for the defect check.
+        broken.addresses[0].balance = "1.0000";
+        broken.addresses[0].tokenBalances = [];
+        address = broken.addresses[0].address;
+        shortMessage = walletDefect(broken).shortMessage;
+
+        approvalDetails = null;
+        sent = [];
+        globalThis.document = makeDocument();
+        globalThis.window = { close: () => {} };
+        globalThis.chrome = {
+            storage: { local: { get: async () => ({}), set: async () => {} } },
+            runtime: {
+                connect: () => ({ postMessage: () => {} }),
+                sendMessage: (msg, reply) => {
+                    sent.push(msg);
+                    if (!reply) return;
+                    reply(
+                        msg.type === "AUTISTMASK_GET_APPROVAL"
+                            ? approvalDetails
+                            : null,
+                    );
+                },
+            },
+        };
+        // What the wallet's stored secret decrypts to: the account-level key
+        // it was imported from.
+        decryptWithPassword.mockReset();
+        decryptWithPassword.mockResolvedValue(accountXprv(VECTOR_PHRASE));
+
+        state.wallets = [broken];
+        state.activeAddress = address;
+        state.selectedWallet = 0;
+        state.selectedAddress = 0;
+        state.selectedToken = "ETH";
+        state.viewStack = [];
+    });
+
+    afterEach(() => {
+        state.wallets = [];
+        state.activeAddress = null;
+        state.selectedWallet = null;
+        state.selectedAddress = null;
+        state.selectedToken = null;
+    });
+
+    test("Send on the main screen", async () => {
+        state.currentView = "main";
+        home.init({});
+
+        await click("btn-main-send");
+
+        expect(node("flash-msg").textContent).toBe(shortMessage);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("Send on the address screen", async () => {
+        state.currentView = "address";
+        addressDetail.init({});
+
+        await click("btn-send");
+
+        expect(node("flash-msg").textContent).toBe(shortMessage);
+        expect(state.currentView).toBe("address");
+    });
+
+    test("Export Private Key on the address screen", async () => {
+        state.currentView = "address";
+        addressDetail.init({});
+
+        await click("btn-export-privkey");
+
+        expect(node("flash-msg").textContent).toBe(shortMessage);
+        expect(state.currentView).toBe("address");
+    });
+
+    test("Send on a token's screen", async () => {
+        state.currentView = "address-token";
+        addressToken.init({});
+
+        await click("btn-address-token-send");
+
+        expect(node("flash-msg").textContent).toBe(shortMessage);
+        expect(state.currentView).toBe("address-token");
+    });
+
+    // The popup reopens onto this screen from a saved view, so the Send
+    // buttons above are not the only way onto it. The screen is not drawn,
+    // because drawing it starts a fee estimate against the network; with a
+    // decrypt that fails, a handler without the check stops at the password
+    // instead of going on to a transaction that was never set up.
+    test("Send on the confirmation screen", async () => {
+        decryptWithPassword.mockRejectedValue(new Error("wrong password"));
+        state.currentView = "confirm-tx";
+        confirmTx.init({});
+        node("confirm-tx-password").value = "any password";
+
+        await click("btn-confirm-send");
+
+        expect(decryptWithPassword).not.toHaveBeenCalled();
+        expect(node("confirm-tx-password-error").textContent).toBe(
+            shortMessage,
+        );
+    });
+
+    async function openTxApproval() {
+        approvalDetails = {
+            type: "tx",
+            origin: "https://dapp.example",
+            isPhishingDomain: false,
+            approvedFrom: address,
+            approvedTx: {
+                from: address,
+                to: RECIPIENT,
+                value: "0x0",
+                data: "0x",
+                chainId: 1,
+                nonce: 0,
+                gasLimit: "21000",
+                maxFeePerGas: "1000000000",
+            },
+        };
+        approval.init({});
+        await approval.show(1);
+    }
+
+    async function openSignApproval() {
+        approvalDetails = {
+            type: "sign",
+            origin: "https://dapp.example",
+            isPhishingDomain: false,
+            approvedFrom: address,
+            // "Hello", as the hex a page sends.
+            signParams: {
+                method: "personal_sign",
+                message: "0x48656c6c6f",
+                from: address,
+            },
+        };
+        approval.init({});
+        await approval.show(1);
+    }
+
+    test("the transaction approval screen says so and disables Approve", async () => {
+        await openTxApproval();
+
+        expect(node("approve-tx-error").textContent).toBe(shortMessage);
+        expect(node("btn-approve-tx").disabled).toBe(true);
+    });
+
+    // The stub runs a disabled button's listener, which a browser would not:
+    // what is asked here is whether the handler refuses on its own.
+    test("Approve on the transaction approval screen does not decrypt", async () => {
+        await openTxApproval();
+        node("approve-tx-password").value = "any password";
+
+        await click("btn-approve-tx");
+
+        expect(decryptWithPassword).not.toHaveBeenCalled();
+        expect(sent.map((msg) => msg.type)).not.toContain(
+            "AUTISTMASK_TX_RESPONSE",
+        );
+        expect(node("approve-tx-error").textContent).toBe(shortMessage);
+    });
+
+    test("the signature approval screen says so and disables Approve", async () => {
+        await openSignApproval();
+
+        expect(node("approve-sign-error").textContent).toBe(shortMessage);
+        expect(node("btn-approve-sign").disabled).toBe(true);
+    });
+
+    test("Approve on the signature approval screen does not decrypt", async () => {
+        await openSignApproval();
+        node("approve-sign-password").value = "any password";
+
+        await click("btn-approve-sign");
+
+        expect(decryptWithPassword).not.toHaveBeenCalled();
+        expect(sent.map((msg) => msg.type)).not.toContain(
+            "AUTISTMASK_SIGN_RESPONSE",
+        );
+        expect(node("approve-sign-error").textContent).toBe(shortMessage);
+    });
+});
+
 describe("no path throws an unhandled error for a defective wallet", () => {
     test("address derivation from the stored xpub still works", () => {
         // The stored xpub is at a non-standard depth but is a valid extended

