fix: eth_sign's warning and the README say what it signs (closes #409)

eth_sign is signed as an EIP-191 personal message over its data, which is
what the Ethereum JSON-RPC specification defines it to return. Its warning
on the signature prompt said the site was asking to sign a raw hash that
could drain funds, and the README said the same; neither was true. The
warning now says the site used the older eth_sign method and that the data
will be signed as a personal message, and the README's SignApproval section
says so too. A test pins that eth_sign is read address first and data
second, and that the page receives the personal message signature over the
data.

Model: opus-5-5

README.md

@@ -422,11 +422,12 @@ captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
 stored network unchanged and send no `chainChanged` until it is approved, a
-prompt raised while another approval window has focus is required to open a
-window of its own, and the password is required to be absent from every message
-the approval window sends to the background — with the message that would carry
-it required to be present, so that check cannot pass by observing nothing. That
-last one is the standing floor under
+network switch in Settings is required to send the page `chainChanged` with the
+new chain id, a prompt raised while another approval window has focus is
+required to open a window of its own, and the password is required to be absent
+from every message the approval window sends to the background — with the
+message that would carry it required to be present, so that check cannot pass by
+observing nothing. That last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -1785,10 +1786,12 @@ view would leave a wallet one click from deletion.
       plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
       Timestamps" checkbox, and a Theme selector (System / Light / Dark)
-    - Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
-      resets the RPC and Blockscout endpoints to that network's defaults. The
+    - Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
       network changes only here, or when the user approves a site's request on
-      **NetworkApproval**
+      **NetworkApproval**; either way, switching restores the RPC and Blockscout
+      endpoints last used on that network, or that network's defaults if it has
+      none, and sends `chainChanged` with the new chain id to every open tab.
+      Choosing the network already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2121,7 +2124,12 @@ view would leave a wallet one click from deletion.
       blocklist)
     - Site origin (bold, scheme and port included) + "wants you to sign a
       message"
-    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
+    - Warning box, shown for `eth_sign`: "This site used the older eth_sign
+      method. The data will be signed as a personal message." An `eth_sign`
+      request names the address first and the data second. Its data is signed
+      exactly as a `personal_sign` message is, as an EIP-191 personal message,
+      which is what the Ethereum JSON-RPC specification defines `eth_sign` to
+      return.
     - Type: "Personal message" or "Typed data (EIP-712)"
     - From: color dot + full address + etherscan link
     - Message: for `personal_sign` and `eth_sign`, the text the message's bytes
@@ -2197,8 +2205,9 @@ view would leave a wallet one click from deletion.
     - "Switch" / "Reject" buttons
 - **Transitions**:
     - "Switch" → closes popup; the background switches the network as
-      **Settings** does, sends `chainChanged` to every open tab, and answers the
-      site with success
+      **Settings** does, restoring the RPC and Blockscout endpoints last used on
+      that network (or that network's defaults if it has none), sends
+      `chainChanged` to every open tab, and answers the site with success
     - "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
       nothing changes
     - Popup window closed without answering → the same as "Reject"
@@ -2691,7 +2700,7 @@ Currently supported:
 
 ### Non-Goals for 1.0
 
-- Multi-chain support (Ethereum mainnet only)
+- Chains other than Ethereum mainnet and the Sepolia testnet
 - Hardware wallet support
 
 ## TODO
@@ -2725,7 +2734,10 @@ Currently supported:
 ## Policies
 
 - We don't mention "the other wallet" by name in code or documentation. We're
-  our own thing.
+  our own thing. Written exception: the injected provider in
+  `src/content/inpage.js` sets the flag named after the other wallet to `true`.
+  It is an interface-compatibility flag many dApps check, and without it the
+  wallet stops working on their sites.
 - The README is the complete authoritative technical documentation. It's ok if
   it gets big.
 

