fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373 )

A popup already open when the stored profile became unreadable stayed on the last good profile until reopened. Every save already runs the check loadState() runs at open; a save refused by it now stops the ten-second refresh, runs the leave cleanup of the current screen, and raises the recovery screen. From then on showView() shows nothing else in that popup, so a transaction wait or a later save cannot take the user off it or clear an export or a typed confirmation. That is held in memory, never as the saved current view, so a popup opened after the record is erased elsewhere opens normally. Any other failed save keeps the "NOT SAVED" banner. The popup test harness now honours clearInterval(). Model: opus-5-5
harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403 )
2026-10-04 21:08:37 +00:00 · 2026-10-04 22:09:07 +02:00 · 2026-10-04 21:43:11 +02:00 · 2026-10-04 21:09:04 +02:00 · 2026-10-04 19:43:11 +02:00 · 2026-10-04 18:43:04 +02:00
56 changed files with 2405 additions and 358 deletions
@@ -8,12 +8,11 @@ WORKDIR /app
 # image sets it.
 ENV AUTISTMASK_LINT_NATIVE=1

-# script/test's default 30s bound is the host figure, against a suite that
-# takes 23-29s there with three jest workers. In here the same suite starts on
-# a cold jest cache and shares the runner with the rest of the build, so 30s
-# is too tight — it killed a healthy suite at 30.6s on a cold CI cache. 180s
-# still catches a hang in three minutes and cannot be tripped by a suite that
-# is merely running on contended hardware.
+# script/test's default 30s bound is the host figure. In here the same suite
+# starts on a cold jest cache and shares the runner with the rest of the build,
+# so 30s is too tight — it killed a healthy suite at 30.6s on a cold CI cache.
+# 180s still catches a hang in three minutes and cannot be tripped by a suite
+# that is merely running on contended hardware.
 ENV AUTISTMASK_TEST_TIMEOUT=180

 # script/bootstrap installs all prerequisites (make via apt here; node
@@ -926,7 +926,10 @@ rule: the ERC-20 `transfer`/`approve` line (`src/popup/views/approval.js`) and
 the swap's `Amount` and `Min. received` lines (`src/shared/uniswap.js`). The
 token permission warning on the signature screen takes the same rule for its
 amounts. An unbounded allowance or permit needs no scale to describe and is
-still shown as `Unlimited`.
+still shown as `Unlimited`. A source's answer counts only if it is a whole
+number from 0 to 80: `decimals()` returns a `uint8`, but `formatUnits()` cannot
+format more than 80 decimal places, so a token that reports 81 to 255 is shown
+as one whose scale nothing knows.

 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1111,16 +1114,18 @@ because bumping for one would send every older install to StateRecovery for
 nothing.

 Every read of the record goes through `assertStateUsable()` first, on the raw
-bytes, before normalization: `loadState()` for the popup and `getState()` for
-the background. It refuses a record that is not an object, a `schemaVersion`
-this build does not understand (a newer one included), a `wallets` that is not a
-list of wallet records with address records in them, and a `networkId` that is
-not a network in `src/shared/networks.js`. Refusing is the whole point — a
-record the wallet cannot vouch for is never normalized, never written back, and
-never half-loaded. The popup shows StateRecovery; a dApp gets a specific error
-(`-32007`, an EIP-1474 server-error code the spec leaves unassigned) saying the
-saved data cannot be read and that nothing was signed or sent, rather than the
-generic `-32603` every request used to answer.
+bytes, before normalization: `loadState()` and every `saveState()` for the
+popup, and `getState()` for the background. It refuses a record that is not an
+object, a `schemaVersion` this build does not understand (a newer one included),
+a `wallets` that is not a list of wallet records with address records in them,
+and a `networkId` that is not a network in `src/shared/networks.js`. Refusing is
+the whole point — a record the wallet cannot vouch for is never normalized,
+never written back, and never half-loaded. The popup shows StateRecovery,
+whether it finds the record unreadable when it opens or at a save while it is
+open; a dApp gets a specific error (`-32007`, an EIP-1474 server-error code the
+spec leaves unassigned) saying the saved data cannot be read and that nothing
+was signed or sent, rather than the generic `-32603` every request used to
+answer.

 Every other field of the record is floored in `normalizePersisted()` rather than
 gated, and the floor is not the same for every field. Some are type-checked as a
@@ -1157,15 +1162,16 @@ each caught only by a reviewer re-deriving thirty fields by hand.
 The `allowedSites` case is why the entry check is not optional. A stored
 `{"0x…": "notalist"}` is a well-formed object holding a malformed entry: it
 passed the gate, rendered a completely healthy popup, and then threw inside
-`saveState()`'s per-hostname merge, so every save from that moment on failed and
+`saveState()`'s per-origin merge, so every save from that moment on failed and
 the user went on operating a wallet that was persisting nothing
 ([#362](https://git.eeqj.de/sneak/AutistMask/issues/362)). A save that fails is
 now also reported rather than swallowed: `onSaveFailure()` in
 `src/shared/state.js` is called for every failed save, awaited or not, and the
 popup puts up a persistent "NOT SAVED" banner (`showSaveFailureBanner()` in
 `src/popup/views/helpers.js`). Storage can still fail for reasons no floor
-covers — a quota, a revoked permission, a record a newer build wrote — and the
-wallet must never look healthy while that is true.
+covers — a quota, a revoked permission — and the wallet must never look healthy
+while that is true. A save that fails because the stored record fails the gate,
+such as one a newer build wrote, gets StateRecovery instead of the banner.

 The `networkId` check is not cosmetic: that value is an object KEY into
 `state.networkEndpoints`, so an unvalidated `"__proto__"` would set the map's
@@ -1631,13 +1637,13 @@ view would leave a wallet one click from deletion.
          a value carrying its unit, hex (`0x10`) or exponent (`1e3`) notation —
          is refused with a flash message and the field snaps back to the stored
          threshold, so a number the user did not type is never stored.
-    - Allowed Sites: the hostnames remembered as allowed, under any address,
-      with remove buttons
-    - Connected Sites: the hostnames of the sites allowed without "Remember my
+    - Allowed Sites: the origins (scheme, host and port) remembered as allowed,
+      under any address, with remove buttons
+    - Connected Sites: the origins of the sites allowed without "Remember my
      choice" that are still connected, with remove buttons. Only the background
      holds these, in memory, and Settings asks it for them with
      `AUTISTMASK_GET_CONNECTED_SITES`
-    - Denied Sites: the hostnames remembered as denied, under any address, with
+    - Denied Sites: the origins remembered as denied, under any address, with
      remove buttons
    - About: project link, license, author, version, release date, and the
      commit, which links to the commit in the repository
@@ -1651,10 +1657,11 @@ view would leave a wallet one click from deletion.
    - Tap wallet name → inline rename field (no screen change)
    - `[x]` on a tracked token → removes it in place (no screen change)
    - `[x]` on an allowed or connected site → disconnects that site, in place:
-      its hostname is dropped from Allowed Sites under every address, and
+      its origin is dropped from Allowed Sites under every address, and
      `AUTISTMASK_REMOVE_SITE` has the background end every connection approved
-      without "Remember" from an origin with that hostname, under any address,
-      and send `accountsChanged` with an empty list to the site's open tabs.
+      without "Remember" from that origin, under any address, and send
+      `accountsChanged` with an empty list to the open tabs of that origin. The
+      same host under another scheme or port is another site and is left alone.
      Only the extension's own pages may send either message
    - `[x]` on a denied site → forgets the refusal, in place; it connects
      nothing and tells the background nothing
@@ -1838,14 +1845,22 @@ view would leave a wallet one click from deletion.

 - **When**: A website requests wallet access via `eth_requestAccounts` or
  `wallet_requestPermissions` and is on neither the allowed nor the denied list.
-  The background script prefers the toolbar popup (`action.openPopup()`) and
-  falls back to a separate popup window (`src/background/index.js`,
-  `requestApproval()`).
+  A site is its full origin, `scheme://host[:port]`, on both lists and for a
+  connection allowed without "Remember": a choice for `https://dapp.example`
+  says nothing about `http://dapp.example` or another port of that host. The
+  background script prefers the toolbar popup (`action.openPopup()`) and falls
+  back to a separate popup window (`src/background/index.js`,
+  `requestApproval()`). Only one exists per site at a time: a further connection
+  request from a site whose prompt is still unanswered is refused with EIP-1193
+  code `-32002` and opens no new prompt. If that prompt was in a toolbar popup
+  that closed before it connected, and the toolbar popup has since been set to
+  open something else, the refused request shows that prompt again.
 - **Elements**:
    - "Connection Request" heading
    - Phishing warning banner (shown when the hostname is on the phishing
      blocklist)
-    - Site hostname (bold) + "wants to connect to your wallet"
+    - Site origin (bold, scheme and port included) + "wants to connect to your
+      wallet"
    - Address that will be shared (color dot + full address + etherscan link)
    - "Remember my choice for this site" checkbox
    - "Allow" / "Deny" buttons
@@ -1864,18 +1879,22 @@ view would leave a wallet one click from deletion.
  programmatically rather than by a user gesture. The background populates the
  transaction (nonce, gas limit, fees, chain id) against the RPC node _before_
  opening the window, so the screen shows a complete transaction and the signed
-  artifact can be compared with it field for field. A request that cannot be
-  populated — unreachable node, reverting gas estimate — opens no window and is
-  failed back to the site. Only one transaction approval exists at a time:
-  populating fixes the nonce, so a second `eth_sendTransaction` arriving while
-  one is unanswered is refused with EIP-1193 code `-32002` rather than being
-  populated at the same nonce. It opens no window and takes no nonce, and the
-  site can send it again once the pending one is answered.
+  artifact can be compared with it field for field. A nonce the site supplies is
+  ignored: the nonce is always the account's next nonce from the node, so a site
+  cannot replace one of the user's pending transactions or leave this one stuck
+  behind a gap. A request that cannot be populated — unreachable node, reverting
+  gas estimate — opens no window and is failed back to the site. Only one
+  transaction approval exists at a time: populating fixes the nonce, so a second
+  `eth_sendTransaction` arriving while one is unanswered is refused with
+  EIP-1193 code `-32002` rather than being populated at the same nonce. It opens
+  no window and takes no nonce, and the site can send it again once the pending
+  one is answered.
 - **Elements**:
    - "Transaction Request" heading
    - Phishing warning banner (shown when the hostname is on the phishing
      blocklist)
-    - Site hostname (bold) + "wants to send a transaction"
+    - Site origin (bold, scheme and port included) + "wants to send a
+      transaction"
    - Decoded action (if calldata is recognized): action name, token details,
      amounts, steps, deadline (see Transaction Decoding)
    - From: color dot + full address + etherscan link
@@ -1901,19 +1920,32 @@ view would leave a wallet one click from deletion.

 - **When**: A connected website requests a message signature via
  `personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened the same way as
-  TxApproval, in a separate popup window.
+  TxApproval, in a separate popup window. Only one exists per site at a time: a
+  further signature request, by any of these methods, from a site whose
+  signature request is still unanswered is refused with EIP-1193 code `-32002`
+  and opens no window.
 - **Elements**:
    - "Signature Request" heading
    - Phishing warning banner (shown when the hostname is on the phishing
      blocklist)
-    - Site hostname (bold) + "wants you to sign a message"
+    - Site origin (bold, scheme and port included) + "wants you to sign a
+      message"
    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
    - Type: "Personal message" or "Typed data (EIP-712)"
    - From: color dot + full address + etherscan link
-    - Message: decoded UTF-8 text (personal_sign) or formatted domain/type/
-      message fields (EIP-712 typed data). The primary type shown is the one
-      ethers signs, derived from the typed data's `types`, not the type the site
-      states.
+    - Message: for `personal_sign` and `eth_sign`, the text the message's bytes
+      decode to as UTF-8, laid out left to right in the order of the bytes that
+      are signed, right-to-left characters included. Each control character,
+      each line or paragraph separator (U+2028, U+2029; left in the text, a
+      paragraph separator would end that layout for the text after it), and each
+      character that paints nothing (format characters such as zero-width and
+      bidirectional ones, default-ignorable characters such as variation
+      selectors and Hangul fillers, and DELETE), is shown as a bordered `U+XXXX`
+      mark instead of acting on the text; a line feed is shown as a line break.
+      Bytes that are not UTF-8 are shown as "This message is not text." For
+      typed data, formatted domain/type/message fields (EIP-712). The primary
+      type shown is the one ethers signs, derived from the typed data's `types`,
+      not the type the site states.
    - Token permission warning, at the top of the message (typed data whose
      primary type is `Permit`, as in EIP-2612, or one of Permit2's signature
      types): "⚠️ TOKEN PERMISSION: Signing this lets the spender below take the
@@ -1925,12 +1957,20 @@ view would leave a wallet one click from deletion.
      domain's `verifyingContract`; any those fields do not give is shown as
      `Unknown`, and the domain, type and message lines still follow. Only typed
      data that cannot be read at all is shown as raw text.
+    - Raw data (`personal_sign` and `eth_sign`): the message's hex exactly as
+      the site sent it. The bytes it encodes are what is signed, as an EIP-191
+      personal message.
    - Password input and an error line
    - "Sign" / "Reject" buttons
 - **Transitions**:
    - Typed data that states no primary type, or one other than the type it
      would be signed as, or that cannot be read → shown with the error line
      saying so and "Sign" disabled; only "Reject" remains
+    - A `personal_sign` or `eth_sign` message that is not hex (`0x` or `0X` and
+      an even number of hex digits, the form ethers' `getBytes` reads when
+      signing) → shown as plain text, with the error line "This message is plain
+      text, not hex, so it cannot be signed." and "Sign" disabled; signing takes
+      the bytes from the hex, so such a message has none to sign
    - "Sign" (correct password) → signs locally → closes popup (returns
      signature)
    - "Sign" (wrong password, or a signing failure) → error line, no screen
@@ -1941,9 +1981,19 @@ view would leave a wallet one click from deletion.

 #### StateRecovery (`state-recovery`)

- **When**: `loadState()` refused the stored profile, so the popup has no
-  profile at all. It is the only screen reached without one, and the only one
-  that never appears during ordinary use.
+- **When**: the stored profile fails `assertStateUsable()`. At open, that is
+  `loadState()` refusing it, so the popup has no profile at all. While the popup
+  is open, on any screen, it is a save refusing it: every `saveState()` reads
+  the stored record and runs the same check before writing, so the popup finds
+  it at the next navigation or ten-second refresh, whether or not the network
+  answers ([#373](https://git.eeqj.de/sneak/AutistMask/issues/373)). A save that
+  fails for any other reason, such as a storage read or write that errors, gets
+  the "NOT SAVED" banner instead and leaves the screen as it is. The screen it
+  replaces is left as any navigation leaves it, so a revealed phrase or key, or
+  a typed password, is wiped. Once up, the screen stays until the popup closes
+  or reloads: work still running in the popup, such as a transaction wait,
+  cannot replace it, even after the record is erased in another window. It is
+  the only screen that never appears during ordinary use.
 - **Why it exists**: a record the wallet cannot read used to render nothing — no
  view, no message, no control — while every dApp call answered a generic
  internal error, and no reset or wipe control existed anywhere in the product.
@@ -1970,16 +2020,20 @@ view would leave a wallet one click from deletion.
      Nothing was erased." on the error line
 - **No other control is reachable.** The Settings gear is hidden while this
  screen is up, because every screen behind it renders from the profile that
-  could not be read, and `showView()` is not used to raise it for the same
-  reason — it reads and writes the state singleton.
+  could not be read. `showView()` is not used to raise it, for the same reason:
+  it reads and writes the state singleton. Under an open popup the screen is
+  passed to `showView()` only to run the replaced screen's cleanup; from then on
+  `showView()` shows nothing else in that popup.
 - **Both controls are required.** An export with no reset leaves the user
  looking at a broken profile with no way to use the wallet again; a reset with
  no export destroys the only copy of a record that may hold recoverable key
  material. The typed phrase is the same barrier DeleteWalletLostPassword uses,
  and for the same reason: there is no password to gate this with, since there
  is no profile to check one against.
- Not in `RESTORABLE_VIEWS`: it is never persisted as the current view, because
-  nothing on this path writes state at all.
+- Not in `RESTORABLE_VIEWS`, and never recorded as the current view: the record
+  can become readable again under an open popup, erased in another window, and
+  the next save from that popup then succeeds. A popup opened after that opens
+  normally.