yarn.lock

@@ -275,7 +275,15 @@
   resolved "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz"
   integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==
 
-"@emnapi/core@^1.4.3", "@emnapi/core@^1.7.1", "@emnapi/core@^1.8.1":
+"@emnapi/core@^1.10.0":
+  version "1.11.3"
+  resolved "https://registry.yarnpkg.com/@emnapi/core/-/core-1.11.3.tgz#5e95348a42cd1e06f0b9aa380cd74091daa4d520"
+  integrity sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg==
+  dependencies:
+    "@emnapi/wasi-threads" "1.2.3"
+    tslib "^2.4.0"
+
+"@emnapi/core@^1.4.3":
   version "1.8.1"
   resolved "https://registry.yarnpkg.com/@emnapi/core/-/core-1.8.1.tgz#fd9efe721a616288345ffee17a1f26ac5dd01349"
   integrity sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg==
@@ -283,20 +291,34 @@
     "@emnapi/wasi-threads" "1.1.0"
     tslib "^2.4.0"
 
-"@emnapi/runtime@^1.4.3", "@emnapi/runtime@^1.7.1", "@emnapi/runtime@^1.8.1":
+"@emnapi/runtime@^1.10.0":
+  version "1.11.3"
+  resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.11.3.tgz#84257ae3b0531eb2aec1ffa23d70700da007ba95"
+  integrity sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==
+  dependencies:
+    tslib "^2.4.0"
+
+"@emnapi/runtime@^1.4.3":
   version "1.8.1"
   resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.8.1.tgz#550fa7e3c0d49c5fb175a116e8cd70614f9a22a5"
   integrity sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==
   dependencies:
     tslib "^2.4.0"
 
-"@emnapi/wasi-threads@1.1.0", "@emnapi/wasi-threads@^1.1.0":
+"@emnapi/wasi-threads@1.1.0":
   version "1.1.0"
   resolved "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz"
   integrity sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==
   dependencies:
     tslib "^2.4.0"
 
+"@emnapi/wasi-threads@1.2.3", "@emnapi/wasi-threads@^1.2.1":
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/@emnapi/wasi-threads/-/wasi-threads-1.2.3.tgz#c9bf72fd4be5b928aee894820e8d814ed73916e9"
+  integrity sha512-ELEBe8PsLvvJ6QMr0zLt8ffvOHW/dc1m3CEzNMg7aJUv3bMaoDtw2TXyDAwkYBuroxxuHEwhRTLJSe5sya547g==
+  dependencies:
+    tslib "^2.4.0"
+
 "@esbuild/aix-ppc64@0.27.3":
   version "0.27.3"
   resolved "https://registry.yarnpkg.com/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz#815b39267f9bffd3407ea6c376ac32946e24f8d2"
@@ -802,14 +824,12 @@
     "@emnapi/runtime" "^1.4.3"
     "@tybys/wasm-util" "^0.10.0"
 
-"@napi-rs/wasm-runtime@^1.1.1":
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.1.tgz#c3705ab549d176b8dc5172723d6156c3dc426af2"
-  integrity sha512-p64ah1M1ld8xjWv3qbvFwHiFVWrq1yFvV4f7w+mzaqiR4IlSgkqhcRdHwsGgomwzBH51sRY4NEowLxnaBjcW/A==
+"@napi-rs/wasm-runtime@^1.1.4":
+  version "1.2.5"
+  resolved "https://registry.yarnpkg.com/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.5.tgz#8c728c07e2543d80e55ccb34158c4ae9d6bd13e8"
+  integrity sha512-HshSvXzmBxNzqejd3k/KemgQ3hdREUYFRRrgxOZ+gPljDIsO2SDZrVZMd4Z/HsxudQbE62OVyVFE8z9BCurfjA==
   dependencies:
-    "@emnapi/core" "^1.7.1"
-    "@emnapi/runtime" "^1.7.1"
-    "@tybys/wasm-util" "^0.10.1"
+    "@tybys/wasm-util" "^0.10.3"
 