RULES.md

@@ -118,4 +118,7 @@ contradicts either, the originals govern.
 - [ ] "Address" not "account" or "derived key"
 - [ ] "Password" not "encryption key" or "vault passphrase"
 - [ ] Error messages are full sentences
-- [ ] No competitor mentioned by name in code or documentation
+- [ ] No competitor mentioned by name in code or documentation. Written
+      exception: the injected provider in `src/content/inpage.js` sets the flag
+      named after the other wallet to `true`, an interface-compatibility flag
+      many dApps check (README.md, Policies)

TODO.md

@@ -2,10 +2,9 @@
 
 - `git pull` `next` and cut a branch from it — one branch per issue, named
   `issue-<N>-<slug>`. Never branch from `main`.
-- Do the work as one commit whose title ends with ` (closes #N)`, with the
-  `TODO.md` update in that same commit.
-- Move Next Step to the top of Completed Steps; move the top item of Future
-  Steps into Next Step.
+- Do the work as one commit whose title ends with ` (closes #N)`.
+- Add no entry to Completed Steps. What landed is recorded on the tracker and in
+  `git log`, where each commit title names the issue it closes.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
   `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on
@@ -44,6 +43,25 @@ then continue tagging as milestones land.
 
 # Completed Steps
 
+- 2026-10-08: The browser suites no longer read a screen before the page has
+  shown it ([#502](https://git.eeqj.de/sneak/AutistMask/issues/502)). Their wait
+  for a screen used to pass as soon as the element laid out, which every view
+  does until the page's stylesheet has applied, so an approval test could read
+  the prompt's fields before the page's script had filled them. `visible()` in
+  `tests/e2e/harness.js` and `waitVisible()` in `tests/e2e/firefox/driver.js`
+  now also wait for the page to finish loading and for neither the element nor
+  anything around it to carry the `hidden` class that `showView()` puts on every
+  view but the current one. No caller changed.
+
+- 2026-10-08: Switching the network in Settings now tells open pages
+  ([#500](https://git.eeqj.de/sneak/AutistMask/issues/500)). Once the switch is
+  saved, Settings asks the background to send `chainChanged` with the new chain
+  id to every open tab, through the same function an approved site request uses.
+  Choosing the network already active changes nothing and sends nothing. Only
+  the extension's own pages can ask for this. `tests/chainSwitchGate.test.js`
+  drives the real Settings view against the background, and the Chrome suite
+  checks that the test page hears both switches.
+
 - 2026-10-07: A site can no longer switch the wallet's network by itself
   ([#408](https://git.eeqj.de/sneak/AutistMask/issues/408)). A connected site's
   `wallet_switchEthereumChain` request for the other supported network opens a
@@ -54,9 +72,20 @@ then continue tagging as milestones land.
   or closing the prompt answers 4001. One such prompt per site at a time. The
   approval window no longer shows the connection prompt while it waits for the
   background to describe the approval, because that prompt's "Allow" answers on
-  the same port as the new one. `tests/chainSwitchGate.test.js` and both browser
+  the same port as the new one; `tests/approvalWindow.test.js` checks that it
+  shows no screen until then. `tests/chainSwitchGate.test.js` and both browser
   suites drive the prompt.
 
+- 2026-10-07: Two contradictions between the documents and the code are resolved
+  as ruled on [#165](https://git.eeqj.de/sneak/AutistMask/issues/165). The
+  README's 1.0 non-goal now puts Ethereum mainnet and the Sepolia testnet in
+  scope and other chains out of it. The injected provider's flag named after the
+  other wallet stays, as an interface-compatibility flag many dApps check, and
+  is written down as an exception to the rule against naming competitors in the
+  README's Policies section, in `RULES.md` and in a comment beside it in
+  `src/content/inpage.js`. `script/check-censored` already allows that flag only
+  in that file and its built copies, so it is unchanged.
+
 - 2026-10-07: Two holes in what `tests/persistedFieldContract.test.js` checks
   are closed ([#379](https://git.eeqj.de/sneak/AutistMask/issues/379)). The
   check that every swept field is driven both truthy and falsy counts only

src/background/index.js

@@ -984,9 +984,8 @@ async function handleRpc(method, params, origin) {
 
         if (method === "eth_sign") {
             signParams.dangerWarning =
-                "\u26a0\ufe0f DANGER: This site is requesting to sign a raw hash. " +
-                "This can be used to sign transactions that drain your funds. " +
-                "Only proceed if you fully understand what you are signing.";
+                "This site used the older eth_sign method. " +
+                "The data will be signed as a personal message.";
         }
 