 ### External Services

@@ -2151,6 +2205,17 @@ the log level and turns the banner on, and that is all it may ever do: it feeds
 constant directly, so no runtime toggle in a release build can reach the
 hardcoded test phrase.

+At the raised log level the console also shows the wallet's addresses with their
+balances and ENS names, the token contracts looked up, and a line for each
+request made through `debugFetch` in `src/shared/log.js` (the explorer, the
+price feed, the RPC calls a site makes, and the endpoint checks in settings) and
+for its response. A request is logged by its HTTP method, the origin of its URL
+(scheme, host and port) and, for a JSON-RPC call, the method name; the balance
+refresh, the token lookup and a failed endpoint check in settings name the
+endpoint by its origin too. The URL's path and query string, where RPC providers
+put API keys, any user name and password in it, and the request body are never
+logged.
+
 ### Key Decisions

 - **No framework**: The popup UI is vanilla JS and HTML. The extension is small
@@ -45,6 +45,103 @@ but the review is broader than any of them.

 # Completed Steps

+- 2026-10-04: A popup that is already open when the stored profile becomes
+  unreadable moves to the recovery screen
+  ([#373](https://git.eeqj.de/sneak/AutistMask/issues/373)). It used to stay on
+  the last good profile, with the "NOT SAVED" banner at most, until reopened.
+  Every save already ran the check the popup runs at open, so the popup finds
+  the record at the next navigation or ten-second refresh, whether or not the
+  network answers; a save that fails that check now raises the recovery screen
+  and stops the refresh. The screen it replaces is left as any navigation leaves
+  it, so a revealed phrase or key or a typed password is wiped. Once up, nothing
+  else in that popup can replace it, and a later save or a transaction wait that
+  ends does not clear an export or a typed confirmation. It is never saved as
+  the current view, so a popup opened after the record is erased in another
+  window opens normally. Any other failed save still gets the banner and leaves
+  the screen alone.
+- 2026-10-04: The signature screen shows a personal message as the bytes that
+  are signed ([#403](https://git.eeqj.de/sneak/AutistMask/issues/403)). It
+  showed only the decoded text, with bidirectional and zero-width characters
+  acting on it, so a site could make the message read differently from what is
+  signed, and a message that was not hex was shown as NUL characters. The hex is
+  now shown as "Raw data" alongside the decoded text, the text is laid out left
+  to right in byte order, control characters, line and paragraph separators and
+  characters that paint nothing are shown as `U+XXXX` marks, and a message that
+  is not hex by the rule signing reads it with is shown as plain text with
+  "Sign" disabled, since such a message has no bytes to sign.
+- 2026-10-04: A token that reports more than 80 decimal places has no known
+  scale ([#350](https://git.eeqj.de/sneak/AutistMask/issues/350)). The shared
+  scale check `toDecimals()` accepted any `uint8`, but `formatUnits()` throws
+  above 80, so such a token left a swap or an ERC-20 call on the approval screen
+  undecoded, with nothing saying why. The check now stops at 80, and both
+  approval paths show the base-unit amount with the scale stated as unknown. The
+  balance list and the history list use the same check, so the same token no
+  longer stops an address's token balances from refreshing or its history from
+  loading.
+- 2026-10-04: Debug mode no longer writes RPC API keys to the console
+  ([#410](https://git.eeqj.de/sneak/AutistMask/issues/410)). `debugFetch` logged
+  every request's full URL and body, so an RPC endpoint with a key in its path
+  or query string printed that key on every request. It now logs the HTTP
+  method, the URL's origin and, for a JSON-RPC call, the method name. The
+  balance refresh and token lookup log the RPC endpoint by its origin too. A
+  failed RPC call's error line prints the error's short message, which names the
+  HTTP status, not its full message, which carries the request URL. A failed
+  endpoint check in settings names the endpoint by its origin, not the `fetch`
+  error's message, which carries the whole URL, password included, for a URL
+  with a user name and password. The README's DEBUG Mode Policy says what debug
+  mode logs.
+
+- 2026-10-04: A site has at most one connection prompt and one signature prompt
+  open at a time ([#405](https://git.eeqj.de/sneak/AutistMask/issues/405)). Each
+  `eth_requestAccounts` or `personal_sign` call opened another approval window,
+  so a page calling in a loop could cover the screen with identical prompts. A
+  further request of the same kind from a site whose prompt is still unanswered
+  is now refused with EIP-1193 `-32002`, the code a second transaction already
+  gets, and opens no window. Signing by `personal_sign`, `eth_sign` and
+  `eth_signTypedData_v4` counts as one kind. Other sites are not affected, and
+  the site may ask again once the user has answered. A connection prompt whose
+  toolbar popup closed before it connected, and which nothing shows any more, is
+  shown again when the site asks again.
+
+- 2026-10-04: A nonce the site supplies with `eth_sendTransaction` is ignored
+  ([#404](https://git.eeqj.de/sneak/AutistMask/issues/404)). It was passed on to
+  the transaction, so a site could replace one of the user's pending
+  transactions (same nonce, higher fee) or leave the new one stuck behind a gap,
+  and the approval screen showed it as a bare number. `nonce` is no longer one
+  of the fields taken from the request in `src/shared/approvalTx.js`, so the
+  transaction always gets the account's next nonce from the node, and that is
+  the nonce the approval screen shows and the popup signs.
+
+- 2026-10-04: Remembered site permissions are held by full origin
+  ([#402](https://git.eeqj.de/sneak/AutistMask/issues/402)). `allowedSites` and
+  `deniedSites` stored the hostname alone, so a grant to `https://dapp.example`
+  also authorised `http://dapp.example` and every port on that host, and the
+  prompts named only the hostname. Both lists now store and match the origin
+  (`scheme://host[:port]`), the key the connections approved without "Remember"
+  already used, in `src/background/index.js` and in Settings, whose site lists
+  and `AUTISTMASK_REMOVE_SITE` carry the origin too. The connection, transaction
+  and signature prompts show the origin. Entries saved by hostname before this
+  change are not migrated (pre-1.0): they match no site, and Settings lists them
+  until they are removed.
+
+- 2026-10-04: A page's request is credited only to the site the browser says
+  sent it ([#407](https://git.eeqj.de/sneak/AutistMask/issues/407)). Where the
+  browser does not give the sender's origin (Firefox before 126), the background
+  used the tab's page, so a frame from another site would have been treated as
+  the site embedding it, and with no tab it used an origin the page wrote into
+  the message. It now uses the URL of the frame that sent the message, and
+  refuses the request with code 4100 when the browser gives neither. The content
+  script no longer writes an origin into the message.
+
+- 2026-10-04: `make test` takes 8-13s on the shared build host, down from
+  17-25s, measured in alternating runs before and after the change
+  ([#428](https://git.eeqj.de/sneak/AutistMask/issues/428)). Each popup boot in
+  the tests (`tests/support/popupBoot.js`) resets jest's module registry so that
+  everything under `src/` loads fresh, and that also reloaded `ethers`,
+  `libsodium-wrappers-sumo`, `qrcode` and `ethereum-blockies-base64` every time.
+  Those four libraries are now loaded once per test file and handed to every
+  boot. No test or assertion changed.
+
 - 2026-10-04: A token whose scale is unknown reads the same on the Send screen
  as on the confirmation screen
  ([#377](https://git.eeqj.de/sneak/AutistMask/issues/377)). When two addresses'
@@ -285,11 +285,13 @@ not appear and may be permanently lost.
 AutistMask injects a standard `window.ethereum` provider (EIP-1193) into web
 pages. When a site requests access to your wallet:

-1. A popup appears showing the site's hostname and the address that will be
-   shared.
+1. A popup appears showing the site's origin (its scheme, host and port, for
+   example `https://app.example`) and the address that will be shared.
 2. Click "Allow" to connect or "Deny" to reject.
 3. Optionally check "Remember my choice for this site" to skip the prompt next
-   time.
+   time. The choice applies to that exact origin only: a choice remembered for
+   `https://app.example` does not cover `http://app.example` or another port of
+   the same host, which ask again.

 When a connected site requests a transaction, a separate approval popup appears
 showing the transaction details (from, to, value, data, network fee, network and
@@ -5,12 +5,12 @@
 # many-core shared host one per core took gigabytes of RAM per run.
 #
 # The timeout bounds a hung suite; it is not a performance budget. On the busy
-# shared build host the suite takes 23-29s with three workers, so
-# REPO_POLICIES' 30s cap is tight there, not comfortable. Inside the image the
-# same suite also pays a cold jest cache and shares the runner with the rest of
-# the build, which is not what that budget describes, so the Dockerfile raises
-# the bound through AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a
-# cold cache produces a red that means nothing, and teaches "just run it again".
+# shared build host the suite takes 8-13s with three workers, inside
+# REPO_POLICIES' 20s budget. Inside the image the same suite also pays a cold
+# jest cache and shares the runner with the rest of the build, which is not what
+# that budget describes, so the Dockerfile raises the bound through
+# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
+# produces a red that means nothing, and teaches "just run it again".
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -57,9 +57,13 @@ const windowsNs = windowsApi();
 const actionNs = actionApi();

 // Connected sites (in-memory, non-persisted): { "origin:address": true }
+//
+// A site is its full origin (scheme://host[:port]), here and in the
+// remembered allowedSites/deniedSites lists alike: a grant to
+// https://dapp.example says nothing about http://dapp.example or another port.
 const connectedSites = {};

-// Pending approval requests: { id: { origin, hostname, resolve } }
+// Pending approval requests: { id: { origin, resolve } }
 const pendingApprovals = {};

 // One transaction approval at a time, wallet-wide.
@@ -83,7 +87,8 @@ const pendingApprovals = {};
 // authority on a nonce the network has not accepted, which an abandoned
 // approval then leaves a hole in.
 //
-// Sign approvals are not gated: a signature consumes no nonce.
+// Sign approvals do not take this slot: a signature consumes no nonce. They are
+// limited per site instead; see findPendingApproval().
 //
 // The slot is null when free, and otherwise the handle of the request holding
 // it. Once that request has raised its approval the handle carries the
@@ -95,7 +100,7 @@ let txApprovalSlot = null;

 // EIP-1474 "resource unavailable": the standard code for a request that is
 // refused because another one is already pending.
-const TX_APPROVAL_PENDING_CODE = -32002;
+const APPROVAL_PENDING_CODE = -32002;

 // True at every moment this can be sent: the slot is taken immediately before
 // the transaction is populated, so the other request is either being prepared
@@ -132,6 +137,22 @@ function releaseTxApprovalSlotFor(approvalId) {
    }
 }

+// One site-connection approval and one sign approval per site at a time: a
+// page that asks again before the user has answered is refused with the code
+// above instead of opening another window, so it cannot bury the user in
+// prompts. The pending approval itself holds the place, so a caller must test
+// this and raise its approval with nothing awaited in between.
+function findPendingApproval(origin, type) {
+    return Object.values(pendingApprovals).find(
+        (approval) => approval.origin === origin && approval.type === type,
+    );
+}
+
+const APPROVAL_PENDING_MESSAGE =
+    "AutistMask is already waiting for your answer to a request of this kind" +
+    " from this site, so this one was not shown. Please answer that one," +
+    " then send this one again.";
+
 // Nonces this worker has already handed to the node, per chain and address.
 // This is the wallet's own knowledge that a nonce is spent, and it is checked
 // before a broadcast rather than after: a node's pending count can lag a
@@ -284,7 +305,12 @@ async function proxyRpc(method, params) {
    return json.result;
 }

+// The site-connection approval the toolbar popup is set to open, or null while
+// it opens the wallet. Set only by resetPopupUrl() and showInToolbarPopup().
+let toolbarPopupApprovalId = null;
+
 function resetPopupUrl() {
+    toolbarPopupApprovalId = null;
    if (actionNs && typeof actionNs.setPopup === "function") {
        actionNs.setPopup({ popup: "src/popup/index.html" });
    }
@@ -459,29 +485,36 @@ async function openApprovalWindow(id) {

 // Open an approval popup and return a promise that resolves with the user decision.
 // Prefers the browser-action popup (anchored to toolbar, no macOS Space switch).
-function requestApproval(origin, hostname) {
+function requestApproval(origin) {
    return new Promise((resolve) => {
        const id = crypto.randomUUID();
-        pendingApprovals[id] = { id, origin, hostname, resolve };
+        pendingApprovals[id] = { id, origin, resolve, type: "site" };

        if (actionNs && typeof actionNs.openPopup === "function") {
-            actionNs.setPopup({
-                popup: "src/popup/index.html?approval=" + id,
-            });
-            try {
-                const result = actionNs.openPopup();
-                if (result && typeof result.catch === "function") {
-                    result.catch(() => openApprovalWindow(id));
-                }
-            } catch {
-                openApprovalWindow(id);
-            }
+            showInToolbarPopup(id);
        } else {
            openApprovalWindow(id);
        }
    });
 }

+// Show a site-connection approval in the toolbar popup, or in a separate popup
+// window when the browser will not open the toolbar popup.
+function showInToolbarPopup(id) {
+    toolbarPopupApprovalId = id;
+    actionNs.setPopup({
+        popup: "src/popup/index.html?approval=" + id,
+    });
+    try {
+        const result = actionNs.openPopup();
+        if (result && typeof result.catch === "function") {
+            result.catch(() => openApprovalWindow(id));
+        }
+    } catch {
+        openApprovalWindow(id);
+    }
+}
+
 // Open a tx-approval popup and return a promise that resolves with txHash or error.
 // Uses windows.create() directly because tx approvals are triggered programmatically
 // (from a dApp RPC call), not from a user gesture, so action.openPopup() is
@@ -495,13 +528,12 @@ function requestApproval(origin, hostname) {
 // screen never named.
 // `slot` is the transaction-approval slot its caller holds. Handing the
 // approval's id to it is what makes retiring the approval free the slot.
-function requestTxApproval(origin, hostname, approvedTx, approvedFrom, slot) {
+function requestTxApproval(origin, approvedTx, approvedFrom, slot) {
    return new Promise((resolve) => {
        const id = crypto.randomUUID();
        pendingApprovals[id] = {
            id,
            origin,
-            hostname,
            approvedTx,
            approvedFrom,
            resolve,
@@ -517,13 +549,12 @@ function requestTxApproval(origin, hostname, approvedTx, approvedFrom, slot) {
 // Uses windows.create() directly because sign approvals are triggered programmatically
 // (from a dApp RPC call), not from a user gesture, so action.openPopup() is
 // unreliable in this context.
-function requestSignApproval(origin, hostname, signParams, approvedFrom) {
+function requestSignApproval(origin, signParams, approvedFrom) {
    return new Promise((resolve) => {
        const id = crypto.randomUUID();
        pendingApprovals[id] = {
            id,
            origin,
-            hostname,
            signParams,
            approvedFrom,
            resolve,
@@ -601,11 +632,11 @@ runtime.onConnect.addListener((port) => {
 // in the worker — a balance refresh in flight, another site's approval — has
 // gone on running the whole time. Loading here used to replace the very
 // objects that work was holding.
-async function rememberSiteChoice(field, address, hostname) {
+async function rememberSiteChoice(field, address, origin) {
    await updateState((s) => {
        if (!s[field][address]) s[field][address] = [];
-        if (!s[field][address].includes(hostname)) {
-            s[field][address].push(hostname);
+        if (!s[field][address].includes(origin)) {
+            s[field][address].push(origin);
        }
    });
 }
@@ -618,12 +649,11 @@ async function handleConnectionRequest(origin) {
        return { error: { message: "No accounts available" } };
    }

-    const hostname = extractHostname(origin);
    const allowed = s.allowedSites[activeAddress] || [];
    const denied = s.deniedSites[activeAddress] || [];

    // Check denied list
-    if (denied.includes(hostname)) {
+    if (denied.includes(origin)) {
        return {
            error: {
                code: 4001,
@@ -634,25 +664,50 @@ async function handleConnectionRequest(origin) {

    // Check allowed list or in-memory connected
    if (
-        allowed.includes(hostname) ||
+        allowed.includes(origin) ||
        connectedSites[origin + ":" + activeAddress]
    ) {
        return { result: [activeAddress] };
    }