 "@noble/curves@1.2.0":
   version "1.2.0"
@@ -823,94 +843,94 @@
   resolved "https://registry.npmjs.org/@noble/hashes/-/hashes-1.3.2.tgz"
   integrity sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ==
 
-"@parcel/watcher-android-arm64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.6.tgz#5f32e0dba356f4ac9a11068d2a5c134ca3ba6564"
-  integrity sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A==
+"@parcel/watcher-android-arm64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.1.tgz#507f836d7e2042f798c7d07ad19c3546f9848ac1"
+  integrity sha512-KF8+j9nNbUN8vzOFDpRMsaKBHZ/mcjEjMToVMJOhTozkDonQFFrRcfdLWn6yWKCmJKmdVxSgHiYvTCef4/qcBA==
 
-"@parcel/watcher-darwin-arm64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.6.tgz"
-  integrity sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA==
+"@parcel/watcher-darwin-arm64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.1.tgz#3d26dce38de6590ef79c47ec2c55793c06ad4f67"
+  integrity sha512-eAzPv5osDmZyBhou8PoF4i6RQXAfeKL9tjb3QzYuccXFMQU0ruIc/POh30ePnaOyD1UXdlKguHBmsTs53tVoPw==
 
-"@parcel/watcher-darwin-x64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.6.tgz#bf05d76a78bc15974f15ec3671848698b0838063"
-  integrity sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg==
+"@parcel/watcher-darwin-x64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.1.tgz#99f3af3869069ccf774e4ddfccf7e64fd2311ef8"
+  integrity sha512-1ZXDthrnNmwv10A0/3AJNZ9JGlzrF82i3gNQcWOzd7nJ8aj+ILyW1MTxVk35Db0u91oD5Nlk9MBiujMlwmeXZg==
 
-"@parcel/watcher-freebsd-x64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.6.tgz#8bc26e9848e7303ac82922a5ae1b1ef1bdb48a53"
-  integrity sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng==
+"@parcel/watcher-freebsd-x64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.1.tgz#14d6857741a9f51dfe51d5b08b7c8afdbc73ad9b"
+  integrity sha512-SI4eljM7Flp9yPuKi8W0ird8TI/JK6CSxju3NojVI6BjHsTyK7zxA9urjVjEKJ5MBYC+bLmMcbAWlZ+rFkLpJQ==
 
-"@parcel/watcher-linux-arm-glibc@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.6.tgz#1328fee1deb0c2d7865079ef53a2ba4cc2f8b40a"
-  integrity sha512-9JiYfB6h6BgV50CCfasfLf/uvOcJskMSwcdH1PHH9rvS1IrNy8zad6IUVPVUfmXr+u+Km9IxcfMLzgdOudz9EQ==
+"@parcel/watcher-linux-arm-glibc@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.1.tgz#43c3246d6892381db473bb4f663229ad20b609a1"
+  integrity sha512-RCdZlEyTs8geyBkkcnPWvtXLY44BCeZKmGYRtSgtwwnHR4dxfHRG3gR99XdMEdQ7KeiDdasJwwvNSF5jKtDwdA==
 
-"@parcel/watcher-linux-arm-musl@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.6.tgz#bad0f45cb3e2157746db8b9d22db6a125711f152"
-  integrity sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==
+"@parcel/watcher-linux-arm-musl@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.1.tgz#663750f7090bb6278d2210de643eb8a3f780d08e"
+  integrity sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==
 
-"@parcel/watcher-linux-arm64-glibc@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.6.tgz#b75913fbd501d9523c5f35d420957bf7d0204809"
-  integrity sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==
+"@parcel/watcher-linux-arm64-glibc@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.1.tgz#ba60e1f56977f7e47cd7e31ad65d15fdcbd07e30"
+  integrity sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==
 
-"@parcel/watcher-linux-arm64-musl@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.6.tgz#da5621a6a576070c8c0de60dea8b46dc9c3827d4"
-  integrity sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==
+"@parcel/watcher-linux-arm64-musl@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.1.tgz#f7fbcdff2f04c526f96eac01f97419a6a99855d2"
+  integrity sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==
 
-"@parcel/watcher-linux-x64-glibc@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.6.tgz#ce437accdc4b30f93a090b4a221fd95cd9b89639"
-  integrity sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==
+"@parcel/watcher-linux-x64-glibc@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.1.tgz#4d2ea0f633eb1917d83d483392ce6181b6a92e4e"
+  integrity sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==
 
-"@parcel/watcher-linux-x64-musl@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.6.tgz#02400c54b4a67efcc7e2327b249711920ac969e2"
-  integrity sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==
+"@parcel/watcher-linux-x64-musl@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.1.tgz#277b346b05db54f55657301dd77bdf99d63606ee"
+  integrity sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==
 
-"@parcel/watcher-win32-arm64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.6.tgz#caae3d3c7583ca0a7171e6bd142c34d20ea1691e"
-  integrity sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==
+"@parcel/watcher-win32-arm64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.1.tgz#7e9e02a26784d47503de1d10e8eab6cceb524243"
+  integrity sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==
 