         if (findPendingApproval(origin, "sign")) {
@@ -1471,6 +1470,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         "AUTISTMASK_ADDRESSES_REMOVED",
         "AUTISTMASK_GET_CONNECTED_SITES",
         "AUTISTMASK_REMOVE_SITE",
+        "AUTISTMASK_NETWORK_CHANGED",
     ];
     if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
         sendResponse({ error: "Unauthorized sender" });
@@ -1854,6 +1854,13 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         broadcastSiteRemoved(msg.origin);
         return false;
     }
+
+    // Settings switched the network and has saved it. Open tabs are told the
+    // new chain id the same way as after a site's approved switch request.
+    if (msg.type === "AUTISTMASK_NETWORK_CHANGED") {
+        broadcastChainChanged(msg.chainId);
+        return false;
+    }
 });
 
 module.exports = { PROXY_METHODS };

src/content/inpage.js

@@ -99,7 +99,10 @@
 
     const provider = {
         isAutistMask: true,
-        isMetaMask: true, // compatibility — many dApps check this
+        // An interface-compatibility flag many dApps check. Kept as a written
+        // exception to the rule that no competitor is named in code: see
+        // Policies in README.md, and RULES.md.
+        isMetaMask: true,
         chainId: currentChainId,
         networkVersion: currentNetworkVersion,
         selectedAddress: null,

src/popup/index.html

@@ -7,9 +7,10 @@
         <link rel="stylesheet" href="styles.css" />
     </head>
     <!-- Chrome gives extension pages a stylesheet of its own that sets the
-         font on body, and a Tailwind class beats it only when marked
-         important: hence font-mono! rather than font-mono. -->
-    <body class="bg-bg text-fg font-mono! text-sm">
+         font and its size on body, and a Tailwind class beats it only when
+         marked important: hence font-mono! and text-sm! rather than
+         font-mono and text-sm. -->
+    <body class="bg-bg text-fg font-mono! text-sm!">
         <div id="app" class="p-2 pr-5 overflow-x-hidden">
             <!-- ============ GLOBAL TITLE BAR ============ -->
             <div
@@ -87,11 +88,14 @@
 
                 <!-- Mnemonic form section -->
                 <div id="add-wallet-section-mnemonic">
-                    <p class="mb-2">
-                        Enter your 12 or 24 word recovery phrase below, or click
-                        the button to roll the die for a new one.
-                    </p>
-                    <div class="mb-1 flex justify-end">
+                    <!-- The die button shares the instruction's row: on a row
+                         of its own it pushes Import below the fold at
+                         360x600. -->
+                    <div class="mb-2 flex justify-between items-start gap-2">
+                        <p>
+                            Enter your 12 or 24 word recovery phrase below, or
+                            click the button to roll the die for a new one.
+                        </p>
                         <button
                             id="btn-generate-phrase"
                             class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"

src/popup/views/approval.js

@@ -329,9 +329,9 @@ function showTxApproval(details) {
     const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
     const usdStr = formatUsd(ethUsd);
     // In the native currency of the network the transaction is for, which the
-    // Network line names, not the active network's: a site can switch the
-    // active network after this transaction is prepared and back before it is
-    // signed.
+    // Network line names, not the active network's: the active network can
+    // change, in Settings or when the user approves a site's request, after
+    // this transaction is prepared and change back before it is signed.
     $("approve-tx-value").textContent =
         ethValueFormatted +
         " " +
@@ -721,7 +721,7 @@ function showSignApproval(details) {
             "This message is plain text, not hex, so it cannot be signed.";
     }
 