+    const pending = findPendingApproval(origin, "site");
+    if (pending) {
+        // A toolbar popup that closed before it connected leaves its prompt
+        // pending, and once the toolbar popup is set to open something else
+        // nothing shows that prompt: the site would be refused until the
+        // address changed. Show it again. A prompt in a window or in a
+        // connected popup is settled when that closes, and one the toolbar
+        // popup is still set to open is a click away, so those are left alone.
+        if (
+            actionNs &&
+            typeof actionNs.openPopup === "function" &&
+            !pending.windowId &&
+            !pending.portConnected &&
+            toolbarPopupApprovalId !== pending.id
+        ) {
+            showInToolbarPopup(pending.id);
+        }
+        return {
+            error: {
+                code: APPROVAL_PENDING_CODE,
+                message: APPROVAL_PENDING_MESSAGE,
+            },
+        };
+    }
+
    // Open approval popup
-    const decision = await requestApproval(origin, hostname);
+    const decision = await requestApproval(origin);

    if (decision.approved) {
        if (decision.remember) {
-            await rememberSiteChoice("allowedSites", activeAddress, hostname);
+            await rememberSiteChoice("allowedSites", activeAddress, origin);
        } else {
            connectedSites[origin + ":" + activeAddress] = true;
        }
        return { result: [activeAddress] };
    } else {
        if (decision.remember) {
-            await rememberSiteChoice("deniedSites", activeAddress, hostname);
+            await rememberSiteChoice("deniedSites", activeAddress, origin);
        }
        return {
            error: {
@@ -698,10 +753,9 @@ async function handleRpc(method, params, origin) {
        const s = await getState();
        const activeAddress = activeAddressOf(s);
        if (!activeAddress) return { result: [] };
-        const hostname = extractHostname(origin);
        const allowed = s.allowedSites[activeAddress] || [];
        if (
-            allowed.includes(hostname) ||
+            allowed.includes(origin) ||
            connectedSites[origin + ":" + activeAddress]
        ) {
            return { result: [activeAddress] };
@@ -731,10 +785,9 @@ async function handleRpc(method, params, origin) {
        // [TESTNET] banner under a user who believed they were on Sepolia.
        const s = await getState();
        const activeAddress = activeAddressOf(s);
-        const hostname = extractHostname(origin);
        const allowed = s.allowedSites[activeAddress] || [];
        if (
-            !allowed.includes(hostname) &&
+            !allowed.includes(origin) &&
            !connectedSites[origin + ":" + activeAddress]
        ) {
            return { error: { code: 4100, message: "Unauthorized" } };
@@ -806,10 +859,9 @@ async function handleRpc(method, params, origin) {
    if (method === "wallet_getPermissions") {
        const s = await getState();
        const activeAddress = activeAddressOf(s);
-        const hostname = extractHostname(origin);
        const allowed = s.allowedSites[activeAddress] || [];
        const isConnected =
-            allowed.includes(hostname) ||
+            allowed.includes(origin) ||
            connectedSites[origin + ":" + activeAddress];
        if (!isConnected || !activeAddress) {
            return { result: [] };
@@ -835,10 +887,9 @@ async function handleRpc(method, params, origin) {
        if (!activeAddress)
            return { error: { message: "No accounts available" } };

-        const hostname = extractHostname(origin);
        const allowed = s.allowedSites[activeAddress] || [];
        if (
-            !allowed.includes(hostname) &&
+            !allowed.includes(origin) &&
            !connectedSites[origin + ":" + activeAddress]
        ) {
            return { error: { code: 4100, message: "Unauthorized" } };
@@ -868,9 +919,16 @@ async function handleRpc(method, params, origin) {
                "Only proceed if you fully understand what you are signing.";
        }

+        if (findPendingApproval(origin, "sign")) {
+            return {
+                error: {
+                    code: APPROVAL_PENDING_CODE,
+                    message: APPROVAL_PENDING_MESSAGE,
+                },
+            };
+        }
        const decision = await requestSignApproval(
            origin,
-            hostname,
            signParams,
            activeAddress,
        );
@@ -884,10 +942,9 @@ async function handleRpc(method, params, origin) {
        if (!activeAddress)
            return { error: { message: "No accounts available" } };

-        const hostname = extractHostname(origin);
        const allowed = s.allowedSites[activeAddress] || [];
        if (
-            !allowed.includes(hostname) &&
+            !allowed.includes(origin) &&
            !connectedSites[origin + ":" + activeAddress]
        ) {
            return { error: { code: 4100, message: "Unauthorized" } };
@@ -903,9 +960,16 @@ async function handleRpc(method, params, origin) {
                },
            };
        }
+        if (findPendingApproval(origin, "sign")) {
+            return {
+                error: {
+                    code: APPROVAL_PENDING_CODE,
+                    message: APPROVAL_PENDING_MESSAGE,
+                },
+            };
+        }
        const decision = await requestSignApproval(
            origin,
-            hostname,
            signParams,
            activeAddress,
        );
@@ -946,10 +1010,9 @@ async function handleSendTransaction(params, origin) {
    const activeAddress = activeAddressOf(s);
    if (!activeAddress) return { error: { message: "No accounts available" } };

-    const hostname = extractHostname(origin);
    const allowed = s.allowedSites[activeAddress] || [];
    if (
-        !allowed.includes(hostname) &&
+        !allowed.includes(origin) &&
        !connectedSites[origin + ":" + activeAddress]
    ) {
        return { error: { code: 4100, message: "Unauthorized" } };
@@ -976,7 +1039,7 @@ async function handleSendTransaction(params, origin) {
    if (!slot) {
        return {
            error: {
-                code: TX_APPROVAL_PENDING_CODE,
+                code: APPROVAL_PENDING_CODE,
                message: TX_APPROVAL_PENDING_MESSAGE,
            },
        };
@@ -1023,7 +1086,6 @@ async function handleSendTransaction(params, origin) {

        const decision = await requestTxApproval(
            origin,
-            hostname,
            approvedTx,
            activeAddress,
            slot,
@@ -1097,10 +1159,9 @@ async function broadcastAccountsChanged() {
    }
    for (const tab of tabs) {
        const origin = tab.url ? new URL(tab.url).origin : "";
-        const hostname = extractHostname(origin);
        const hasPermission =
            activeAddress &&
-            (allowed.includes(hostname) ||
+            (allowed.includes(origin) ||
                connectedSites[origin + ":" + activeAddress]);
        // Same as chainChanged above: a tab without our content script
        // rejects, and that is expected rather than a fault.
@@ -1113,7 +1174,7 @@ async function broadcastAccountsChanged() {
 }

 // Tell every open tab of a site Settings removed that it has no account.
-async function broadcastSiteRemoved(hostname) {
+async function broadcastSiteRemoved(origin) {
    let tabs;
    try {
        tabs = await tabsQuery({});
@@ -1121,7 +1182,7 @@ async function broadcastSiteRemoved(hostname) {
        return;
    }
    for (const tab of tabs) {
-        if (!tab.url || extractHostname(tab.url) !== hostname) continue;
+        if (!tab.url || new URL(tab.url).origin !== origin) continue;
        tabsSendMessage(tab.id, {
            type: "AUTISTMASK_EVENT",
            eventName: "accountsChanged",
@@ -1288,18 +1349,29 @@ if (windowsNs && windowsNs.onRemoved) {
 // Listen for messages from content scripts and popup
 runtime.onMessage.addListener((msg, sender, sendResponse) => {
    if (msg.type === "AUTISTMASK_RPC") {
-        // Derive origin from trusted sender info to prevent origin spoofing.
-        // Chrome MV3 provides sender.origin; Firefox MV2 fallback uses sender.tab.url.
-        let trustedOrigin = msg.origin; // fallback only if sender info unavailable
-        if (sender.origin) {
-            trustedOrigin = sender.origin;
-        } else if (sender.tab && sender.tab.url) {
+        // The origin is the one the browser reports for the sender, never one
+        // the message carries. Firefox before 126 gives no sender.origin, so
+        // the origin of sender.url is used: the frame that sent the message,
+        // not the tab's page, which may be another site embedding that
+        // frame. With neither, the request is refused.
+        let trustedOrigin = sender.origin;
+        if (!trustedOrigin && sender.url) {
            try {
-                trustedOrigin = new URL(sender.tab.url).origin;
+                trustedOrigin = new URL(sender.url).origin;
            } catch {
-                // keep fallback
+                // an unparseable URL leaves the origin unknown
            }
        }
+        if (!trustedOrigin) {
+            sendResponse({
+                error: {
+                    code: 4100,
+                    message:
+                        "The wallet could not tell which site sent this request.",
+                },
+            });
+            return false;
+        }
        handleRpc(msg.method, msg.params, trustedOrigin)
            .then((response) => {
                sendResponse(response);
@@ -1337,10 +1409,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
        const approval = pendingApprovals[msg.id];
        if (approval) {
-            const resp = {
-                hostname: approval.hostname,
-                origin: approval.origin,
-            };
+            const resp = { origin: approval.origin };
            if (approval.type === "tx") {
                resp.type = "tx";
                // The populated transaction, and the address it was raised
@@ -1355,7 +1424,9 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                resp.approvedFrom = approval.approvedFrom;
            }
            // Flag if the requesting domain is on the phishing blocklist.
-            resp.isPhishingDomain = isPhishingDomain(approval.hostname);
+            resp.isPhishingDomain = isPhishingDomain(
+                extractHostname(approval.origin),
+            );
            sendResponse(resp);
        } else {
            sendResponse(null);
@@ -1689,23 +1760,22 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
    if (msg.type === "AUTISTMASK_GET_CONNECTED_SITES") {
        sendResponse(
            Object.keys(connectedSites).map((key) =>
-                extractHostname(key.slice(0, key.lastIndexOf(":"))),
+                key.slice(0, key.lastIndexOf(":")),
            ),
        );
        return false;
    }

-    // Settings removed this site and has already dropped its remembered
-    // entries. Its connections approved without "Remember" end here, under
-    // every address, and its open tabs are told it has no account.
+    // Settings removed this site (msg.origin) and has already dropped its
+    // remembered entries. Its connections approved without "Remember" end
+    // here, under every address, and its open tabs are told it has no account.
    if (msg.type === "AUTISTMASK_REMOVE_SITE") {
        for (const key of Object.keys(connectedSites)) {
-            const origin = key.slice(0, key.lastIndexOf(":"));
-            if (extractHostname(origin) === msg.hostname) {
+            if (key.slice(0, key.lastIndexOf(":")) === msg.origin) {
                delete connectedSites[key];
            }
        }
-        broadcastSiteRemoved(msg.hostname);
+        broadcastSiteRemoved(msg.origin);
        return false;
    }
 });
@@ -30,7 +30,6 @@ window.addEventListener("message", (event) => {
        id,
        method,
        params,
-        origin: location.origin,
    })
        .then((response) => {
            if (response) {
@@ -1561,7 +1561,7 @@
                    with extreme caution.
                </div>
                <p class="mb-2">
-                    <span id="approve-tx-hostname" class="font-bold"></span>
+                    <span id="approve-tx-origin" class="font-bold"></span>
                    wants to send a transaction.
                </p>

@@ -1662,7 +1662,7 @@
                    funds. Proceed with extreme caution.
                </div>
                <p class="mb-2">
-                    <span id="approve-sign-hostname" class="font-bold"></span>
+                    <span id="approve-sign-origin" class="font-bold"></span>
                    wants you to sign a message.
                </p>

@@ -1698,6 +1698,15 @@
                    ></div>
                </div>

+                <div id="approve-sign-hex-section" class="mb-3 hidden">
+                    <div class="text-xs text-muted mb-1">Raw data</div>
+                    <div
+                        id="approve-sign-hex"
+                        class="text-xs break-all"
+                        style="max-height: 6rem; overflow-y: auto"
+                    ></div>
+                </div>
+
                <div class="mb-2">
                    <label class="block mb-1 text-xs">Password</label>
                    <input
@@ -1740,7 +1749,7 @@
                </div>
                <div class="mb-3">
                    <p class="mb-2">
-                        <span id="approve-hostname" class="font-bold"></span>
+                        <span id="approve-origin" class="font-bold"></span>
                        wants to connect to your wallet.
                    </p>
                    <div class="text-xs text-muted mb-1">
@@ -50,6 +50,10 @@ function renderWalletList() {

 let refreshInFlight = false;

+// The ten-second refresh init() starts, stopped when the popup moves to the
+// recovery screen: there is no profile left to refresh.
+let refreshTimer = null;
+
 async function doRefreshAndRender() {
    if (refreshInFlight) return;
    refreshInFlight = true;
@@ -155,7 +159,28 @@ async function init() {
    // reported rather than being swallowed by the save queue
    // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
    // the approval-window branch below too, since that window saves as well.
-    onSaveFailure(showSaveFailureBanner);
+    //
+    // Every save first reads the stored record and refuses it with the same
+    // check loadState() runs below. So a record that becomes unreadable while
+    // the popup is open is found by the next save, a navigation or the
+    // ten-second refresh, and gets the screen it would get at open
+    // (https://git.eeqj.de/sneak/AutistMask/issues/373). Passing the recovery
+    // screen to showView() first leaves the current screen as any navigation
+    // does, so a phrase, key or password on it is wiped, and from then on
+    // showView() shows nothing else. A later save that fails the same way,
+    // such as a refresh already in flight, comes back here, where both calls
+    // see the screen already up and do nothing. Any other failed save is a
+    // read or write that failed, and gets the banner without changing the
+    // screen.
+    onSaveFailure((e) => {
+        if (e instanceof StateUnusableError) {
+            clearInterval(refreshTimer);
+            showView("state-recovery");
+            stateRecovery.show(e);
+        } else {
+            showSaveFailureBanner(e);
+        }
+    });
    try {
        await loadState();
    } catch (e) {
@@ -244,7 +269,7 @@ async function init() {
        renderWalletList();
        restoreView();
        doRefreshAndRender();
-        setInterval(doRefreshAndRender, 10000);
+        refreshTimer = setInterval(doRefreshAndRender, 10000);
    }
 }

@@ -64,3 +64,13 @@ body {
    white-space: nowrap;
    overflow-x: auto;
 }
+
+/* A personal message on the signature screen is laid out left to right in
+ * the order of its bytes. Without this, right-to-left characters in it move
+ * the characters around them: `5`, U+05C3, `00` would read as `500`
+ * followed by U+05C3. A paragraph separator (U+2029) ends this layout for
+ * the text after it, so src/popup/views/approval.js shows one as a mark. */
+.am-byte-order {
+    direction: ltr;
+    unicode-bidi: bidi-override;
+}
@@ -26,6 +26,7 @@ const {
 } = require("ethers");
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
+const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
 const {
    resolveTokenDecimals,
    resolveTokenSymbol,
@@ -306,7 +307,7 @@ function showTxApproval(details) {
        };
    }

-    $("approve-tx-hostname").textContent = details.hostname;
+    $("approve-tx-origin").textContent = details.origin;
    $("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);

    // Show token symbol next to contract address if known
@@ -380,20 +381,48 @@ function showTxApproval(details) {
    );
 }

+// Whether a personal message is hex by the rule signing reads it with:
+// signing takes getBytes(message), which throws on anything else.
+function isHexMessage(message) {
+    try {
+        getBytes(message);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+// The text the hex message's bytes decode to as UTF-8, or null when they are
+// not UTF-8. The caller has checked that the message is hex.
 function decodeHexMessage(hex) {
    try {
-        const bytes = Uint8Array.from(
-            hex
-                .slice(2)
-                .match(/.{1,2}/g)
-                .map((b) => parseInt(b, 16)),
-        );
-        return toUtf8String(bytes);
+        return toUtf8String(getBytes(hex));
    } catch {
        return null;
    }
 }

+// A character shown as a bordered U+XXXX mark.
+function codePointMark(c) {
+    const code = c.codePointAt(0).toString(16).toUpperCase();
+    return `<span class="border border-border">U+${code.padStart(4, "0")}</span>`;
+}
+
+// The text as HTML, with each character that paints nothing (zero-width and
+// bidirectional characters, variation selectors and Hangul fillers among
+// them), each control character and each line or paragraph separator
+// (U+2028, U+2029) shown as a mark. A line feed is shown as a line break.
+// Left in the text, a paragraph separator would end the byte-order layout
+// for everything after it. The marks are plain ASCII, so the second pass
+// leaves them be.
+function markInvisibleCharacters(text) {
+    return escapeHtml(text)
+        .replace(INVISIBLE_CHARACTERS, codePointMark)
+        .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, (c) =>
+            c === "\n" ? "<br>" : codePointMark(c),
+        );
+}
+
 // The type ethers will sign typed data as. ethers does not read the page's
 // `primaryType`: it takes the one struct in `types` that no other struct
 // refers to. Throws when the types name no such single struct, which ethers
@@ -645,7 +674,7 @@ function showSignApproval(details) {
    pendingSignParams = sp;
    pendingSignFrom = details.approvedFrom;

