security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

The provider UUID was generated once, stored in extension storage, and
announced verbatim to every page on every load and across restarts, so any
site — connected or not — could read a stable cross-site, cross-session
identifier for the install: a supercookie contradicting the "no tracking"
promise. EIP-6963 wants a fresh UUIDv4 per announcement instead.

inpage.js now announces a per-load crypto.randomUUID() and persists nothing;
the eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script
message are removed. That key was a standalone top-level storage entry, never
part of the versioned autistmask profile, so stateSchema.js and the
persisted-field harness are untouched and no existing profile is affected.

A jest test asserts two loads announce different UUIDv4s and that one load
reuses a single UUID across re-announcements.

Model: opus-4-8

src/content/inpage.js

@@ -204,11 +204,12 @@
                 "</svg>",
         );
 
-    // EIP-6963 asks for one UUIDv4 per provider for the life of the page: one
-    // per page load, shared by every announcement in that load. It is
-    // generated here and never stored: announcing one persisted value to every
-    // site, on every load and across restarts, turned it into a stable
-    // cross-site, cross-session tracking identifier any page could read
+    // EIP-6963 wants a fresh UUIDv4 per page load — it identifies one
+    // announcement, so a provider can be told apart from another instance of
+    // itself in the same page. It is generated here and never stored:
+    // announcing one persisted value to every site, on every load and across
+    // restarts, turned it into a stable cross-site, cross-session tracking
+    // identifier any page could read
     // (https://git.eeqj.de/sneak/AutistMask/issues/398).
     const providerUuid = crypto.randomUUID();
 

tests/inpageProviderUuid.test.js

@@ -4,13 +4,8 @@
 // persisted in extension storage, and announced verbatim to every page on
 // every load and across browser restarts, so any site — connected or not —
 // could read a stable cross-site, cross-session identifier for the install.
-// EIP-6963 asks for one UUIDv4 per page load, shared by every announcement in
-// that load. The fix generates it per page load and stores nothing.
-//
-// The stored UUID reached inpage.js as an AUTISTMASK_PROVIDER_UUID page
-// message from the content script, and inpage.js then announced it. Each load
-// below is posted the same stored UUID that way, so on the old code both loads
-// announce it and the last two tests fail.
+// EIP-6963 wants a fresh UUIDv4 per announcement instead. The fix generates
+// it per page load and stores nothing.
 //
 // inpage.js is a bare IIFE injected into the page's JS context, not a module;
 // see tests/inpageErrors.test.js for why it is evaluated against a stub window
@@ -49,14 +44,9 @@ class StubCustomEvent extends StubEvent {
     }
 }
 
-// What the old content script read out of extension storage and posted to
-// every page load.
-const STORED_UUID = "11111111-2222-4333-8444-555555555555";
-
-// Evaluate inpage.js once against a fresh stub window, post it STORED_UUID the
-// way the old content script did, then dispatch a `requestProvider` event so a
-// re-announcement is observed as well as the announcement at load. Returns
-// every UUID the load announced, in order.
+// Evaluate inpage.js once against a fresh stub window and return every UUID it
+// announced. A `requestProvider` event is dispatched too, so a re-announcement
+// within one load is observed as well as the announcement at load.
 function announcedUuids() {
     const listeners = {};
     const uuids = [];
@@ -83,11 +73,6 @@ function announcedUuids() {
     win.window = win;
 
     loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
-    win.dispatchEvent({
-        type: "message",
-        source: win,
-        data: { type: "AUTISTMASK_PROVIDER_UUID", uuid: STORED_UUID },
-    });
     win.dispatchEvent(new StubEvent("eip6963:requestProvider"));
     return uuids;
 }
@@ -96,7 +81,7 @@ const UUID_V4 =
     /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 
 describe("the EIP-6963 provider UUID is fresh per page load", () => {
-    test("a load announces a UUIDv4 without being asked", () => {
+    test("a load announces a UUIDv4, unprompted, with nothing delivered", () => {
         const uuids = announcedUuids();
         expect(uuids.length).toBeGreaterThan(0);
         expect(uuids[0]).toMatch(UUID_V4);
@@ -108,11 +93,11 @@ describe("the EIP-6963 provider UUID is fresh per page load", () => {
         expect(new Set(uuids).size).toBe(1);
     });
 
-    test("two page loads announce different UUIDs, neither the stored one", () => {
-        const first = announcedUuids();
-        const second = announcedUuids();
-        expect(first).not.toContain(STORED_UUID);
-        expect(second).not.toContain(STORED_UUID);
-        expect(second[0]).not.toBe(first[0]);
+    test("two page loads announce different UUIDs", () => {
+        const first = announcedUuids()[0];
+        const second = announcedUuids()[0];
+        expect(first).toMatch(UUID_V4);
+        expect(second).toMatch(UUID_V4);
+        expect(second).not.toBe(first);
     });
 });