-"@parcel/watcher-win32-ia32@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.6.tgz#9ac922550896dfe47bfc5ae3be4f1bcaf8155d6d"
-  integrity sha512-k35yLp1ZMwwee3Ez/pxBi5cf4AoBKYXj00CZ80jUz5h8prpiaQsiRPKQMxoLstNuqe2vR4RNPEAEcjEFzhEz/g==
+"@parcel/watcher-win32-ia32@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.1.tgz#2d0f94fa59a873cdc584bf7f6b1dc628ddf976e6"
+  integrity sha512-c2KkcVN+NJmuA7CGlaGD1qJh1cLfDnQsHjE89E60vUEMlqduHGCdCLJCID5geFVM0dOtA3ZiIO8BoEQmzQVfpQ==
 
-"@parcel/watcher-win32-x64@2.5.6":
-  version "2.5.6"
-  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.6.tgz#73fdafba2e21c448f0e456bbe13178d8fe11739d"
-  integrity sha512-hbQlYcCq5dlAX9Qx+kFb0FHue6vbjlf0FrNzSKdYK2APUf7tGfGxQCk2ihEREmbR6ZMc0MVAD5RIX/41gpUzTw==
+"@parcel/watcher-win32-x64@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.1.tgz#ae52693259664ba6f2228fa61d7ee44b64ea0947"
+  integrity sha512-9lHBdJITeNR++EvSQVUcaZoWupyHfXe1jZvGZ06O/5MflPcuPLtEphScIBL+AiCWBO46tDSHzWyD0uDmmZqsgA==
 
-"@parcel/watcher@^2.5.1":
-  version "2.5.6"
-  resolved "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz"
-  integrity sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==
+"@parcel/watcher@2.5.1":
+  version "2.5.1"
+  resolved "https://registry.yarnpkg.com/@parcel/watcher/-/watcher-2.5.1.tgz#342507a9cfaaf172479a882309def1e991fb1200"
+  integrity sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==
   dependencies:
-    detect-libc "^2.0.3"
+    detect-libc "^1.0.3"
     is-glob "^4.0.3"
+    micromatch "^4.0.5"
     node-addon-api "^7.0.0"
-    picomatch "^4.0.3"
   optionalDependencies:
-    "@parcel/watcher-android-arm64" "2.5.6"
-    "@parcel/watcher-darwin-arm64" "2.5.6"
-    "@parcel/watcher-darwin-x64" "2.5.6"
-    "@parcel/watcher-freebsd-x64" "2.5.6"
-    "@parcel/watcher-linux-arm-glibc" "2.5.6"
-    "@parcel/watcher-linux-arm-musl" "2.5.6"
-    "@parcel/watcher-linux-arm64-glibc" "2.5.6"
-    "@parcel/watcher-linux-arm64-musl" "2.5.6"
-    "@parcel/watcher-linux-x64-glibc" "2.5.6"
-    "@parcel/watcher-linux-x64-musl" "2.5.6"
-    "@parcel/watcher-win32-arm64" "2.5.6"
-    "@parcel/watcher-win32-ia32" "2.5.6"
-    "@parcel/watcher-win32-x64" "2.5.6"
+    "@parcel/watcher-android-arm64" "2.5.1"
+    "@parcel/watcher-darwin-arm64" "2.5.1"
+    "@parcel/watcher-darwin-x64" "2.5.1"
+    "@parcel/watcher-freebsd-x64" "2.5.1"
+    "@parcel/watcher-linux-arm-glibc" "2.5.1"
+    "@parcel/watcher-linux-arm-musl" "2.5.1"
+    "@parcel/watcher-linux-arm64-glibc" "2.5.1"
+    "@parcel/watcher-linux-arm64-musl" "2.5.1"
+    "@parcel/watcher-linux-x64-glibc" "2.5.1"
+    "@parcel/watcher-linux-x64-musl" "2.5.1"
+    "@parcel/watcher-win32-arm64" "2.5.1"
+    "@parcel/watcher-win32-ia32" "2.5.1"
+    "@parcel/watcher-win32-x64" "2.5.1"
 
 "@pkgjs/parseargs@^0.11.0":
   version "0.11.0"
@@ -941,124 +961,131 @@
   dependencies:
     "@sinonjs/commons" "^3.0.1"
 
-"@tailwindcss/cli@^4.2.1":
-  version "4.2.1"
-  resolved "https://registry.npmjs.org/@tailwindcss/cli/-/cli-4.2.1.tgz"
-  integrity sha512-b7MGn51IA80oSG+7fuAgzfQ+7pZBgjzbqwmiv6NO7/+a1sev32cGqnwhscT7h0EcAvMa9r7gjRylqOH8Xhc4DA==
+"@tailwindcss/cli@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/cli/-/cli-4.3.1.tgz#bc00e49e2b70baad223969071e4e380da7123afe"
+  integrity sha512-ZWPy20rF+TBfTImxDMG3Wr75Y3RpaPlo9lc+oJbInlMyjT+XPkTVKVIL5RZ7JirXuIahcfHoLNFRmDorKi+JQQ==
   dependencies:
-    "@parcel/watcher" "^2.5.1"
-    "@tailwindcss/node" "4.2.1"
-    "@tailwindcss/oxide" "4.2.1"
-    enhanced-resolve "^5.19.0"
+    "@parcel/watcher" "2.5.1"
+    "@tailwindcss/node" "4.3.1"
+    "@tailwindcss/oxide" "4.3.1"
+    enhanced-resolve "5.21.6"
     mri "^1.2.0"
     picocolors "^1.1.1"
-    tailwindcss "4.2.1"
+    tailwindcss "4.3.1"
 