-    $("approve-sign-hostname").textContent = details.hostname;
+    $("approve-sign-origin").textContent = details.origin;
    $("approve-sign-from").innerHTML = approvalAddressHtml(
        details.approvedFrom,
    );
@@ -657,15 +686,33 @@ function showSignApproval(details) {
        ? "Typed data (EIP-712)"
        : "Personal message";

+    // A personal message is signed as the bytes its hex encodes, so the hex
+    // is shown as well as any text it decodes to, and that text is laid out
+    // left to right in the order of its bytes. Signing reads the bytes from
+    // the hex, so a message that is not hex cannot be signed: it is shown as
+    // the text it is, and refused.
+    let refusal = null;
+    $("approve-sign-hex-section").classList.add("hidden");
+    $("approve-sign-message").classList.toggle("am-byte-order", !isTyped);
    if (isTyped) {
        $("approve-sign-message").innerHTML = formatTypedDataHtml(sp.typedData);
-    } else {
+        refusal = typedDataRefusal(sp);
+    } else if (isHexMessage(sp.message)) {
        const decoded = decodeHexMessage(sp.message);
        if (decoded !== null) {
-            $("approve-sign-message").textContent = decoded;
+            $("approve-sign-message").innerHTML =
+                markInvisibleCharacters(decoded);
        } else {
-            $("approve-sign-message").textContent = sp.message;
+            $("approve-sign-message").textContent = "This message is not text.";
        }
+        $("approve-sign-hex").textContent = sp.message;
+        $("approve-sign-hex-section").classList.remove("hidden");
+    } else {
+        $("approve-sign-message").innerHTML = markInvisibleCharacters(
+            sp.message,
+        );
+        refusal =
+            "This message is plain text, not hex, so it cannot be signed.";
    }

    // Display danger warning for eth_sign (raw hash signing)
@@ -687,7 +734,6 @@ function showSignApproval(details) {

    showView("approve-sign");
    attachCopyHandlers("view-approve-sign");
-    const refusal = typedDataRefusal(sp);
    if (refusal) {
        showError("approve-sign-error", refusal);
        $("btn-approve-sign").disabled = true;
@@ -732,7 +778,7 @@ async function show(id) {
        "approve-site-phishing-warning",
        details.isPhishingDomain,
    );
-    $("approve-hostname").textContent = details.hostname;
+    $("approve-origin").textContent = details.origin;
    $("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
    attachCopyHandlers("view-approve-site");
    $("approve-remember").checked = state.rememberSiteChoice;
@@ -395,7 +395,7 @@ async function estimateGas(txInfo) {
        feeWei = gasCostWei;
        renderValidation(txInfo);
    } catch (e) {
-        log.errorf("gas estimation failed:", e.message);
+        log.errorf("gas estimation failed:", e.shortMessage || e.message);
        if (pendingTx !== txInfo) return;
        $("confirm-fee-amount").textContent = "Unable to estimate";
        setVisible("confirm-fee-reserve", false);
@@ -52,9 +52,8 @@ const VIEWS = [
    "export-privkey",
    "show-phrase",
    // Shown by src/popup/views/stateRecovery.js when the stored profile
-    // cannot be read. It is never reached through showView() — by then the
-    // state singleton this file writes on every navigation refuses to be read
-    // — but it is listed so that every view-hiding loop covers it.
+    // cannot be read, never by showView() (see there), but listed so that
+    // every view-hiding loop covers it.
    "state-recovery",
 ];

@@ -85,12 +84,28 @@ function hideError(id) {
    el.style.visibility = "hidden";
 }

+// Set when src/popup/index.js passes the recovery screen to showView(), and
+// never cleared. Kept in memory for this popup's life, never in
+// state.currentView, which is saved: a popup opened later must not inherit it.
+let stateRecoveryShown = false;
+
 function showView(name) {
+    // The recovery screen, once up, is never replaced: work still running
+    // when it went up, such as a transaction wait, must not take the user off
+    // it or clear what they exported or typed there
+    // (https://git.eeqj.de/sneak/AutistMask/issues/373).
+    if (stateRecoveryShown) return;
    const leaving = state.currentView;
    if (leaving && leaving !== name) {
        const onLeave = viewLeaveHandlers.get(leaving);
        if (onLeave) onLeave();
    }
+    // Passed here only so the screen it replaces is left like any other;
+    // stateRecovery.show() raises it, and it is never the current view.
+    if (name === "state-recovery") {
+        stateRecoveryShown = true;
+        return;
+    }
    for (const v of VIEWS) {
        const el = document.getElementById(`view-${v}`);
        if (el) {
@@ -16,7 +16,12 @@ const {
 } = require("../dustThreshold");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { onChainSwitch } = require("../../shared/chainSwitch");
-const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
+const {
+    log,
+    debugFetch,
+    urlOrigin,
+    setRuntimeDebug,
+} = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
 const showPhrase = require("./showPhrase");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
@@ -34,35 +39,35 @@ const { notify, sendMessage } = require("../../shared/browserApi");
 let versionClickCount = 0;
 let versionClickTimer = null;

-// One row per hostname, however many addresses or origins it appears under,
-// each with an [x] that hands it to onRemove.
-function renderSiteList(containerId, hostnames, onRemove) {
+// One row per site origin, however many addresses it appears under, each with
+// an [x] that hands it to onRemove.
+function renderSiteList(containerId, origins, onRemove) {
    const container = $(containerId);
-    const unique = [...new Set(hostnames)];
+    const unique = [...new Set(origins)];
    if (unique.length === 0) {
        container.innerHTML = '<p class="text-xs text-muted">None</p>';
        return;
    }
    let html = "";
-    unique.forEach((hostname) => {
+    unique.forEach((origin) => {
        html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
-        // A hostname the URL parser produced cannot carry a delimiter, so
+        // An origin the URL parser produced cannot carry a delimiter, so
        // this is escaped for the rule rather than for a known hole — the
        // rule being that nothing reaches innerHTML unescaped.
-        html += `<span>${escapeHtml(hostname)}</span>`;
-        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
+        html += `<span>${escapeHtml(origin)}</span>`;
+        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-origin="${escapeHtml(origin)}">[x]</button>`;
        html += `</div>`;
    });
    container.innerHTML = html;
    container.querySelectorAll(".btn-remove-site").forEach((btn) => {
-        btn.addEventListener("click", () => onRemove(btn.dataset.hostname));
+        btn.addEventListener("click", () => onRemove(btn.dataset.origin));
    });
 }

-// Drop a hostname from a remembered site list under every address.
-function forgetHostname(siteMap, hostname) {
+// Drop a site origin from a remembered site list under every address.
+function forgetOrigin(siteMap, origin) {
    for (const addr of Object.keys(siteMap)) {
-        siteMap[addr] = siteMap[addr].filter((h) => h !== hostname);
+        siteMap[addr] = siteMap[addr].filter((o) => o !== origin);
        if (siteMap[addr].length === 0) {
            delete siteMap[addr];
        }
@@ -72,16 +77,16 @@ function forgetHostname(siteMap, hostname) {
 // Removing a site from Allowed Sites or Connected Sites disconnects it: it is
 // no longer allowed under any address, and the background ends its
 // connections approved without "Remember" and tells its open tabs.
-async function removeAllowedSite(hostname) {
-    forgetHostname(state.allowedSites, hostname);
+async function removeAllowedSite(origin) {
+    forgetOrigin(state.allowedSites, origin);
    await saveState();
-    notify({ type: "AUTISTMASK_REMOVE_SITE", hostname });
+    notify({ type: "AUTISTMASK_REMOVE_SITE", origin });
    await renderSiteLists();
 }

 // Removing a denied site only forgets the refusal; it connects nothing.
-async function removeDeniedSite(hostname) {
-    forgetHostname(state.deniedSites, hostname);
+async function removeDeniedSite(origin) {
+    forgetOrigin(state.deniedSites, origin);
    await saveState();
    await renderSiteLists();
 }
@@ -272,8 +277,11 @@ function init(ctx) {
                showFlash("Wrong network: expected " + net.name + ".");
                return;
            }
-        } catch (e) {
-            log.errorf("RPC validation fetch failed:", e.message);
+        } catch {
+            // Not the error's message: fetch puts the whole URL, password and
+            // key included, in the message of the error it throws for a URL
+            // with a user name and password or one it cannot parse.
+            log.errorf("RPC validation fetch failed:", urlOrigin(url));
            showFlash("Could not reach endpoint.");
            return;
        }
@@ -295,8 +303,9 @@ function init(ctx) {
                showFlash("Endpoint returned HTTP " + resp.status + ".");
                return;
            }
-        } catch (e) {
-            log.errorf("Blockscout validation failed:", e.message);
+        } catch {
+            // Not the error's message, as for the RPC check above.
+            log.errorf("Blockscout validation failed:", urlOrigin(url));
            showFlash("Could not reach endpoint.");
            return;
        }
@@ -3,8 +3,10 @@
 // Everything else in the popup assumes a loaded profile: showView() reads and
 // writes the state singleton, every view renders from it, and the Settings
 // gear leads to a screen that does both. None of that is available here — by
-// the time this runs, loadState() has REFUSED, deliberately, and reading the
-// singleton throws (https://git.eeqj.de/sneak/AutistMask/issues/311).
+// the time this runs, the stored record has been REFUSED, deliberately: at
+// open loadState() refused it and reading the singleton throws
+// (https://git.eeqj.de/sneak/AutistMask/issues/311), and under an open popup
+// a save refused it (https://git.eeqj.de/sneak/AutistMask/issues/373).
 //
 // So this module talks to the DOM directly and touches no state at all. It is
 // the one screen that must work when nothing else can, which is also why it
@@ -170,6 +172,11 @@ function wire() {
 *     refused, or its sentence.
 */
 function show(problem) {
+    // Already up: a later save that trips over the same record, such as a
+    // refresh that was in flight when the screen went up, must not clear what
+    // the user has exported or typed here.
+    if (!$("view-state-recovery").classList.contains("hidden")) return;
+
    const sentence =
        (problem && (problem.problem || problem.message)) || String(problem);

@@ -133,7 +133,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
            // failed — which matters most on a resumed wait, where the
            // first poll is already past the deadline.
            answered = false;
-            log.errorf("poll receipt failed:", e.message);
+            log.errorf("poll receipt failed:", e.shortMessage || e.message);
        }
        // The lookup is async: the wait may have ended while it was in
        // flight, in which case this result must not touch the view.
@@ -75,7 +75,7 @@ async function getFullWarnings(address, provider, options = {}) {
            });
        }
    } catch (e) {
-        log.errorf("contract check failed:", e.message);
+        log.errorf("contract check failed:", e.shortMessage || e.message);
    }

    // Skip tx count check for contracts — they may legitimately have
@@ -92,7 +92,7 @@ async function getFullWarnings(address, provider, options = {}) {
                });
            }
        } catch (e) {
-            log.errorf("tx count check failed:", e.message);
+            log.errorf("tx count check failed:", e.shortMessage || e.message);
        }
    }

@@ -23,11 +23,11 @@
 // disputed is refused rather than guessed at.

 // Solidity's decimals() is a uint8, and every source here is ultimately
-// reporting that call's result. toDecimals() is that check, shared with the
-// send path rather than copied: the bundled list stores numbers, the
-// explorer's copy arrives as a string, and a token the user added by hand
-// carries whatever lookupTokenInfo() got back, so the accepted types are
-// enumerated rather than coerced.
+// reporting that call's result. toDecimals() is that check, stopping at the 80
+// places formatUnits() accepts, and shared with the send path rather than
+// copied: the bundled list stores numbers, the explorer's copy arrives as a
+// string, and a token the user added by hand carries whatever lookupTokenInfo()
+// got back, so the accepted types are enumerated rather than coerced.
 const { toDecimals } = require("./transferAmount");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { isSpoofedSymbol } = require("./symbolSpoof");
@@ -51,11 +51,15 @@ const POPULATE_TIMEOUT_MS = 20000;
 // passed to ethers: the object is page-controlled, and a future ethers that
 // learns to carry a new transaction field must not start picking one up out of
 // it without this module knowing.
+//
+// The nonce is not taken from the page; it is always the account's next nonce
+// from the network. A page that chose it could replace one of the user's
+// pending transactions (the same nonce at a higher fee) or leave this one stuck
+// behind a gap (a nonce above the next one).
 const REQUEST_FIELDS = [
    "to",
    "value",
    "data",
-    "nonce",
    "gasLimit",
    "gasPrice",
    "maxFeePerGas",
@@ -10,7 +10,7 @@ const {
 } = require("ethers");
 const { ERC20_ABI } = require("./constants");
 const { NETWORKS } = require("./networks");
-const { log, debugFetch } = require("./log");
+const { log, debugFetch, urlOrigin } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
@@ -203,7 +203,7 @@ async function refreshBalances(
    trackedTokens,
    networkId,
 ) {
-    log.debugf("refreshBalances start, rpc:", rpcUrl);
+    log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
    const provider = getProvider(rpcUrl, networkId);
    const updates = [];

@@ -246,7 +246,7 @@ async function refreshBalances(
                        log.errorf(
                            "ENS reverse failed",
                            addr.address,
-                            e.message,
+                            e.shortMessage || e.message,
                        );
                        // Keep existing addr.ensName if we had one
                    }),
@@ -280,7 +280,7 @@ async function refreshBalances(
 // Look up token metadata from its contract.
 // Calls symbol() and decimals() to verify it implements ERC-20.
 async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
-    log.debugf("lookupTokenInfo", contractAddress, "rpc:", rpcUrl);
+    log.debugf("lookupTokenInfo", contractAddress, "rpc:", urlOrigin(rpcUrl));
    const provider = getProvider(rpcUrl, networkId);
    const contract = new Contract(contractAddress, ERC20_ABI, provider);

@@ -305,7 +305,10 @@ async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
        name = await contract.name();
        log.debugf("name() =", name);
    } catch (e) {
-        log.warnf("name() failed, using symbol as name:", e.message);
+        log.warnf(
+            "name() failed, using symbol as name:",
+            e.shortMessage || e.message,
+        );
        name = symbol;
    }

@@ -42,7 +42,11 @@ async function resolveEnsName(address, rpcUrl, networkId) {
        setCache(address, name);
        return name;
    } catch (e) {
-        log.errorf("ENS reverse lookup failed", address, e.message);
+        log.errorf(
+            "ENS reverse lookup failed",
+            address,
+            e.shortMessage || e.message,
+        );
        // Don't cache failures — let subsequent lookups retry
        return null;
    }
@@ -42,14 +42,34 @@ const log = {
    },
 };

-// Fetch wrapper that debug-logs every request and response.
+// The origin (scheme, host and port) of a URL, for logging in place of the
+// URL: RPC providers put API keys in the path or the query string, and a URL
+// can carry a user name and password, which the origin leaves out. A URL that
+// does not parse gives "", so logging never stops a request.
+function urlOrigin(url) {
+    try {
+        return new URL(url).origin;
+    } catch {
+        return "";
+    }
+}
+
+// Fetch wrapper that debug-logs every request and response. It logs the
+// URL's origin and, for a JSON-RPC body, the method name: never the full URL
+// or body, which can carry an API key or a signed transaction.
 async function debugFetch(url, opts) {
    const method = (opts && opts.method) || "GET";
-    const body = opts && opts.body;
-    log.debugf("fetch →", method, url, body || "");
+    const origin = urlOrigin(url);
+    let rpcMethod = "";
+    try {
+        rpcMethod = JSON.parse(opts.body).method || "";
+    } catch {
+        // no body, or a body that is not JSON
+    }
+    log.debugf("fetch →", method, origin, rpcMethod);
    const resp = await fetch(url, opts);
-    log.debugf("fetch ←", resp.status, url);
+    log.debugf("fetch ←", resp.status, origin);
    return resp;
 }

-module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
+module.exports = { log, debugFetch, urlOrigin, setRuntimeDebug, isDebug };
@@ -102,11 +102,11 @@ function tokenRefs(value) {