-    // Display danger warning for eth_sign (raw hash signing)
+    // The warning the background attaches to an eth_sign request.
     const warningEl = $("approve-sign-danger-warning");
     if (warningEl) {
         if (sp.dangerWarning) {

src/popup/views/settings.js

@@ -316,7 +316,11 @@ function init(ctx) {
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
         const newId = networkSelect.value;
+        if (newId === state.networkId) return;
         const net = await onChainSwitch(newId);
+        // Open pages are told by the background, as after a site's approved
+        // switch request.
+        notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
         showFlash("Switched to " + net.name + ".");

src/popup/views/transactionDetail.js

@@ -84,8 +84,9 @@ function show(tx) {
             contractAddress: tx.contractAddress || null,
             // The network the history entry was read from. The type line and
             // the fee are in its native currency, not the active network's:
-            // a site can switch the active network before a later popup
-            // shows this screen again.
+            // the active network can change, in Settings or when the user
+            // approves a site's request, before a later popup shows this
+            // screen again.
             chainId: tx.chainId,
         },
     };

src/popup/views/txStatus.js

@@ -89,8 +89,9 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
 
     // A native amount, here and on the success and error screens, is in the
     // native currency of txInfo.chainId, the network the transaction was sent
-    // on, not the active network's: a site can switch the active network
-    // while this screen is open or before a later popup resumes it.
+    // on, not the active network's: the active network can change, in
+    // Settings or when the user approves a site's request, while this screen
+    // is open or before a later popup resumes it.
     const symbol =
         txInfo.token === "ETH"
             ? nativeCurrencyByChainId(txInfo.chainId)

tests/approvalWindow.test.js

@@ -0,0 +1,47 @@
+// The approval window shows no screen until the background has described the
+// approval it answers (https://git.eeqj.de/sneak/AutistMask/issues/408). The
+// connection prompt's "Allow" and the network switch prompt's "Switch" answer
+// on the same port, so a window that showed the connection prompt while it
+// waited could approve a network switch.
+//
+// Booted through the real popup entry point, which is where the connection
+// prompt used to be put up before the background had answered.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    settle,
+    unversionedValidProfile,
+} = require("./support/popupBoot");
+
+afterEach(cleanupPopup);
+
+test("the approval window shows no screen until the background describes the approval", async () => {
+    // The background's answer, held until the test gives it.
+    let answer = null;
+    const env = await bootPopup(unversionedValidProfile(), {
+        search: "?approval=approval-1",
+        runtime: {
+            connect: () => ({ postMessage: () => {} }),
+            sendMessage: (msg, reply) => {
+                if (msg.type === "AUTISTMASK_GET_APPROVAL") answer = reply;
+            },
+        },
+    });
+
+    expect(answer).not.toBeNull();
+    // No screen at all, the connection prompt included.
+    expect(env.visibleViews()).toEqual([]);
+
+    answer({
+        type: "network",
+        origin: "https://dapp.example",
+        currentNetworkId: "mainnet",
+        requestedNetworkId: "sepolia",
+        isPhishingDomain: false,
+    });
+    await settle();
+
+    expect(env.visibleViews()).toEqual(["approve-network"]);
+    expect(env.pageErrors).toEqual([]);
+});

tests/backgroundApproval.test.js

@@ -1551,6 +1551,53 @@ describe("what the approval is verified against", () => {
     });
 });
 
+// eth_sign names the address first and the data second, the reverse of
+// personal_sign, and is answered as the JSON-RPC specification defines it:
+// with an EIP-191 personal message signature over the data, the same
+// signature personal_sign returns
+// (https://git.eeqj.de/sneak/AutistMask/issues/409).
+describe("eth_sign", () => {
+    test("is read address first, and returns a personal message signature over the data", async () => {
+        const bg = loadBackground();
+        const page = bg.send(
+            {
+                type: "AUTISTMASK_RPC",
+                method: "eth_sign",
+                params: [signer.address, MESSAGE],
+            },
+            { origin: ORIGIN },
+        );
+        await settle();
+        const id = approvalIdIn(bg.created.map((c) => c.url));
+
+        const details = bg.send(
+            { type: "AUTISTMASK_GET_APPROVAL", id },
+            { url: bg.fromPopup.url },
+        );
+        const { signParams } = details.sendResponse.mock.calls[0][0];
+        expect(signParams).toMatchObject({
+            method: "eth_sign",
+            message: MESSAGE,
+            from: signer.address,
+        });
+        expect(signParams.dangerWarning).toBe(
+            "This site used the older eth_sign method. " +
+                "The data will be signed as a personal message.",
+        );
+
+        const signature = await signer.signMessage(
+            Buffer.from(MESSAGE.slice(2), "hex"),
+        );
+        bg.send(
+            { type: "AUTISTMASK_SIGN_RESPONSE", id, approved: true, signature },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(page.sendResponse).toHaveBeenCalledWith({ result: signature });
+    });
+});
+
 // The interlock must not cost the retry the approval exists to allow.
 describe("the interlock releases a failed attempt", () => {
     test("a retryable failure before the broadcast leaves the approval usable", async () => {