-"@tailwindcss/node@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.npmjs.org/@tailwindcss/node/-/node-4.2.1.tgz"
-  integrity sha512-jlx6sLk4EOwO6hHe1oCGm1Q4AN/s0rSrTTPBGPM0/RQ6Uylwq17FuU8IeJJKEjtc6K6O07zsvP+gDO6MMWo7pg==
+"@tailwindcss/node@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/node/-/node-4.3.1.tgz#77402afcfa29c4b48b8494d0edfc4428d0a504ba"
+  integrity sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==
   dependencies:
     "@jridgewell/remapping" "^2.3.5"
-    enhanced-resolve "^5.19.0"
-    jiti "^2.6.1"
-    lightningcss "1.31.1"
+    enhanced-resolve "5.21.6"
+    jiti "^2.7.0"
+    lightningcss "1.32.0"
     magic-string "^0.30.21"
     source-map-js "^1.2.1"
-    tailwindcss "4.2.1"
+    tailwindcss "4.3.1"
 
-"@tailwindcss/oxide-android-arm64@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.2.1.tgz#a7c24919b607e7f884e6ab97799d12c7fb5b47bd"
-  integrity sha512-eZ7G1Zm5EC8OOKaesIKuw77jw++QJ2lL9N+dDpdQiAB/c/B2wDh0QPFHbkBVrXnwNugvrbJFk1gK2SsVjwWReg==
+"@tailwindcss/oxide-android-arm64@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz#83c6762cd383a2ebc6e01897b0f35f19225e6653"
+  integrity sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==
 
-"@tailwindcss/oxide-darwin-arm64@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.2.1.tgz"
-  integrity sha512-q/LHkOstoJ7pI1J0q6djesLzRvQSIfEto148ppAd+BVQK0JYjQIFSK3JgYZJa+Yzi0DDa52ZsQx2rqytBnf8Hw==
+"@tailwindcss/oxide-darwin-arm64@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz#2558b7e835889ad721823e4dcb50dd5071d747d8"
+  integrity sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==
 
-"@tailwindcss/oxide-darwin-x64@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.2.1.tgz#1e59ef0665f6cb9e658bf0ebcb3cb50f21b2c175"
-  integrity sha512-/f/ozlaXGY6QLbpvd/kFTro2l18f7dHKpB+ieXz+Cijl4Mt9AI2rTrpq7V+t04nK+j9XBQHnSMdeQRhbGyt6fw==
+"@tailwindcss/oxide-darwin-x64@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz#d987957b87a26668b6d0117ccd4a8a4d1a318a2b"
+  integrity sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==
 
-"@tailwindcss/oxide-freebsd-x64@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.2.1.tgz#6b0c75e9dac7f1a241cb9a5eaa89f0d9664835b6"
-  integrity sha512-5e/AkgYJT/cpbkys/OU2Ei2jdETCLlifwm7ogMC7/hksI2fC3iiq6OcXwjibcIjPung0kRtR3TxEITkqgn0TcA==
+"@tailwindcss/oxide-freebsd-x64@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz#75b342c81a07b1afa437976ec82f86d372431da7"
+  integrity sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==
 
-"@tailwindcss/oxide-linux-arm-gnueabihf@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.2.1.tgz#717044d8fe746b1f0760485946c0c9a900174f7b"
-  integrity sha512-Uny1EcVTTmerCKt/1ZuKTkb0x8ZaiuYucg2/kImO5A5Y/kBz41/+j0gxUZl+hTF3xkWpDmHX+TaWhOtba2Fyuw==
+"@tailwindcss/oxide-linux-arm-gnueabihf@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz#6730adc6d17187eeeff2f14f6a914d009749cb97"
+  integrity sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==
 
-"@tailwindcss/oxide-linux-arm64-gnu@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.2.1.tgz#f544b0faf166d80791347911b2dd4372a893129d"
-  integrity sha512-CTrwomI+c7n6aSSQlsPL0roRiNMDQ/YzMD9EjcR+H4f0I1SQ8QqIuPnsVp7QgMkC1Qi8rtkekLkOFjo7OlEFRQ==
+"@tailwindcss/oxide-linux-arm64-gnu@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz#869d16b3d9bd8097b797a3dd876db0368c07eae3"
+  integrity sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==
 
-"@tailwindcss/oxide-linux-arm64-musl@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.2.1.tgz#9fbaf8dc00b858a2b955526abb15d88f5678d1ef"
-  integrity sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==
+"@tailwindcss/oxide-linux-arm64-musl@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz#ab110680ce3c7a2a135656db4402dffc1fb9c1d7"
+  integrity sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==
 