 // A list of strings, for the fields whose entries are dereferenced as text:
 // fraudContracts (`a.toLowerCase()` in src/popup/views/send.js and
-// src/shared/transactions.js) and each address's hostname list in the site maps
-// below (`h !== host` filters, `list.includes(hostname)` in the background).
+// src/shared/transactions.js) and each address's origin list in the site maps
+// below (`o !== origin` filters, `list.includes(origin)` in the background).
 //
 // Same rule as tokenRefs(), for the same reason: the container AND the entries,
-// with a malformed entry DROPPED rather than repaired. A number in a hostname
+// with a malformed entry DROPPED rather than repaired. A number in an origin
 // list names no site and a number in fraudContracts names no contract, so there
 // is nothing to repair either to, and the empty list is a legitimate value that
 // survives. The result is a fresh array of primitives, so it shares no
@@ -116,21 +116,22 @@ function textList(value) {
    return value.filter((entry) => typeof entry === "string");
 }

-// allowedSites / deniedSites: { [address]: [hostname, ...] }.
+// allowedSites / deniedSites: { [address]: [origin, ...] }, each origin the
+// full scheme://host[:port] of a site.
 //
 // The container check these had (truthy and not an array) is not the floor:
 // `{"0xabc…": "notalist"}` IS a non-array object, and the dereference is one
-// level below it. saveState() merges these maps per key and then per hostname
+// level below it. saveState() merges these maps per key and then per origin
 // WITHIN each key, so a stored value that is not a list reaches `base.map()` in
 // mergeListByIdentity() (src/shared/state.js) and throws — after the popup has
 // rendered, which is why every save from then on failed while the UI looked
 // healthy (https://git.eeqj.de/sneak/AutistMask/issues/362). The Settings
 // revoke button (`list.filter()`), and the background's
-// `allowed.includes(hostname)` gate, dereference it the same way; on that last
+// `allowed.includes(origin)` gate, dereference it the same way; on that last
 // one a stored string would also answer a SUBSTRING match, so a corrupt map
 // could widen a site permission rather than merely throw.
 //
-// An address key whose value is not a list of hostnames is dropped entirely: it
+// An address key whose value is not a list of origins is dropped entirely: it
 // grants and denies nothing, and dropping it fails closed. A stored own
 // "__proto__" key — which JSON can carry — is dropped for the same reason: it
 // can never be a wallet address, so it grants nothing either, and keeping it
@@ -143,9 +144,9 @@ function siteMap(value) {
    if (!isRecord(value)) return out;
    for (const address of Object.keys(value)) {
        if (address === "__proto__") continue;
-        const hostnames = textList(value[address]);
-        if (hostnames.length === 0) continue;
-        defineOwn(out, address, hostnames);
+        const origins = textList(value[address]);
+        if (origins.length === 0) continue;
+        defineOwn(out, address, origins);
    }
    return out;
 }
@@ -304,7 +304,7 @@ function mergeAddress(base, ours, theirs) {
 }

 // Merge a plain object keyed by string (allowedSites/deniedSites: address ->
-// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
+// origin list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
 // same way mergeListByIdentity() merges an array — by key, not by whole-
 // object diff — so a key one page added or removed applies independently of
 // a key another page edited. Unlike an array's identity function, an object
@@ -353,25 +353,25 @@ function mergeMapByKey(base, ours, theirs, mergeLeaf) {
    return result;
 }

-// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
+// allowedSites/deniedSites: { [address]: [origin, ...] }. The origin
 // list is itself membership, not a leaf — the background appends a newly
-// approved/denied hostname to it, and the Settings "revoke" button
-// (src/popup/views/settings.js) filters a hostname out of it in place, from a
+// approved/denied origin to it, and the Settings "revoke" button
+// (src/popup/views/settings.js) filters an origin out of it in place, from a
 // different page. Merge it the same way wallets are merged: identity is the
-// hostname itself, so a merged pair is always equal and mergeItem is a no-op
+// origin itself, so a merged pair is always equal and mergeItem is a no-op
 // pick.
-function mergeHostnameList(base, ours, theirs) {
+function mergeOriginList(base, ours, theirs) {
    return mergeListByIdentity(
        base,
        ours,
        theirs,
-        (hostname) => hostname,
+        (origin) => origin,
        (b, o, t) => t,
    );
 }

 function mergeSiteMap(base, ours, theirs) {
-    return mergeMapByKey(base, ours, theirs, mergeHostnameList);
+    return mergeMapByKey(base, ours, theirs, mergeOriginList);
 }

 // networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }.
@@ -422,8 +422,8 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // address) apply independently instead of colliding as the same field.
 //
 // `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
-// by address key and then by hostname within each address's list), for the
-// identical reason: the background appends a newly approved/denied hostname
+// by address key and then by origin within each address's list), for the
+// identical reason: the background appends a newly approved/denied origin
 // to them, and the Settings "revoke" button (src/popup/views/settings.js)
 // filters one out in place, from a different page. A whole-field diff here
 // doesn't just lose data, it is a security defect — a stale page's save can
@@ -34,6 +34,11 @@ function normalizeAddress(addr) {
    return (addr || "").toLowerCase();
 }

+// The characters that paint nothing; normalizeSymbol below says which they
+// are. The signature screen marks them in a personal message
+// (src/popup/views/approval.js).
+const INVISIBLE_CHARACTERS = /[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu;
+
 // Fold a symbol onto what a user actually sees, and no further:
 //
 //   NFKC        collapses compatibility variants that render as the ASCII
@@ -82,7 +87,7 @@ function normalizeAddress(addr) {
 function normalizeSymbol(symbol) {
    return String(symbol || "")
        .normalize("NFKC")
-        .replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
+        .replace(INVISIBLE_CHARACTERS, "")
        .trim()
        .toUpperCase();
 }
@@ -104,5 +109,6 @@ function isSpoofedSymbol(symbol, contractAddress) {
 }

 module.exports = {
+    INVISIBLE_CHARACTERS,
    isSpoofedSymbol,
 };
@@ -27,9 +27,11 @@

 const { parseUnits } = require("ethers");

-// Solidity's decimals() returns a uint8, so anything outside that range is not
-// an answer this wallet can use.
-const MAX_DECIMALS = 255;
+// Solidity's decimals() returns a uint8, but ethers' formatUnits() and
+// parseUnits() refuse more than 80 decimal places ("invalid FixedNumber
+// decimals (too large)"). A scale of 81 to 255 can be neither displayed nor
+// encoded, so it is not an answer this wallet can use, the same as no answer.
+const MAX_DECIMALS = 80;

 const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
    "The transfer was not sent, because the number of decimal places this" +
@@ -55,7 +57,7 @@ function mismatchMessage(displayed, onChain) {
 // A decimals value from any source as a number, or null if it is not one.
 // decimals() comes back from ethers as a bigint and the explorer's copy arrives
 // as a string, so both of those are accepted alongside a plain number; anything
-// fractional, negative, out of uint8 range, or of any other type at all is not.
+// fractional, negative, above MAX_DECIMALS, or of any other type at all is not.
 //
 // The types are enumerated rather than coerced because Number() is far too
 // willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
@@ -184,6 +184,22 @@ describe("decodeCalldata amount", () => {
        expect(line).not.toMatch(/0\.0000/);
    });

+    // A token added by hand carries whatever its decimals() returned, and a
+    // uint8 reaches 255, but formatUnits() throws above 80. The throw left the
+    // call undecoded rather than refused
+    // (https://git.eeqj.de/sneak/AutistMask/issues/350).
+    test("a token reporting more than 80 decimals shows base units", () => {
+        state.trackedTokens = [
+            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 81 },
+        ];
+        expect(
+            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
+        ).toBe("5000000000 base units (decimals unknown)");
+        expect(amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN)).toBe(
+            "5000000000 base units (decimals unknown)",
+        );
+    });
+
    test("an unbounded allowance is still named, with or without a scale", () => {
        expect(amountLine(approveData(MAX_UINT256), NOVEL_TOKEN)).toBe(
            "Unlimited",
@@ -0,0 +1,167 @@
+// A nonce the page supplies is not used
+// (https://git.eeqj.de/sneak/AutistMask/issues/404). With it a page could
+// replace one of the user's pending transactions (the same nonce at a higher
+// fee) or leave the new one stuck behind a gap, so the transaction is always
+// given the account's next nonce from the network.
+//
+// Driven through the preparation the background runs on a page's
+// eth_sendTransaction (src/shared/approvalTx.js) and the real approval screen,
+// password and Confirm included, against a minimal DOM stub in the shape
+// tests/approvalOrigin.test.js uses. The vault is mocked so that no password
+// has to be hashed.
+
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+}));
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { Network, Transaction } = require("ethers");
+const { state } = require("../src/shared/state");
+const { decryptWithPassword } = require("../src/shared/vault");
+const { prepareApprovalTx } = require("../src/shared/approvalTx");
+const approval = require("../src/popup/views/approval");
+
+// A well-known test phrase, and its first address.
+const PHRASE = "test test test test test test test test test test test junk";
+const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+// The account's next nonce, as the network reports it.
+const NETWORK_NONCE = 7;
+
+const network = {
+    getNetwork: async () => Network.from(1),
+    getTransactionCount: async () => NETWORK_NONCE,
+    estimateGas: async () => 21000n,
+    getFeeData: async () => ({
+        gasPrice: 2000000000n,
+        maxFeePerGas: 2000000000n,
+        maxPriorityFeePerGas: 1000000000n,
+    }),
+};
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+function click(id) {
+    return Promise.all((node(id).listeners.click || []).map((fn) => fn()));
+}
+
+// Open the transaction approval screen the way the popup does: the background
+// hands over the populated transaction and show() draws it. Returns every
+// message the screen sends to the background. The background's answer to the
+// signed transaction does not matter here; a retryable refusal keeps the
+// screen where it is.
+async function openTxApproval(approvedTx) {
+    const sent = [];
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" }, close: () => {} };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (msg, reply) => {
+            sent.push(msg);
+            if (!reply) return;
+            if (msg.type !== "AUTISTMASK_GET_APPROVAL") {
+                return reply({ error: "Not sent.", retryable: true });
+            }
+            reply({
+                type: "tx",
+                origin: "https://dapp.example",
+                isPhishingDomain: false,
+                approvedFrom: FROM,
+                approvedTx,
+            });
+        },
+    };
+    state.activeAddress = FROM;
+    state.wallets = [
+        {
+            type: "hd",
+            name: "Wallet 1",
+            xpub: "xpub-wallet-1",
+            encryptedSecret: "encrypted-secret-1",
+            nextIndex: 1,
+            addresses: [{ address: FROM, balance: "0", tokenBalances: [] }],
+        },
+    ];
+    approval.init({});
+    await approval.show(1);
+    return sent;
+}
+
+test("a page's nonce is replaced by the network's, on screen and in the signed transaction", async () => {
+    // What the background does with the page's request before it opens the
+    // approval window.
+    const approvedTx = await prepareApprovalTx(network, FROM, {
+        from: FROM,
+        to: RECIPIENT,
+        value: "0x0",
+        data: "0x",
+        nonce: "0x2",
+    });
+
+    const sent = await openTxApproval(approvedTx);
+    expect(node("approve-tx-nonce").textContent).toBe("7");
+
+    decryptWithPassword.mockResolvedValue(PHRASE);
+    node("approve-tx-password").value = "any password";
+    await click("btn-approve-tx");
+
+    const response = sent.find((msg) => msg.type === "AUTISTMASK_TX_RESPONSE");
+    expect(Transaction.from(response.rawSignedTx).nonce).toBe(NETWORK_NONCE);
+});
@@ -0,0 +1,140 @@
+// The connection, transaction and signature prompts name the site by its full
+// origin, scheme and port included, not by its bare hostname
+// (https://git.eeqj.de/sneak/AutistMask/issues/402). A page served over http,
+// or on another port, of a host the user trusts over https must not raise a
+// prompt that reads as that trusted site.
+//
+// Driven against a minimal DOM stub in the shape
+// tests/contractCreation.test.js uses.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const approval = require("../src/popup/views/approval");
+
+// The site asking, in cleartext and on a port, which is what the hostname
+// alone, dapp.example, used to hide.
+const ORIGIN = "http://dapp.example:8080";
+const FROM = "0x0000000000000000000000000000000000000a11";
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Open the prompt the background describes with `details`, the way the popup
+// does: it asks for the approval and show() draws it.
+async function openApproval(details) {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" } };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (msg, reply) => {
+            if (!reply) return;
+            if (msg.type !== "AUTISTMASK_GET_APPROVAL") return reply(null);
+            reply({
+                origin: ORIGIN,
+                isPhishingDomain: false,
+                approvedFrom: FROM,
+                ...details,
+            });
+        },
+    };
+    approval.init({});
+    await approval.show(1);
+}
+
+beforeEach(() => {
+    state.wallets = [];
+    state.activeAddress = FROM;
+    state.viewData = {};
+    state.viewStack = [];
+    state.currentView = null;
+});
+
+test("the connection prompt shows the origin", async () => {
+    await openApproval({});
+    expect(node("approve-origin").textContent).toBe(ORIGIN);
+});
+
+test("the transaction prompt shows the origin", async () => {
+    await openApproval({
+        type: "tx",
+        approvedTx: {
+            type: 2,
+            from: FROM,
+            chainId: "0x1",
+            nonce: "0x7",
+            gasLimit: "0x5208",
+            maxPriorityFeePerGas: "0x3b9aca00",
+            maxFeePerGas: "0x77359400",
+            to: RECIPIENT,
+            value: "0x0",
+            data: "0x",
+            accessList: [],
+        },
+    });
+    expect(node("approve-tx-origin").textContent).toBe(ORIGIN);
+});
+
+test("the signature prompt shows the origin", async () => {
+    await openApproval({
+        type: "sign",
+        // "Hello" as the hex a dApp passes to personal_sign.
+        signParams: {
+            method: "personal_sign",
+            message: "0x48656c6c6f",
+            from: FROM,
+        },
+    });
+    expect(node("approve-sign-origin").textContent).toBe(ORIGIN);
+});
@@ -121,7 +121,7 @@ describe("prepareApprovalTx", () => {
        );
    });

-    test("keeps a nonce, gas limit and fee the request did fix", async () => {
+    test("keeps a gas limit and fee the request did fix, but not its nonce", async () => {
        const approved = await prepareApprovalTx(
            providerWith(),
            signer.address,
@@ -133,7 +133,7 @@ describe("prepareApprovalTx", () => {
                maxPriorityFeePerGas: "0x3b9aca00",
            },
        );
-        expect(approved.nonce).toBe("0x2");
+        expect(approved.nonce).toBe("0x7");
        expect(approved.gasLimit).toBe("0x30d40");
        expect(approved.maxFeePerGas).toBe("0x12a05f200");
    });
@@ -39,7 +39,6 @@ const other = new Wallet(OTHER_KEY);
 const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 const ORIGIN = "https://dapp.example";
-const HOSTNAME = "dapp.example";
 // A page the wallet has never been connected to, whose requests are refused.
 const UNCONNECTED_ORIGIN = "https://stranger.example";
 const EXT_URL = "chrome-extension://autistmask/";
@@ -75,6 +74,22 @@ const NONCE = 7;
 // "Hello AutistMask" as the hex string a dApp passes to personal_sign.
 const MESSAGE = "0x48656c6c6f204175746973744d61736b";

+// An EIP-712 document as a dApp passes it to eth_signTypedData_v4. The
+// background only carries it to the approval screen, so a small one does.
+const TYPED_DATA = JSON.stringify({
+    domain: { name: "AutistMask Test", version: "1", chainId: 1 },
+    primaryType: "Note",
+    types: {
+        EIP712Domain: [
+            { name: "name", type: "string" },
+            { name: "version", type: "string" },
+            { name: "chainId", type: "uint256" },
+        ],
+        Note: [{ name: "contents", type: "string" }],
+    },
+    message: { contents: "Hello AutistMask" },
+});
+
 // The transaction the background populates and the approval screen displays.
 // The nonce is a parameter because the duplicate case turns on two artifacts
 // differing in a field the dApp fixed nothing for.
@@ -199,7 +214,7 @@ function loadBackground(options) {
        networkId: "mainnet",
        rpcUrl: "https://rpc.invalid",
        activeAddress: signer.address,
-        allowedSites: { [signer.address]: [HOSTNAME] },
+        allowedSites: { [signer.address]: [ORIGIN] },
        deniedSites: {},
    };