tests/chainSwitchGate.test.js

@@ -16,7 +16,9 @@
 //
 // The endpoint half of #308 lives in tests/networkEndpoints.test.js, which
 // covers the popup's chain switch; this file covers the background's, which
-// goes through storage rather than the shared state singleton.
+// goes through storage rather than the shared state singleton. The last block
+// covers what the background tells open tabs when the user switches the
+// network in Settings.
 
 const { networkById } = require("../src/shared/networks");
 const { makeStorageStub } = require("./support/storageStub");
@@ -225,6 +227,14 @@ function loadBackground() {
         answerPrompt,
         closePrompt,
         opened,
+        // A message to the background from `sender`, and its answer.
+        send: (msg, sender) => {
+            let reply = null;
+            messageListener(msg, sender, (r) => {
+                reply = r;
+            });
+            return reply;
+        },
         walletState: () => storage.read("autistmask"),
         chainChangedEvents: () =>
             toTabs.filter((m) => m.eventName === "chainChanged"),
@@ -390,3 +400,109 @@ describe("only the user switches the network", () => {
         expect(bg.walletState().rpcUrl).toBe(CUSTOM_RPC);
     });
 });
+
+// Switching the network in Settings tells open pages, as an approved site
+// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). These drive
+// the real Settings view over the background's storage, with what it sends
+// delivered to the background from the extension's own page.
+describe("switching the network in Settings tells every open tab", () => {
+    const POPUP = { url: EXT_URL + "src/popup/index.html" };
+
+    // A stand-in for one DOM node: enough of an element for init() to set
+    // properties on it and hang listeners off it.
+    function fakeElement() {
+        return {
+            value: "",
+            checked: false,
+            textContent: "",
+            style: {},
+            dataset: {},
+            classList: { add() {}, remove() {} },
+            listeners: {},
+            addEventListener(event, handler) {
+                this.listeners[event] = handler;
+            },
+            querySelectorAll: () => [],
+        };
+    }
+
+    // Settings, opened the way the popup opens it. Returns its network
+    // selector.
+    async function openSettings(bg) {
+        const elements = {};
+        const element = (id) => (elements[id] ||= fakeElement());
+        jest.doMock("../src/popup/views/helpers", () => ({
+            $: element,
+            showView: () => {},
+            updateDebugBanner: () => {},
+            showFlash: () => {},
+            escapeHtml: (s) => s,
+            flashCopyFeedback: () => {},
+            goBack: () => {},
+            pushCurrentView: () => {},
+            onViewLeave: () => {},
+            VIEWS: [],
+        }));
+        global.chrome.runtime.sendMessage = (msg) => {
+            bg.send(msg, POPUP);
+        };
+        await require("../src/shared/state").loadState();
+        require("../src/popup/views/settings").init({
+            pageClosed: new AbortController().signal,
+        });
+        const select = element("settings-network");
+        select.value = "mainnet";
+        return select;
+    }
+
+    // The user picks `networkId` in the selector.
+    async function choose(select, networkId) {
+        select.value = networkId;
+        await select.listeners.change();
+        await settle();
+    }
+
+    afterEach(() => {
+        jest.dontMock("../src/popup/views/helpers");
+    });
+
+    test("switching to the other network sends chainChanged once, with its chain id", async () => {
+        const bg = loadBackground();
+        const select = await openSettings(bg);
+
+        await choose(select, "sepolia");
+
+        expect(bg.walletState().networkId).toBe("sepolia");
+        expect(bg.chainChangedEvents()).toEqual([
+            {
+                type: "AUTISTMASK_EVENT",
+                eventName: "chainChanged",
+                data: SEPOLIA.chainId,
+            },
+        ]);
+    });
+
+    test("choosing the network already active changes nothing and sends nothing", async () => {
+        const bg = loadBackground();
+        const select = await openSettings(bg);
+        const before = bg.walletState();
+
+        await choose(select, "mainnet");
+
+        expect(bg.walletState()).toEqual(before);
+        expect(bg.chainChangedEvents()).toEqual([]);
+    });
+
+    test("a page cannot make the background send chainChanged", async () => {
+        const bg = loadBackground();
+
+        const reply = bg.send(
+            { type: "AUTISTMASK_NETWORK_CHANGED", chainId: SEPOLIA.chainId },
+            { url: CONNECTED_ORIGIN + "/" },
+        );
+        await settle();
+
+        expect(reply).toEqual({ error: "Unauthorized sender" });
+        expect(bg.chainChangedEvents()).toEqual([]);
+    });
+});