-"@tailwindcss/oxide-linux-x64-gnu@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.2.1.tgz#6ab4e6b8d308d037a1155b8443df5941dbfa6aa1"
-  integrity sha512-qMFzxI2YlBOLW5PhblzuSWlWfwLHaneBE0xHzLrBgNtqN6mWfs+qYbhryGSXQjFYB1Dzf5w+LN5qbUTPhW7Y5g==
+"@tailwindcss/oxide-linux-x64-gnu@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz#422a4175a76ae60dd9d17946eec3584cb636352f"
+  integrity sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==
 
-"@tailwindcss/oxide-linux-x64-musl@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.2.1.tgz#52c55593394dff85f1fa88172f69f8fdcde182b6"
-  integrity sha512-5r1X2FKnCMUPlXTWRYpHdPYUY6a1Ar/t7P24OuiEdEOmms5lyqjDRvVY1yy9Rmioh+AunQ0rWiOTPE8F9A3v5g==
+"@tailwindcss/oxide-linux-x64-musl@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz#f4c714a653a0e742955d2af2c53d0064b4c500d1"
+  integrity sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==
 
-"@tailwindcss/oxide-wasm32-wasi@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.2.1.tgz#7401e35f881d3654b6180badd1243d75a2702ea5"
-  integrity sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==
+"@tailwindcss/oxide-wasm32-wasi@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz#32172ca8b2427b9c2bb09c97756960185b7d4fc0"
+  integrity sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==
   dependencies:
-    "@emnapi/core" "^1.8.1"
-    "@emnapi/runtime" "^1.8.1"
-    "@emnapi/wasi-threads" "^1.1.0"
-    "@napi-rs/wasm-runtime" "^1.1.1"
-    "@tybys/wasm-util" "^0.10.1"
+    "@emnapi/core" "^1.10.0"
+    "@emnapi/runtime" "^1.10.0"
+    "@emnapi/wasi-threads" "^1.2.1"
+    "@napi-rs/wasm-runtime" "^1.1.4"
+    "@tybys/wasm-util" "^0.10.2"
     tslib "^2.8.1"
 
-"@tailwindcss/oxide-win32-arm64-msvc@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.2.1.tgz#63a502e7b696dcd976aa356b94ce0f4f8f832c44"
-  integrity sha512-YlUEHRHBGnCMh4Nj4GnqQyBtsshUPdiNroZj8VPkvTZSoHsilRCwXcVKnG9kyi0ZFAS/3u+qKHBdDc81SADTRA==
+"@tailwindcss/oxide-win32-arm64-msvc@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz#07a11b6eb1f578d012460e6ad6f2352a28d32514"
+  integrity sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==
 
-"@tailwindcss/oxide-win32-x64-msvc@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.2.1.tgz#8cc59b28ebc4dc866c0c14d7057f07f0ed04c4a8"
-  integrity sha512-rbO34G5sMWWyrN/idLeVxAZgAKWrn5LiR3/I90Q9MkA67s6T1oB0xtTe+0heoBvHSpbU9Mk7i6uwJnpo4u21XQ==
+"@tailwindcss/oxide-win32-x64-msvc@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz#60c6095d97b141c02de36bb52a16c358d9bdaa98"
+  integrity sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==
 
-"@tailwindcss/oxide@4.2.1":
-  version "4.2.1"
-  resolved "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.2.1.tgz"
-  integrity sha512-yv9jeEFWnjKCI6/T3Oq50yQEOqmpmpfzG1hcZsAOaXFQPfzWprWrlHSdGPEF3WQTi8zu8ohC9Mh9J470nT5pUw==
+"@tailwindcss/oxide@4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@tailwindcss/oxide/-/oxide-4.3.1.tgz#6fdd28b3abf785e2c2cac31f52c4755875826828"
+  integrity sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==
   optionalDependencies:
-    "@tailwindcss/oxide-android-arm64" "4.2.1"
-    "@tailwindcss/oxide-darwin-arm64" "4.2.1"
-    "@tailwindcss/oxide-darwin-x64" "4.2.1"
-    "@tailwindcss/oxide-freebsd-x64" "4.2.1"
-    "@tailwindcss/oxide-linux-arm-gnueabihf" "4.2.1"
-    "@tailwindcss/oxide-linux-arm64-gnu" "4.2.1"
-    "@tailwindcss/oxide-linux-arm64-musl" "4.2.1"
-    "@tailwindcss/oxide-linux-x64-gnu" "4.2.1"
-    "@tailwindcss/oxide-linux-x64-musl" "4.2.1"
-    "@tailwindcss/oxide-wasm32-wasi" "4.2.1"
-    "@tailwindcss/oxide-win32-arm64-msvc" "4.2.1"
-    "@tailwindcss/oxide-win32-x64-msvc" "4.2.1"
+    "@tailwindcss/oxide-android-arm64" "4.3.1"
+    "@tailwindcss/oxide-darwin-arm64" "4.3.1"
+    "@tailwindcss/oxide-darwin-x64" "4.3.1"
+    "@tailwindcss/oxide-freebsd-x64" "4.3.1"
+    "@tailwindcss/oxide-linux-arm-gnueabihf" "4.3.1"
+    "@tailwindcss/oxide-linux-arm64-gnu" "4.3.1"
+    "@tailwindcss/oxide-linux-arm64-musl" "4.3.1"
+    "@tailwindcss/oxide-linux-x64-gnu" "4.3.1"
+    "@tailwindcss/oxide-linux-x64-musl" "4.3.1"
+    "@tailwindcss/oxide-wasm32-wasi" "4.3.1"
+    "@tailwindcss/oxide-win32-arm64-msvc" "4.3.1"
+    "@tailwindcss/oxide-win32-x64-msvc" "4.3.1"
 