@@ -230,6 +245,7 @@ function loadBackground(options) {
    // raised through action.openPopup() opens no window at all, so this is
    // the only place its id appears.
    const actionPopups = [];
+    const openPopup = jest.fn(() => Promise.resolve());

    global.chrome = {
        storage,
@@ -284,7 +300,7 @@ function loadBackground(options) {
            // popup: no window is created, so windows.onRemoved can never
            // fire for it and the port disconnect is the only close signal
            // that exists.
-            ...(opts.actionPopup ? { openPopup: () => Promise.resolve() } : {}),
+            ...(opts.actionPopup ? { openPopup } : {}),
        },
    };

@@ -331,7 +347,7 @@ function loadBackground(options) {

    // The same for a message-signing approval, which pins the signing address
    // at approval time in exactly the same way.
-    function requestSign(from) {
+    function requestSign(from, origin) {
        let rpcResult = null;
        messageListener(
            {
@@ -339,7 +355,7 @@ function loadBackground(options) {
                method: "personal_sign",
                params: [MESSAGE, from || signer.address],
            },
-            { origin: ORIGIN },
+            { origin: origin || ORIGIN },
            (r) => {
                rpcResult = r;
            },
@@ -353,6 +369,24 @@ function loadBackground(options) {
        };
    }

+    // The same through eth_signTypedData_v4, whose params name the address
+    // first and the typed data second.
+    function requestTypedData() {
+        let rpcResult = null;
+        messageListener(
+            {
+                type: "AUTISTMASK_RPC",
+                method: "eth_signTypedData_v4",
+                params: [signer.address, TYPED_DATA],
+            },
+            { origin: ORIGIN },
+            (r) => {
+                rpcResult = r;
+            },
+        );
+        return { result: () => rpcResult };
+    }
+
    // A dApp asking to connect. The origin defaults to one the persisted
    // state has never allowed, so the request really does raise a prompt
    // instead of being answered from allowedSites.
@@ -427,12 +461,15 @@ function loadBackground(options) {
        send,
        requestTx,
        requestSign,
+        requestTypedData,
        requestSite,
        connectApproval,
        closeWindow,
        broadcastTransaction,
        created,
        removed,
+        actionPopups,
+        openPopup,
        storage,
        // The user switching account in the toolbar popup, as the background
        // sees it: the persisted active address changes underneath a pending
@@ -822,6 +859,238 @@ describe("one transaction approval at a time", () => {
    });
 });

+// A page that asks again before the user has answered its last connection or
+// signature request is refused, instead of opening one more window per call.
+describe("one connection and one signature approval per site at a time", () => {
+    const PENDING_REFUSAL = {
+        error: {
+            code: -32002,
+            message: expect.stringMatching(/already waiting for your answer/),
+        },
+    };
+
+    test("a loop of eth_requestAccounts opens one approval and refuses the rest", async () => {
+        const bg = loadBackground();
+        const requests = [];
+        for (let i = 0; i < 5; i++) requests.push(bg.requestSite());
+        await settle();
+
+        expect(bg.created).toHaveLength(1);
+        expect(requests[0].result()).toBeNull();
+        for (const extra of requests.slice(1)) {
+            expect(extra.result()).toEqual(PENDING_REFUSAL);
+        }
+
+        // Once the user has answered, the site may ask again.
+        bg.closeWindow(1);
+        await settle();
+        expect(requests[0].result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        const again = bg.requestSite();
+        await settle();
+        expect(again.result()).toBeNull();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    test("a loop of personal_sign opens one approval and refuses the rest", async () => {
+        const bg = loadBackground();
+        const requests = [];
+        for (let i = 0; i < 5; i++) requests.push(bg.requestSign());
+        await settle();
+
+        expect(bg.created).toHaveLength(1);
+        expect(requests[0].result()).toBeNull();
+        for (const extra of requests.slice(1)) {
+            expect(extra.result()).toEqual(PENDING_REFUSAL);
+        }
+    });
+
+    test("a loop of eth_signTypedData_v4 opens one approval and refuses the rest", async () => {
+        const bg = loadBackground();
+        const requests = [];
+        for (let i = 0; i < 5; i++) requests.push(bg.requestTypedData());
+        await settle();
+
+        expect(bg.created).toHaveLength(1);
+        expect(requests[0].result()).toBeNull();
+        for (const extra of requests.slice(1)) {
+            expect(extra.result()).toEqual(PENDING_REFUSAL);
+        }
+    });
+
+    test("a pending personal_sign also refuses eth_signTypedData_v4", async () => {
+        const bg = loadBackground();
+        bg.requestSign();
+        const typed = bg.requestTypedData();
+        await settle();
+
+        expect(typed.result()).toEqual(PENDING_REFUSAL);
+        expect(bg.created).toHaveLength(1);
+    });
+
+    test("in the toolbar popup, a loop of eth_requestAccounts opens it once", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const requests = [];
+        for (let i = 0; i < 5; i++) requests.push(bg.requestSite());
+        await settle();
+
+        expect(bg.openPopup).toHaveBeenCalledTimes(1);
+        for (const extra of requests.slice(1)) {
+            expect(extra.result()).toEqual(PENDING_REFUSAL);
+        }
+    });
+
+    // A toolbar popup that closes before it connects tells the background
+    // nothing, so its prompt stays pending. Once the toolbar popup has been set
+    // to open something else, nothing shows that prompt, and the site asking
+    // again must show it again rather than be refused for good.
+    test("a toolbar prompt nothing shows any more is shown again when the site asks again", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const first = bg.requestSite();
+        await settle();
+        const id = first.id();
+
+        // Its popup closed without connecting. Another site's prompt takes the
+        // toolbar popup and is answered, which sets it back to the wallet.
+        const other = bg.requestSite(UNCONNECTED_ORIGIN);
+        await settle();
+        const otherPort = bg.connectApproval(other.id());
+        otherPort.decide(false, false);
+        otherPort.disconnect();
+        await settle();
+        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            "src/popup/index.html",
+        );
+
+        const repeat = bg.requestSite();
+        await settle();
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(bg.openPopup).toHaveBeenCalledTimes(3);
+        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            "src/popup/index.html?approval=" + id,
+        );
+
+        // The user answers it, and the first request gets that answer.
+        bg.connectApproval(id).decide(true, false);
+        await settle();
+        expect(first.result()).toEqual({ result: [signer.address] });
+    });
+
+    // The user rejects a signature request from another site, which is
+    // connected already. Answering any approval sets the toolbar popup back to
+    // the wallet.
+    async function rejectSignatureFromAnotherSite(bg) {
+        const sign = bg.requestSign(undefined, ORIGIN);
+        await settle();
+        bg.send(
+            {
+                type: "AUTISTMASK_SIGN_RESPONSE",
+                id: sign.id(),
+                approved: false,
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(sign.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            "src/popup/index.html",
+        );
+    }
+
+    test("a toolbar prompt is shown again after another site's signature request is answered", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const first = bg.requestSite();
+        await settle();
+        const id = first.id();
+
+        // Its popup closed without connecting.
+        await rejectSignatureFromAnotherSite(bg);
+
+        const repeat = bg.requestSite();
+        await settle();
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(bg.openPopup).toHaveBeenCalledTimes(2);
+        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            "src/popup/index.html?approval=" + id,
+        );
+    });
+
+    test("a prompt in a window is not opened again when the site asks again", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        // The browser will not open the toolbar popup, so the prompt goes to a
+        // window of its own.
+        bg.openPopup.mockImplementation(() =>
+            Promise.reject(new Error("no toolbar popup")),
+        );
+        bg.requestSite();
+        await settle();
+        expect(bg.created).toHaveLength(1);
+
+        await rejectSignatureFromAnotherSite(bg);
+        expect(bg.created).toHaveLength(2);
+
+        const repeat = bg.requestSite();
+        await settle();
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(bg.openPopup).toHaveBeenCalledTimes(1);
+        expect(bg.created).toHaveLength(2);
+    });
+
+    test("a prompt in a connected toolbar popup is not opened again when the site asks again", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const first = bg.requestSite();
+        await settle();
+        // The popup is open and showing the prompt.
+        bg.connectApproval(first.id());
+
+        await rejectSignatureFromAnotherSite(bg);
+
+        const repeat = bg.requestSite();
+        await settle();
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(bg.openPopup).toHaveBeenCalledTimes(1);
+        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            "src/popup/index.html",
+        );
+    });
+
+    test("another site's connection request is not held up", async () => {
+        const bg = loadBackground();
+        bg.requestSite();
+        const repeat = bg.requestSite();
+        const other = bg.requestSite(UNCONNECTED_ORIGIN);
+        await settle();
+
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(other.result()).toBeNull();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    test("another site's signature request is not held up", async () => {
+        const bg = loadBackground();
+        // Connect a second site, so that it may ask for a signature at all.
+        const connecting = bg.requestSite();
+        await settle();
+        const port = bg.connectApproval(connecting.id());
+        port.decide(true, false);
+        port.disconnect();
+        await settle();
+        expect(connecting.result()).toEqual({ result: [signer.address] });
+
+        bg.requestSign();
+        const repeat = bg.requestSign();
+        const other = bg.requestSign(signer.address, FRESH_ORIGIN);
+        await settle();
+
+        expect(repeat.result()).toEqual(PENDING_REFUSAL);
+        expect(other.result()).toBeNull();
+        expect(bg.created).toHaveLength(3);
+    });
+});
+
 // A nonce collision found before the transaction reaches the network is the
 // one send failure the wallet can speak about with certainty. The user is told
 // it did not go out and to send it again, rather than being warned it might
@@ -2193,12 +2462,54 @@ describe("removing an address ends a site's connection to it", () => {
    });
 });

+// A remembered permission belongs to the origin it was granted to, scheme and
+// port included (https://git.eeqj.de/sneak/AutistMask/issues/402). The stored
+// state allows ORIGIN, https://dapp.example. A cleartext page on the same host,
+// which a network attacker can serve, and another port on it are other sites.
+describe("a remembered permission is held by the full origin", () => {
+    for (const origin of ["http://dapp.example", "https://dapp.example:8443"]) {
+        test(`an https grant does not authorise ${origin}`, async () => {
+            const bg = loadBackground();
+            expect(await siteAccounts(bg, ORIGIN)).toEqual({
+                result: [signer.address],
+            });
+
+            expect(await siteAccounts(bg, origin)).toEqual({ result: [] });
+            const send = bg.requestTx(TX_PARAMS, origin);
+            await settle();
+            expect(send.result()).toEqual({
+                error: { code: 4100, message: "Unauthorized" },
+            });
+            expect(send.id()).toBeNull();
+        });
+    }
+
+    test("Remember stores the origin, so the cleartext page on that host is asked again", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const granted = bg.requestSite(FRESH_ORIGIN);
+        await settle();
+        const grantedId = granted.id();
+        bg.connectApproval(grantedId).decide(true, true);
+        await settle();
+        expect(granted.result()).toEqual({ result: [signer.address] });
+        expect(
+            bg.storage.read("autistmask").allowedSites[signer.address],
+        ).toEqual([ORIGIN, FRESH_ORIGIN]);
+
+        const cleartext = bg.requestSite("http://fresh.example");
+        await settle();
+        // Unanswered: it is waiting on a prompt of its own.
+        expect(cleartext.result()).toBeNull();
+        expect(cleartext.id()).not.toBe(grantedId);
+    });
+});
+
 // Settings lists the sites allowed without "Remember", which only the
 // background holds, and removing a site there, from either list, disconnects
 // it. These drive the real Settings view against the real background and
 // click the [x] the user clicks.
 describe("removing a site in Settings disconnects it", () => {
-    // FRESH_ORIGIN on another port, so its hostname is FRESH_ORIGIN's.
+    // The host of FRESH_ORIGIN on another port, which makes it another site.
    const FRESH_OTHER_PORT = "https://fresh.example:8443";

    // A site list's container. Its [x] buttons, data attributes and all, are
@@ -2226,9 +2537,9 @@ describe("removing a site in Settings disconnects it", () => {
        return list;
    }

-    // The hostnames a site list shows.
+    // The origins a site list shows.
    function listed(list) {
-        return [...list.innerHTML.matchAll(/data-hostname="([^"]*)"/g)].map(
+        return [...list.innerHTML.matchAll(/data-origin="([^"]*)"/g)].map(
            (match) => match[1],
        );
    }
@@ -2259,10 +2570,10 @@ describe("removing a site in Settings disconnects it", () => {
            allowed: element("settings-allowed-sites"),
            connected: element("settings-connected-sites"),
            // Click the [x] beside a site, and let what it sends run.
-            remove: async (list, hostname) => {
-                expect(listed(list)).toContain(hostname);
+            remove: async (list, origin) => {
+                expect(listed(list)).toContain(origin);
                const button = list.buttons.find(
-                    (b) => b.dataset.hostname === hostname,
+                    (b) => b.dataset.origin === origin,
                );
                await button.click();
                await settle();
@@ -2274,14 +2585,15 @@ describe("removing a site in Settings disconnects it", () => {
        delete global.document;
    });

-    test("Settings lists a site connected without Remember", async () => {
+    test("Settings lists each site by its origin", async () => {
        const bg = loadBackground({ actionPopup: true });
        await connect(bg, FRESH_ORIGIN, false);
+        await connect(bg, FRESH_OTHER_PORT, true);

        const settings = await openSettings(bg);

-        expect(listed(settings.connected)).toEqual(["fresh.example"]);
-        expect(listed(settings.allowed)).toEqual([HOSTNAME]);
+        expect(listed(settings.connected)).toEqual([FRESH_ORIGIN]);
+        expect(listed(settings.allowed)).toEqual([ORIGIN, FRESH_OTHER_PORT]);
    });

    test("removing a site connected without Remember disconnects it and tells its tabs", async () => {
@@ -2293,6 +2605,7 @@ describe("removing a site in Settings disconnects it", () => {
                cb([
                    { id: 1, url: FRESH_ORIGIN + "/app" },
                    { id: 2, url: ORIGIN + "/app" },
+                    { id: 3, url: FRESH_OTHER_PORT + "/app" },
                ]),
            sendMessage: (tabId, msg, cb) => {
                sentToTabs.push({ tabId, msg });
@@ -2301,7 +2614,7 @@ describe("removing a site in Settings disconnects it", () => {
        };
        const settings = await openSettings(bg);

-        await settings.remove(settings.connected, "fresh.example");
+        await settings.remove(settings.connected, FRESH_ORIGIN);

        expect(await siteAccounts(bg)).toEqual({ result: [] });
        expect(sentToTabs).toEqual([
@@ -2321,20 +2634,45 @@ describe("removing a site in Settings disconnects it", () => {
        });
    });

-    // The same hostname can hold both kinds of connection: one origin allowed
-    // without Remember, then another, on a different port, allowed with it.
+    // One origin can hold both kinds of connection under two addresses:
+    // remembered for one, allowed without Remember for the other.
    test("removing a remembered site also ends its connection made without Remember", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const stored = bg.storage.read("autistmask");
+        stored.wallets[0].addresses.push({
+            address: other.address,
+            balance: "0",
+            tokenBalances: [],
+        });
+        bg.storage.write("autistmask", stored);
+        await connect(bg, FRESH_ORIGIN, true);
+        bg.setActiveAddress(other.address);
+        const pending = bg.requestSite(FRESH_ORIGIN);
+        await settle();
+        bg.connectApproval(pending.id()).decide(true, false);
+        await settle();
+        expect(pending.result()).toEqual({ result: [other.address] });
+        const settings = await openSettings(bg);
+
+        await settings.remove(settings.allowed, FRESH_ORIGIN);
+
+        expect(await siteAccounts(bg, FRESH_ORIGIN)).toEqual({ result: [] });
+    });
+
+    test("removing a remembered site leaves the same host on another port connected", async () => {
        const bg = loadBackground({ actionPopup: true });
        await connect(bg, FRESH_ORIGIN, false);
        await connect(bg, FRESH_OTHER_PORT, true);
        const settings = await openSettings(bg);