tests/e2e/firefox/driver.js

@@ -279,12 +279,18 @@ class Driver {
 
     // Shown means shown: in the popup a view is switched by toggling a
     // "hidden" class, and an element that is present but collapsed is not
-    // the thing a test means by visible.
+    // the thing a test means by visible. Until the page's stylesheet has
+    // applied that class hides nothing and every view lays out, so the page
+    // must also have finished loading, which it does only after its
+    // stylesheet, and neither the element nor anything enclosing it may
+    // carry the class (https://git.eeqj.de/sneak/AutistMask/issues/502).
     async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
         return this.waitFor(
             "selector " + selector + " to be visible",
             `const el = document.querySelector(arguments[0]);
-             if (!el) return false;
+             if (document.readyState !== "complete" || !el) return false;
+             if (el.closest(".hidden")) return false;
+             if (getComputedStyle(el).visibility !== "visible") return false;
              const r = el.getBoundingClientRect();
              return r.width > 0 && r.height > 0;`,
             [selector],

tests/e2e/firefox/run.js

@@ -128,6 +128,18 @@ step("the popup is drawn in the monospace font it declares", async (env) => {
     );
 });
 
+// The same check as the Chrome suite's (#456), so both browsers are held to
+// the same size.
+step("the popup's text is drawn at the 14px text-sm declares", async (env) => {
+    const size = await env.driver.execute(
+        "return getComputedStyle(document.body).fontSize;",
+    );
+    assert(
+        size === "14px",
+        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
+    );
+});
+
 // The recovery screen (#361): the Chrome suite's four cases, run before any
 // wallet exists for the same reason. With no wallet nothing saves on a timer,
 // so no save can write a good record over the unreadable one. The last of them

tests/e2e/harness.js

@@ -333,8 +333,33 @@ async function launch(routeOpts) {
 
 const PASSWORD = "e2e-harness-password";
 
+// Waits until the page shows `selector`, not only until it lays out. Until the
+// page's stylesheet has applied, the `hidden` class that showView() keeps on
+// every view but the current one hides nothing and every view lays out, so a
+// test could read a screen before the page's script had filled it
+// (https://git.eeqj.de/sneak/AutistMask/issues/502). So the page must also
+// have finished loading, which it does only after its stylesheet, and neither
+// the element nor anything enclosing it may carry `hidden`. Polled on a timer:
+// animation frames are not guaranteed to a window that is not in front.
 async function visible(page, selector, timeout = 15000) {
-    await page.waitForSelector(selector, { state: "visible", timeout });
+    await page
+        .waitForFunction(
+            (sel) => {
+                const el = document.querySelector(sel);
+                if (document.readyState !== "complete" || !el) return false;
+                if (el.closest(".hidden")) return false;
+                if (getComputedStyle(el).visibility !== "visible") return false;
+                const r = el.getBoundingClientRect();
+                return r.width > 0 && r.height > 0;
+            },
+            selector,
+            { polling: 50, timeout },
+        )
+        .catch((e) => {
+            throw new Error(
+                "the page did not show " + selector + ": " + e.message,
+            );
+        });
 }
 
 // An empty WebAssembly module: magic number and version header, no

tests/e2e/run.js

@@ -113,6 +113,18 @@ test("the popup is drawn in the monospace font it declares (#418)", async (env)
     );
 });
 