-"@tybys/wasm-util@^0.10.0", "@tybys/wasm-util@^0.10.1":
+"@tybys/wasm-util@^0.10.0":
   version "0.10.1"
   resolved "https://registry.yarnpkg.com/@tybys/wasm-util/-/wasm-util-0.10.1.tgz#ecddd3205cf1e2d5274649ff0eedd2991ed7f414"
   integrity sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==
   dependencies:
     tslib "^2.4.0"
 
+"@tybys/wasm-util@^0.10.2", "@tybys/wasm-util@^0.10.3":
+  version "0.10.4"
+  resolved "https://registry.yarnpkg.com/@tybys/wasm-util/-/wasm-util-0.10.4.tgz#3e85ecb266f9d1722250e89bc69528615720b154"
+  integrity sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==
+  dependencies:
+    tslib "^2.4.0"
+
 "@types/babel__core@^7.20.5":
   version "7.20.5"
   resolved "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz"
@@ -1582,6 +1609,11 @@ deepmerge@^4.3.1:
   resolved "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz"
   integrity sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==
 
+detect-libc@^1.0.3:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-1.0.3.tgz#fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b"
+  integrity sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==
+
 detect-libc@^2.0.3:
   version "2.1.2"
   resolved "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz"
@@ -1622,13 +1654,13 @@ emoji-regex@^9.2.2:
   resolved "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz"
   integrity sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==
 
-enhanced-resolve@^5.19.0:
-  version "5.19.0"
-  resolved "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz"
-  integrity sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==
+enhanced-resolve@5.21.6:
+  version "5.21.6"
+  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz#aa207b43cf658e6ab3ba06896edc00c13c3127c6"
+  integrity sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==
   dependencies:
     graceful-fs "^4.2.4"
-    tapable "^2.3.0"
+    tapable "^2.3.3"
 
 error-ex@^1.3.1:
   version "1.3.4"
@@ -2469,10 +2501,10 @@ jest@^30.2.0:
     import-local "^3.2.0"
     jest-cli "30.2.0"
 
-jiti@^2.6.1:
-  version "2.6.1"
-  resolved "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz"
-  integrity sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==
+jiti@^2.7.0:
+  version "2.7.0"
+  resolved "https://registry.yarnpkg.com/jiti/-/jiti-2.7.0.tgz#974228f2f4ca2bc21885a1797b45fea68e950c64"
+  integrity sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==
 
 js-tokens@^4.0.0:
   version "4.0.0"
@@ -2549,79 +2581,79 @@ libsodium-wrappers-sumo@^0.8.2:
   dependencies:
     libsodium-sumo "^0.8.0"
 
-lightningcss-android-arm64@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz#609ff48332adff452a8157a7c2842fd692a8eac4"
-  integrity sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==
+lightningcss-android-arm64@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz#f033885116dfefd9c6f54787523e3514b61e1968"
+  integrity sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==
 
-lightningcss-darwin-arm64@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz"
-  integrity sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==
+lightningcss-darwin-arm64@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz#50b71871b01c8199584b649e292547faea7af9b5"
+  integrity sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==
 
-lightningcss-darwin-x64@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz#f7482c311273571ec0c2bd8277c1f5f6e90e03a4"
-  integrity sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==
+lightningcss-darwin-x64@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz#35f3e97332d130b9ca181e11b568ded6aebc6d5e"
+  integrity sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==
 
-lightningcss-freebsd-x64@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz#91df1bb290f1cb7bb2af832d7d0d8809225e0124"
-  integrity sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==
+lightningcss-freebsd-x64@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz#9777a76472b64ed6ff94342ad64c7bafd794a575"
+  integrity sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==
 
-lightningcss-linux-arm-gnueabihf@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz#c3cad5ae8b70045f21600dc95295ab6166acf57e"
-  integrity sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==
+lightningcss-linux-arm-gnueabihf@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz#13ae652e1ab73b9135d7b7da172f666c410ad53d"
+  integrity sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==
 
-lightningcss-linux-arm64-gnu@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz#a5c4f6a5ac77447093f61b209c0bd7fef1f0a3e3"
-  integrity sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==
+lightningcss-linux-arm64-gnu@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz#417858795a94592f680123a1b1f9da8a0e1ef335"
+  integrity sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==
 