-        await settings.remove(settings.allowed, "fresh.example");
+        await settings.remove(settings.allowed, FRESH_OTHER_PORT);

        expect(await siteAccounts(bg, FRESH_OTHER_PORT)).toEqual({
            result: [],
        });
-        expect(await siteAccounts(bg, FRESH_ORIGIN)).toEqual({ result: [] });
+        expect(await siteAccounts(bg, FRESH_ORIGIN)).toEqual({
+            result: [signer.address],
+        });
    });

    test("a page can neither remove a site nor list the connected ones", async () => {
@@ -2343,7 +2681,7 @@ describe("removing a site in Settings disconnects it", () => {
        const page = { url: FRESH_ORIGIN + "/index.html" };

        const remove = bg.send(
-            { type: "AUTISTMASK_REMOVE_SITE", hostname: "fresh.example" },
+            { type: "AUTISTMASK_REMOVE_SITE", origin: FRESH_ORIGIN },
            page,
        );
        const list = bg.send({ type: "AUTISTMASK_GET_CONNECTED_SITES" }, page);
@@ -33,7 +33,6 @@ const signer = new Wallet(SIGNER_KEY);
 const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
 const EXT_URL = "chrome-extension://autistmask/";

 const MAINNET = networkById("mainnet");
@@ -81,7 +80,7 @@ function storedProfile(networkId) {
        networkId,
        rpcUrl: net.defaultRpcUrl,
        blockscoutUrl: net.defaultBlockscoutUrl,
-        allowedSites: { [signer.address]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [signer.address]: [CONNECTED_ORIGIN] },
        deniedSites: {},
        trackedTokens: [],
        lastBalanceRefresh: 0,
@@ -19,7 +19,6 @@ const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 // The site the persisted state has connected, and one it has never heard of.
 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
 const STRANGER_ORIGIN = "https://stranger.example";

 const MAINNET = networkById("mainnet");
@@ -86,7 +85,7 @@ function loadBackground() {
        tokenHolderCache: {},
        fraudContracts: [],
        activeAddress: ADDRESS,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [ADDRESS]: [CONNECTED_ORIGIN] },
        deniedSites: {},
    };
    const storage = makeStorageStub({ autistmask: persisted });
@@ -17,7 +17,6 @@ const { networkById } = require("../src/shared/networks");
 const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
 const UNKNOWN_ORIGIN = "https://stranger.example";

 const MAINNET = networkById("mainnet");
@@ -41,7 +40,7 @@ function storedProfile(networkId) {
        networkId,
        rpcUrl: networkById(networkId).defaultRpcUrl,
        blockscoutUrl: networkById(networkId).defaultBlockscoutUrl,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [ADDRESS]: [CONNECTED_ORIGIN] },
        deniedSites: {},
        trackedTokens: [],
    };
@@ -21,7 +21,6 @@ const { makeStorageStub } = require("./support/storageStub");
 const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";

 const MAINNET = networkById("mainnet");
 const SEPOLIA = networkById("sepolia");
@@ -50,7 +49,7 @@ function storedProfile(networkId) {
        networkId,
        rpcUrl: CUSTOM_RPC,
        blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [ADDRESS]: [CONNECTED_ORIGIN] },
        deniedSites: {},
        trackedTokens: [{ address: TOKEN, symbol: "DAI", decimals: 18 }],
        theme: "dark",
@@ -168,7 +167,7 @@ describe("a chain switch on a worker that never loaded state", () => {
        expect(after.wallets).toEqual(walletFixture());
        expect(after.hasWallet).toBe(true);
        expect(after.activeAddress).toBe(ADDRESS);
-        expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_HOSTNAME] });
+        expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_ORIGIN] });
        expect(after.trackedTokens).toEqual([
            { address: TOKEN, symbol: "DAI", decimals: 18 },
        ]);
@@ -29,7 +29,6 @@ const signer = new Wallet(SIGNER_KEY);
 const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";

 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
 const EXT_URL = "chrome-extension://autistmask/";

 const SEPOLIA = networkById("sepolia");
@@ -67,7 +66,7 @@ function storedProfile(networkId) {
        networkId,
        rpcUrl: net.defaultRpcUrl,
        blockscoutUrl: net.defaultBlockscoutUrl,
-        allowedSites: { [signer.address]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [signer.address]: [CONNECTED_ORIGIN] },
        deniedSites: {},
        trackedTokens: [],
    };
@@ -150,7 +150,7 @@ async function openTxApproval(to, data) {
            if (msg.type !== "AUTISTMASK_GET_APPROVAL") return reply(null);
            reply({
                type: "tx",
-                hostname: "dapp.example",
+                origin: "https://dapp.example",
                isPhishingDomain: false,
                approvedFrom: FROM,
                approvedTx: {
@@ -0,0 +1,53 @@
+// What debugFetch writes to the console in debug mode.
+//
+// RPC providers put the API key in the URL's path or query string, and the
+// debug log used to print the whole URL and request body, so turning debug
+// mode on wrote the key to the console
+// (https://git.eeqj.de/sneak/AutistMask/issues/410). The log now names the
+// HTTP method, the URL's origin and the JSON-RPC method, and nothing else of
+// the request.
+
+const { debugFetch, urlOrigin, setRuntimeDebug } = require("../src/shared/log");
+
+const realFetch = globalThis.fetch;
+
+afterEach(() => {
+    globalThis.fetch = realFetch;
+    setRuntimeDebug(false);
+    jest.restoreAllMocks();
+});
+
+test("logs the origin and JSON-RPC method, not the key in the URL", async () => {
+    setRuntimeDebug(true);
+    const consoleLog = jest.spyOn(console, "log").mockImplementation(() => {});
+    globalThis.fetch = jest.fn(async () => ({ status: 200 }));
+
+    await debugFetch(
+        "https://rpc.example.invalid/v3/PATHKEY123?token=QUERYTOKEN456",
+        {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 1,
+                method: "eth_chainId",
+                params: [],
+            }),
+        },
+    );
+
+    const logged = consoleLog.mock.calls.flat().join(" ");
+    expect(logged).not.toContain("PATHKEY123");
+    expect(logged).not.toContain("QUERYTOKEN456");
+    expect(logged).toContain("https://rpc.example.invalid");
+    expect(logged).toContain("eth_chainId");
+});
+
+test("the origin leaves out a user name and password in the URL", () => {
+    expect(
+        urlOrigin("https://user:SECRETPASS@rpc.example.invalid/v3/KEY"),
+    ).toBe("https://rpc.example.invalid");
+    expect(urlOrigin("wss://user:SECRETPASS@rpc.example.invalid:8546/")).toBe(
+        "wss://rpc.example.invalid:8546",
+    );
+});
@@ -140,8 +140,14 @@ function load() {
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    state.activeAddress = A0;
-    state.allowedSites = { [A0]: ["a.example"], [B0]: ["b.example"] };
-    state.deniedSites = { [B0]: ["c.example"], [C0]: ["d.example"] };
+    state.allowedSites = {
+        [A0]: ["https://a.example"],
+        [B0]: ["https://b.example"],
+    };
+    state.deniedSites = {
+        [B0]: ["https://c.example"],
+        [C0]: ["https://d.example"],
+    };
    state.viewStack = ["main", "settings"];
    state.currentView = "settings";

@@ -388,8 +394,8 @@ describe("deleting without the password", () => {
        await click("btn-delete-wallet-lost-confirm");

        const saved = (await storage.get("autistmask")).autistmask;
-        expect(saved.allowedSites).toEqual({ [A0]: ["a.example"] });
-        expect(saved.deniedSites).toEqual({ [C0]: ["d.example"] });
+        expect(saved.allowedSites).toEqual({ [A0]: ["https://a.example"] });
+        expect(saved.deniedSites).toEqual({ [C0]: ["https://d.example"] });
    });

    // The route shares finishDelete() with the password route, so the
@@ -437,7 +443,7 @@ describe("deleting without the password", () => {
    test("deleting the last wallet lands on Welcome with nothing left", async () => {
        const { deleteWallet, state, storage } = load();
        state.wallets = [wallet("Wallet 1", "secret-one", [A0])];
-        state.allowedSites = { [A0]: ["a.example"] };
+        state.allowedSites = { [A0]: ["https://a.example"] };
        state.deniedSites = {};

        await openLostPassword(deleteWallet, 0);
@@ -438,11 +438,10 @@ step(
        await d.switchToWindow(popup);
        await d.waitVisible("#view-approve-site");

-        const hostname = await d.text("#approve-hostname");
+        const origin = await d.text("#approve-origin");
        assert(
-            hostname === "127.0.0.1",
-            "the site prompt names the wrong origin: " +
-                JSON.stringify(hostname),
+            origin === env.server.origin,
+            "the site prompt names the wrong origin: " + JSON.stringify(origin),
        );
        const shown = await d.text("#approve-address");
        assert(
@@ -494,16 +493,16 @@ step(

        const screen = await d.execute(
            `return {
-             hostname: document.getElementById("approve-sign-hostname").textContent,
+             origin: document.getElementById("approve-sign-origin").textContent,
             type: document.getElementById("approve-sign-type").textContent,
             message: document.getElementById("approve-sign-message").textContent,
             from: document.getElementById("approve-sign-from").textContent,
         };`,
        );
        assert(
-            screen.hostname === "127.0.0.1",
+            screen.origin === env.server.origin,
            "the sign prompt names the wrong origin: " +
-                JSON.stringify(screen.hostname),
+                JSON.stringify(screen.origin),
        );
        assert(
            screen.type === "Personal message",
@@ -571,7 +570,7 @@ step(

        const screen = await d.execute(
            `return {
-             hostname: document.getElementById("approve-tx-hostname").textContent,
+             origin: document.getElementById("approve-tx-origin").textContent,
             from: document.getElementById("approve-tx-from").textContent,
             to: document.getElementById("approve-tx-to").textContent,
             value: document.getElementById("approve-tx-value").textContent,
@@ -582,9 +581,9 @@ step(
         };`,
        );
        assert(
-            screen.hostname === "127.0.0.1",
+            screen.origin === env.server.origin,
            "the transaction prompt names the wrong origin: " +
-                JSON.stringify(screen.hostname),
+                JSON.stringify(screen.origin),
        );
        assert(
            screen.from.toLowerCase().includes(env.address.toLowerCase()),
@@ -35,6 +35,7 @@ const {
 const {
    DAPP_ORIGIN,
    DAPP_URL,
+    PHISHING_DAPP_ORIGIN,
    PHISHING_DAPP_URL,
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
@@ -2471,8 +2472,6 @@ test("a token whose symbol() returns markup renders as text (#307)", async (env)
 // dApp, with real funds, against a real network. The RPC is stubbed
 // throughout. That pass stays on the human list before 1.0.0.

-const DAPP_HOSTNAME = new URL(DAPP_URL).hostname;
-
 // The personal_sign payload. Sent as hex, which is what dApps send and what
 // the popup requires — it calls getBytes() on the message — and displayed on
 // the approval screen as the decoded text, which is what the user is agreeing
@@ -3016,11 +3015,10 @@ test("eth_requestAccounts rejected at the prompt returns a rejection (#183)", as
    try {
        await visible(popup, "#view-approve-site");

-        const hostname = await popup.locator("#approve-hostname").innerText();
+        const origin = await popup.locator("#approve-origin").innerText();
        assert(
-            hostname === DAPP_HOSTNAME,
-            "the site prompt names the wrong origin: " +
-                JSON.stringify(hostname),
+            origin === DAPP_ORIGIN,
+            "the site prompt names the wrong origin: " + JSON.stringify(origin),
        );

        // The control for the phishing test below: this origin is not on the
@@ -3101,7 +3099,6 @@ test("a connect request from a blocklisted site is flagged (#219)", async (env)
    // check and the real approval screen. Nothing about the list is stubbed —
    // there is nothing left to stub, since the extension no longer fetches it.
    const phishingDapp = await openDapp(env.ctx, PHISHING_DAPP_URL);
-    const hostname = new URL(PHISHING_DAPP_URL).hostname;
    try {
        await reserveApprovalTab(env);
        await startRequest(
@@ -3114,15 +3111,15 @@ test("a connect request from a blocklisted site is flagged (#219)", async (env)
        try {
            await visible(popup, "#view-approve-site");

-            const shown = await popup.locator("#approve-hostname").innerText();
+            const shown = await popup.locator("#approve-origin").innerText();
            assert(
-                shown === hostname,
+                shown === PHISHING_DAPP_ORIGIN,
                "the site prompt names the wrong origin: " +
                    JSON.stringify(shown),
            );

            await visible(popup, "#approve-site-phishing-warning");
-            console.log("# phishing warning shown for " + hostname);
+            console.log("# phishing warning shown for " + PHISHING_DAPP_ORIGIN);

            // Not remembered: a remembered decision for this origin would
            // outlive the test.
@@ -3152,15 +3149,15 @@ test("personal_sign signs, and the signature recovers to the address (#183)", as
    const boundary = await watchApprovalBoundary(popup, env);

    const screen = await popup.evaluate(() => ({
-        hostname: document.getElementById("approve-sign-hostname").textContent,
+        origin: document.getElementById("approve-sign-origin").textContent,
        type: document.getElementById("approve-sign-type").textContent,
        message: document.getElementById("approve-sign-message").textContent,
        from: document.getElementById("approve-sign-from").textContent,
    }));
    assert(
-        screen.hostname === DAPP_HOSTNAME,
+        screen.origin === DAPP_ORIGIN,
        "the sign prompt names the wrong origin: " +
-            JSON.stringify(screen.hostname),
+            JSON.stringify(screen.origin),
    );
    assert(
        screen.type === "Personal message",
@@ -3235,6 +3232,64 @@ test("personal_sign rejected returns a rejection to the page (#183)", async (env
    );
 });

+// A right-to-left character must not move the characters around it: U+05C3
+// between "5" and "00" would otherwise put "500" on screen before it. A
+// paragraph separator (U+2029) before it, left in the text, would end the
+// byte-order layout and bring that back
+// (https://git.eeqj.de/sneak/AutistMask/issues/403).
+test("a personal message is laid out in the order of its bytes (#403)", async (env) => {
+    const rightToLeft = String.fromCodePoint(0x05c3);
+    const text =
+        "Sign in" +
+        String.fromCodePoint(0x2029) +
+        "Pay 5" +
+        rightToLeft +
+        "00 ETH";
+    await startRequest(env.dapp, "sign-bidi", "personal_sign", [
+        hexlify(toUtf8Bytes(text)),
+        env.expectedAddress,
+    ]);
+    const popup = await waitForApprovalWindow(env.ctx);
+    await visible(popup, "#view-approve-sign");
+
+    // The text on screen, marks included, and the left edge of each of its
+    // characters, in byte order. A character the browser's fonts draw with
+    // no width shares its neighbour's edge.
+    const shown = await popup.evaluate(() => {
+        const message = document.getElementById("approve-sign-message");
+        const walker = document.createTreeWalker(message, NodeFilter.SHOW_TEXT);
+        const range = document.createRange();
+        let text = "";
+        const lefts = [];
+        for (let node = walker.nextNode(); node; node = walker.nextNode()) {
+            for (let i = 0; i < node.length; i++) {
+                range.setStart(node, i);
+                range.setEnd(node, i + 1);
+                lefts.push(range.getBoundingClientRect().left);
+            }
+            text += node.data;
+        }
+        return { text, lefts };
+    });
+    await clickAndClose(popup, "#btn-reject-sign");
+    await assertUserRejection(
+        env.dapp,
+        "sign-bidi",
+        "the byte-order personal_sign rejection",
+    );
+
+    assert(
+        shown.text === "Sign inU+2029Pay 5" + rightToLeft + "00 ETH",
+        "the paragraph separator is not shown as a mark: " +
+            JSON.stringify(shown.text),
+    );
+    assert(
+        shown.lefts.every((left, i) => i === 0 || left >= shown.lefts[i - 1]),
+        "the personal message is not laid out in byte order: " +
+            JSON.stringify(shown.lefts),
+    );
+});
+
 test("eth_signTypedData_v4 signs, and the signature recovers (#183)", async (env) => {
    await startRequest(env.dapp, "typed", "eth_signTypedData_v4", [
        env.expectedAddress,
@@ -3245,15 +3300,15 @@ test("eth_signTypedData_v4 signs, and the signature recovers (#183)", async (env
    const boundary = await watchApprovalBoundary(popup, env);

    const screen = await popup.evaluate(() => ({
-        hostname: document.getElementById("approve-sign-hostname").textContent,
+        origin: document.getElementById("approve-sign-origin").textContent,
        type: document.getElementById("approve-sign-type").textContent,
        message: document.getElementById("approve-sign-message").innerText,
        from: document.getElementById("approve-sign-from").textContent,
    }));
    assert(
-        screen.hostname === DAPP_HOSTNAME,
+        screen.origin === DAPP_ORIGIN,
        "the typed data prompt names the wrong origin: " +
-            JSON.stringify(screen.hostname),
+            JSON.stringify(screen.origin),
    );
    assert(
        screen.type === "Typed data (EIP-712)",
@@ -3351,7 +3406,7 @@ test("eth_sendTransaction signs the approved transaction and broadcasts it (#183
    const boundary = await watchApprovalBoundary(popup, env);

    const screen = await popup.evaluate(() => ({
-        hostname: document.getElementById("approve-tx-hostname").textContent,
+        origin: document.getElementById("approve-tx-origin").textContent,
        from: document.getElementById("approve-tx-from").textContent,
        to: document.getElementById("approve-tx-to").textContent,
        value: document.getElementById("approve-tx-value").textContent,
@@ -3361,9 +3416,9 @@ test("eth_sendTransaction signs the approved transaction and broadcasts it (#183
            .classList.contains("hidden"),
    }));
    assert(
-        screen.hostname === DAPP_HOSTNAME,
+        screen.origin === DAPP_ORIGIN,
        "the transaction prompt names the wrong origin: " +
-            JSON.stringify(screen.hostname),
+            JSON.stringify(screen.origin),
    );
    assert(
        screen.from.toLowerCase().includes(env.expectedAddress.toLowerCase()),
@@ -59,24 +59,32 @@ describe("the floor under allowedSites and deniedSites", () => {
            }
        });