+// The same stylesheet sets the size on body to 75%, which would draw the
+// popup at 12px.
+test("the popup's text is drawn at the 14px text-sm declares (#456)", async (env) => {
+    const size = await env.page.evaluate(
+        () => getComputedStyle(document.body).fontSize,
+    );
+    assert(
+        size === "14px",
+        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
+    );
+});
+
 // The empirical half of #182. The manifest change is only a claim about
 // what the CSP permits; this is the observation. Two things have to hold
 // together, and the run covers both: the popup realm compiles WASM (here),
@@ -4538,6 +4550,42 @@ test("a site's network switch changes nothing until the user approves it (#408)"
     );
 });
 
+// Switching the network in Settings tells the page too, as an approved site
+// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). The wallet
+// goes back to mainnet the same way at the end.
+test("a network switch in Settings tells the page (#500)", async (env) => {
+    const { mainnet, sepolia } = NETWORKS;
+    const before = await storedNetwork(env.page);
+    assert(
+        before.networkId === "mainnet",
+        "this test starts on mainnet, not on " + before.networkId,
+    );
+    const eventsBefore = (await chainChangedEvents(env.dapp)).length;
+    await openSettings(env.page);
+
+    await env.page.selectOption("#settings-network", "sepolia");
+    let events = await chainChangedEvents(env.dapp, eventsBefore + 1);
+    assert(
+        events.length === eventsBefore + 1 &&
+            events[events.length - 1].data === sepolia.chainId,
+        "the page was not told of the switch to Sepolia: " +
+            JSON.stringify(events),
+    );
+
+    await env.page.selectOption("#settings-network", "mainnet");
+    events = await chainChangedEvents(env.dapp, eventsBefore + 2);
+    assert(
+        events.length === eventsBefore + 2 &&
+            events[events.length - 1].data === mainnet.chainId,
+        "the page was not told of the switch back to mainnet: " +
+            JSON.stringify(events),
+    );
+    assert(
+        isDeepStrictEqual(await storedNetwork(env.page), before),
+        "switching back did not restore the mainnet network and endpoints",
+    );
+});
+
 // The closing pass over both boundaries at once. Every message the section
 // put on either channel is re-read here and required to be free of the
 // password — and required to be there at all, method by method, so the

tests/nativeCurrency.test.js

@@ -345,10 +345,10 @@ describe.each([
 });
 
 // A transaction's value and fee are in the native currency of the network the
-// transaction is on, which need not be the active one. A site can switch the
-// active network after its transaction is prepared and back before it is
-// signed, and a popup opened after a switch shows a sent or listed transaction
-// again. The wallet's balances follow the active network; these do not.
+// transaction is on, which need not be the active one. The active network can
+// change, in Settings or when the user approves a site's request, after a
+// transaction is prepared and change back before it is signed, and a popup
+// opened after a switch shows a sent or listed transaction again. The wallet's balances follow the active network; these do not.
 describe.each([
     ["mainnet", "sepolia", "ETH"],
     ["sepolia", "mainnet", "SepoliaETH"],

tests/support/popupBoot.js

@@ -238,6 +238,10 @@ async function settle() {
  * @param {object} [options]
  * @param {object} [options.storage] a storage stub from makeStorageStub(), for
  *     a test that needs to make writes fail or to watch the round trips.
+ * @param {string} [options.search] the page URL's query string, such as
+ *     "?approval=" and an id for the popup opened as an approval window.
+ * @param {object} [options.runtime] members of chrome.runtime that replace the
+ *     stub's own, for a test that has to answer the background's messages.
  * @returns {Promise<object>} handles onto the booted page.
  */
 async function bootPopup(stored, options) {
@@ -281,12 +285,13 @@ async function bootPopup(stored, options) {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,
             onMessage: { addListener: () => {} },
+            ...(options && options.runtime),
         },
     };
     globalThis.document = document;
     globalThis.window = {
         location: {
-            search: "",
+            search: (options && options.search) || "",
             href: "chrome-extension://autistmask/src/popup/index.html",
             reload: () => reloads.push(Date.now()),
         },