-lightningcss-linux-arm64-musl@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz#af26ab8f829b727ada0a200938a6c8796ff36900"
-  integrity sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==
+lightningcss-linux-arm64-musl@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz#6be36692e810b718040802fd809623cffe732133"
+  integrity sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==
 
-lightningcss-linux-x64-gnu@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.31.1.tgz#a891d44e84b71c0d88959feb9a7522bbf61450ee"
-  integrity sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==
+lightningcss-linux-x64-gnu@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz#0b7803af4eb21cfd38dd39fe2abbb53c7dd091f6"
+  integrity sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==
 
-lightningcss-linux-x64-musl@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.31.1.tgz#8c8b21def851f4d477fa897b80cb3db2b650bc6e"
-  integrity sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==
+lightningcss-linux-x64-musl@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz#88dc8ba865ddddb1ac5ef04b0f161804418c163b"
+  integrity sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==
 
-lightningcss-win32-arm64-msvc@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz#79000fb8c57e94a91b8fc643e74d5a54407d7080"
-  integrity sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==
+lightningcss-win32-arm64-msvc@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz#4f30ba3fa5e925f5b79f945e8cc0d176c3b1ab38"
+  integrity sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==
 
-lightningcss-win32-x64-msvc@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.yarnpkg.com/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz#7f025274c81c7d659829731e09c8b6f442209837"
-  integrity sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==
+lightningcss-win32-x64-msvc@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz#141aa5605645064928902bb4af045fa7d9f4220a"
+  integrity sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==
 
-lightningcss@1.31.1:
-  version "1.31.1"
-  resolved "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz"
-  integrity sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==
+lightningcss@1.32.0:
+  version "1.32.0"
+  resolved "https://registry.yarnpkg.com/lightningcss/-/lightningcss-1.32.0.tgz#b85aae96486dcb1bf49a7c8571221273f4f1e4a9"
+  integrity sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==
   dependencies:
     detect-libc "^2.0.3"
   optionalDependencies:
-    lightningcss-android-arm64 "1.31.1"
-    lightningcss-darwin-arm64 "1.31.1"
-    lightningcss-darwin-x64 "1.31.1"
-    lightningcss-freebsd-x64 "1.31.1"
-    lightningcss-linux-arm-gnueabihf "1.31.1"
-    lightningcss-linux-arm64-gnu "1.31.1"
-    lightningcss-linux-arm64-musl "1.31.1"
-    lightningcss-linux-x64-gnu "1.31.1"
-    lightningcss-linux-x64-musl "1.31.1"
-    lightningcss-win32-arm64-msvc "1.31.1"
-    lightningcss-win32-x64-msvc "1.31.1"
+    lightningcss-android-arm64 "1.32.0"
+    lightningcss-darwin-arm64 "1.32.0"
+    lightningcss-darwin-x64 "1.32.0"
+    lightningcss-freebsd-x64 "1.32.0"
+    lightningcss-linux-arm-gnueabihf "1.32.0"
+    lightningcss-linux-arm64-gnu "1.32.0"
+    lightningcss-linux-arm64-musl "1.32.0"
+    lightningcss-linux-x64-gnu "1.32.0"
+    lightningcss-linux-x64-musl "1.32.0"
+    lightningcss-win32-arm64-msvc "1.32.0"
+    lightningcss-win32-x64-msvc "1.32.0"
 
 lines-and-columns@^1.1.6:
   version "1.2.4"
@@ -2680,9 +2712,9 @@ merge-stream@^2.0.0:
   resolved "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz"
   integrity sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==
 
-micromatch@^4.0.8:
+micromatch@^4.0.5, micromatch@^4.0.8:
   version "4.0.8"
-  resolved "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
   integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
     braces "^3.0.3"
@@ -2873,7 +2905,7 @@ picomatch@^2.0.4, picomatch@^2.3.1:
   resolved "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz"
   integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==
 
-picomatch@^4.0.2, picomatch@^4.0.3:
+picomatch@^4.0.2:
   version "4.0.3"
   resolved "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz"
   integrity sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==
@@ -3134,15 +3166,15 @@ synckit@^0.11.8:
   dependencies:
     "@pkgr/core" "^0.2.9"
 
-tailwindcss@4.2.1, tailwindcss@^4.2.1:
-  version "4.2.1"
-  resolved "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.2.1.tgz"
-  integrity sha512-/tBrSQ36vCleJkAOsy9kbNTgaxvGbyOamC30PRePTQe/o1MFwEKHQk4Cn7BNGaPtjp+PuUrByJehM1hgxfq4sw==
+tailwindcss@4.3.1:
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/tailwindcss/-/tailwindcss-4.3.1.tgz#78ee06f6186bc8fb9603f8083eb703dc7dd96a10"
+  integrity sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==
 
-tapable@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz"
-  integrity sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==
+tapable@^2.3.3:
+  version "2.3.3"
+  resolved "https://registry.yarnpkg.com/tapable/-/tapable-2.3.3.tgz#5da7c9992c46038221267985ab28421a8879f160"
+  integrity sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==
 
 test-exclude@^6.0.0:
   version "6.0.0"