-        test(`an ${field} entry whose value is not a hostname list is dropped`, () => {
-            for (const bad of ["dapp.example", 42, null, { a: 1 }, true]) {
+        test(`an ${field} entry whose value is not an origin list is dropped`, () => {
+            for (const bad of [
+                "https://dapp.example",
+                42,
+                null,
+                { a: 1 },
+                true,
+            ]) {
                expect(
                    normalizePersisted({ [field]: { [ADDRESS]: bad } })[field],
                ).toEqual({});
            }
        });

-        test(`a hostname that is not text is dropped from an ${field} entry`, () => {
+        test(`an origin that is not text is dropped from an ${field} entry`, () => {
            expect(
                normalizePersisted({
-                    [field]: { [ADDRESS]: [42, null, "dapp.example", {}] },
+                    [field]: {
+                        [ADDRESS]: [42, null, "https://dapp.example", {}],
+                    },
                })[field],
-            ).toEqual({ [ADDRESS]: ["dapp.example"] });
+            ).toEqual({ [ADDRESS]: ["https://dapp.example"] });
        });

        test(`a real ${field} map survives, copied not shared`, () => {
-            const saved = { [field]: { [ADDRESS]: ["dapp.example"] } };
+            const saved = { [field]: { [ADDRESS]: ["https://dapp.example"] } };

            const out = normalizePersisted(saved);

@@ -87,10 +95,13 @@ describe("the floor under allowedSites and deniedSites", () => {

        test(`a good ${field} entry beside a malformed one survives`, () => {
            const out = normalizePersisted({
-                [field]: { [ADDRESS]: ["dapp.example"], [TOKEN_ADDRESS]: 42 },
+                [field]: {
+                    [ADDRESS]: ["https://dapp.example"],
+                    [TOKEN_ADDRESS]: 42,
+                },
            });

-            expect(out[field]).toEqual({ [ADDRESS]: ["dapp.example"] });
+            expect(out[field]).toEqual({ [ADDRESS]: ["https://dapp.example"] });
        });

        test(`a stored own "__proto__" key in ${field} is dropped`, () => {
@@ -100,7 +111,7 @@ describe("the floor under allowedSites and deniedSites", () => {
            // saveState()'s merge hands to the prototype setter on the next
            // write.
            const saved = JSON.parse(
-                '{"' + field + '":{"__proto__":["evil.invalid"]}}',
+                '{"' + field + '":{"__proto__":["https://evil.invalid"]}}',
            );

            const out = normalizePersisted(saved);
@@ -197,7 +208,7 @@ describe("a malformed allowedSites entry", () => {
    const MALFORMED = [
        { name: "a string", value: "notalist" },
        { name: "a number", value: 42 },
-        { name: "a record", value: { hostnames: ["dapp.example"] } },
+        { name: "a record", value: { origins: ["https://dapp.example"] } },
    ];

    for (const { name, value } of MALFORMED) {
@@ -231,7 +242,7 @@ describe("a malformed allowedSites entry", () => {
        const env = await bootPopup(
            unversionedValidProfile({
                allowedSites: {
-                    [ADDRESS]: ["dapp.example"],
+                    [ADDRESS]: ["https://dapp.example"],
                    [TOKEN_ADDRESS]: "notalist",
                },
            }),
@@ -239,7 +250,7 @@ describe("a malformed allowedSites entry", () => {

        expect(env.pageErrors).toEqual([]);
        expect(env.storage.read("autistmask").allowedSites).toEqual({
-            [ADDRESS]: ["dapp.example"],
+            [ADDRESS]: ["https://dapp.example"],
        });
    });

@@ -165,7 +165,7 @@ const CONTRACT = [
            [ADDRESS],
            { [ADDRESS]: 42 },
            { [ADDRESS]: [42, null, {}] },
-            JSON.parse('{"__proto__":["evil.invalid"]}'),
+            JSON.parse('{"__proto__":["https://evil.invalid"]}'),
        ],
        holds: siteMapHolds,
    },
@@ -177,7 +177,7 @@ const CONTRACT = [
            [ADDRESS],
            { [ADDRESS]: 42 },
            { [ADDRESS]: [42, null, {}] },
-            JSON.parse('{"__proto__":["evil.invalid"]}'),
+            JSON.parse('{"__proto__":["https://evil.invalid"]}'),
        ],
        holds: siteMapHolds,
    },
@@ -0,0 +1,229 @@
+// The signature prompt shows a personal message as the bytes that are signed
+// (https://git.eeqj.de/sneak/AutistMask/issues/403): the raw data in hex, the
+// text it decodes to with control characters, line and paragraph separators
+// and characters that paint nothing marked rather than obeyed, markup shown as
+// text, laid out in byte order, and a message that is not hex as plain text
+// that cannot be signed.
+//
+// Driven against a minimal DOM stub in the shape
+// tests/approvalOrigin.test.js uses. That the layout keeps right-to-left
+// characters in byte order needs a real browser: tests/e2e/run.js checks it.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { hexlify, toUtf8Bytes } = require("ethers");
+const { state } = require("../src/shared/state");
+const approval = require("../src/popup/views/approval");
+
+const FROM = "0x0000000000000000000000000000000000000a11";
+
+// Built from their code points so that this file holds none of them.
+const RIGHT_TO_LEFT_OVERRIDE = String.fromCodePoint(0x202e);
+const POP_DIRECTIONAL_FORMATTING = String.fromCodePoint(0x202c);
+const ZERO_WIDTH_SPACE = String.fromCodePoint(0x200b);
+const VARIATION_SELECTOR_1 = String.fromCodePoint(0xfe00);
+const VARIATION_SELECTOR_17 = String.fromCodePoint(0xe0100);
+const HANGUL_FILLER = String.fromCodePoint(0x3164);
+const LINE_SEPARATOR = String.fromCodePoint(0x2028);
+const PARAGRAPH_SEPARATOR = String.fromCodePoint(0x2029);
+
+function makeElement(id) {
+    const classes = new Set();
+    return {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Open the signature prompt for a personal_sign of `message`, the way the
+// popup does: it asks the background for the approval and show() draws it.
+async function openPersonalSign(message) {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" } };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (msg, reply) => {
+            if (!reply) return;
+            if (msg.type !== "AUTISTMASK_GET_APPROVAL") return reply(null);
+            reply({
+                type: "sign",
+                origin: "https://dapp.example",
+                isPhishingDomain: false,
+                approvedFrom: FROM,
+                signParams: { method: "personal_sign", message, from: FROM },
+            });
+        },
+    };
+    approval.init({});
+    await approval.show(1);
+}
+
+// The message box's markup as the text a reader sees: tags dropped.
+function shownMessage() {
+    return node("approve-sign-message").innerHTML.replace(/<[^>]*>/g, "");
+}
+
+beforeEach(() => {
+    state.wallets = [];
+    state.activeAddress = FROM;
+    state.viewData = {};
+    state.viewStack = [];
+    state.currentView = null;
+});
+
+test("a right-to-left override is marked, so the text reads in byte order", async () => {
+    // Obeyed, the override shows "0001" as "1000".
+    const text =
+        "Pay " +
+        RIGHT_TO_LEFT_OVERRIDE +
+        "0001" +
+        POP_DIRECTIONAL_FORMATTING +
+        " ETH";
+    await openPersonalSign(hexlify(toUtf8Bytes(text)));
+    const html = node("approve-sign-message").innerHTML;
+    expect(html).not.toContain(RIGHT_TO_LEFT_OVERRIDE);
+    expect(html).not.toContain(POP_DIRECTIONAL_FORMATTING);
+    expect(shownMessage()).toBe("Pay U+202E0001U+202C ETH");
+});
+
+test("a zero-width character is marked", async () => {
+    await openPersonalSign(
+        hexlify(toUtf8Bytes("pay" + ZERO_WIDTH_SPACE + "pal.com")),
+    );
+    expect(node("approve-sign-message").innerHTML).not.toContain(
+        ZERO_WIDTH_SPACE,
+    );
+    expect(shownMessage()).toBe("payU+200Bpal.com");
+});
+
+test("variation selectors and a Hangul filler are marked", async () => {
+    // Each paints nothing, so a page could hide bytes after "Sign in".
+    await openPersonalSign(
+        hexlify(
+            toUtf8Bytes(
+                "Sign in" +
+                    VARIATION_SELECTOR_1 +
+                    VARIATION_SELECTOR_17 +
+                    HANGUL_FILLER,
+            ),
+        ),
+    );
+    expect(shownMessage()).toBe("Sign inU+FE00U+E0100U+3164");
+});
+
+test("the message is laid out in byte order", async () => {
+    await openPersonalSign(hexlify(toUtf8Bytes("Hello")));
+    expect(
+        node("approve-sign-message").classList.contains("am-byte-order"),
+    ).toBe(true);
+});
+
+test("a control character other than a line feed is marked", async () => {
+    await openPersonalSign(hexlify(toUtf8Bytes("a\u0000b\tc")));
+    expect(shownMessage()).toBe("aU+0000bU+0009c");
+});
+
+test("line and paragraph separators are marked", async () => {
+    // Left in the text, a paragraph separator would end the byte-order
+    // layout for everything after it.
+    await openPersonalSign(
+        hexlify(toUtf8Bytes("a" + LINE_SEPARATOR + "b" + PARAGRAPH_SEPARATOR)),
+    );
+    const html = node("approve-sign-message").innerHTML;
+    expect(html).not.toContain(LINE_SEPARATOR);
+    expect(html).not.toContain(PARAGRAPH_SEPARATOR);
+    expect(shownMessage()).toBe("aU+2028bU+2029");
+});
+
+test("a line feed is shown as a line break", async () => {
+    await openPersonalSign(hexlify(toUtf8Bytes("Sign in\nNonce: 7")));
+    expect(node("approve-sign-message").innerHTML).toBe("Sign in<br>Nonce: 7");
+});
+
+// The message box is written as HTML, so a site's markup has to arrive there
+// escaped, as the text it is.
+const MARKUP = "<b>x</b><img src=x onerror=alert(1)>";
+
+test.each([
+    ["a hex message", hexlify(toUtf8Bytes(MARKUP))],
+    ["a message that is not hex", MARKUP],
+])("markup in %s is shown as text, not as markup", async (_, message) => {
+    await openPersonalSign(message);
+    expect(node("approve-sign-message").innerHTML).toBe(
+        "&lt;b&gt;x&lt;/b&gt;&lt;img src=x onerror=alert(1)&gt;",
+    );
+});
+
+test("the raw hex is shown alongside the text", async () => {
+    await openPersonalSign("0x48656c6c6f");
+    expect(shownMessage()).toBe("Hello");
+    expect(node("approve-sign-hex").textContent).toBe("0x48656c6c6f");
+    expect(node("approve-sign-hex-section").classList.contains("hidden")).toBe(
+        false,
+    );
+});
+
+test("hex with an uppercase 0X is read as hex, as signing reads it", async () => {
+    await openPersonalSign("0X48656C6C6F");
+    expect(shownMessage()).toBe("Hello");
+    expect(node("approve-sign-hex").textContent).toBe("0X48656C6C6F");
+    expect(node("btn-approve-sign").disabled).toBe(false);
+});
+
+test("bytes that are not text are shown only as hex", async () => {
+    await openPersonalSign("0xff00");
+    expect(node("approve-sign-message").textContent).toBe(
+        "This message is not text.",
+    );
+    expect(node("approve-sign-hex").textContent).toBe("0xff00");
+});
+
+test("a message that is not hex is shown as text and cannot be signed", async () => {
+    await openPersonalSign("Hello world");
+    expect(shownMessage()).toBe("Hello world");
+    expect(node("approve-sign-error").textContent).toBe(
+        "This message is plain text, not hex, so it cannot be signed.",
+    );
+    expect(node("btn-approve-sign").disabled).toBe(true);
+    expect(node("approve-sign-hex-section").classList.contains("hidden")).toBe(
+        true,
+    );
+});
@@ -0,0 +1,105 @@
+// What reaches the console when the RPC endpoint answers with an HTTP error.
+//
+// RPC providers put the API key in the endpoint URL's path or query string.
+// When the endpoint answers with an HTTP error (a wrong or expired key, a rate
+// limit, a server error), the error ethers throws carries the full request URL
+// in its message, so a line logging that message printed the key
+// (https://git.eeqj.de/sneak/AutistMask/issues/410). Those lines log the
+// error's short message, which names the HTTP status and not the URL.
+//
+// The real ethers provider runs; only its HTTP transport is replaced, by one
+// that answers every request with 401 Unauthorized. Debug mode is on, so
+// every log level is printed.
+
+const { FetchRequest } = require("ethers");
+const {
+    getProvider,
+    lookupTokenInfo,
+    refreshBalances,
+} = require("../src/shared/balances");
+const { getFullWarnings } = require("../src/shared/addressWarnings");
+const { resolveEnsName } = require("../src/shared/ens");
+const { setRuntimeDebug } = require("../src/shared/log");
+
+const RPC_URL = "https://rpc.example.invalid/v3/PATHKEY123?token=QUERYTOKEN456";
+const ADDRESS = "0x1111111111111111111111111111111111111111";
+
+const realFetch = globalThis.fetch;
+let printed;
+
+beforeEach(() => {
+    setRuntimeDebug(true);
+    printed = [];
+    for (const method of ["log", "warn", "error"]) {
+        jest.spyOn(console, method).mockImplementation((...args) => {
+            printed.push(args.map(String).join(" "));
+        });
+    }
+    FetchRequest.registerGetUrl(async () => ({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        headers: {},
+        body: new Uint8Array(),
+    }));
+    // The explorer requests the balance refresh makes go nowhere.
+    globalThis.fetch = jest.fn(async () => {
+        throw new Error("tests must not perform network requests");
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    setRuntimeDebug(false);
+    jest.restoreAllMocks();
+});
+
+// The line carrying `label` was printed and names the HTTP status, and nothing
+// printed carries the key.
+function expectFailureLoggedWithoutKey(label) {
+    const line = printed.find((text) => text.includes(label));
+    expect(line).toContain("401");
+    const all = printed.join("\n");
+    expect(all).not.toContain("PATHKEY123");
+    expect(all).not.toContain("QUERYTOKEN456");
+}
+
+test("ethers puts the URL in the error message, not in the short message", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const error = await provider.getCode(ADDRESS).catch((e) => e);
+    expect(error.message).toContain("PATHKEY123");
+    expect(error.shortMessage).not.toContain("PATHKEY123");
+});
+
+test("the recipient checks before a send", async () => {
+    await getFullWarnings(ADDRESS, getProvider(RPC_URL, "mainnet"));
+    expectFailureLoggedWithoutKey("contract check failed");
+    expectFailureLoggedWithoutKey("tx count check failed");
+});
+
+test("the ENS reverse lookup", async () => {
+    expect(await resolveEnsName(ADDRESS, RPC_URL, "mainnet")).toBeNull();
+    expectFailureLoggedWithoutKey("ENS reverse lookup failed");
+});
+
+test("the balance refresh", async () => {
+    const wallets = [{ addresses: [{ address: ADDRESS }] }];
+    await refreshBalances(
+        wallets,
+        RPC_URL,
+        "https://explorer.example.invalid/api/v2",
+        [],
+        "mainnet",
+    );
+    expectFailureLoggedWithoutKey("ETH balance failed");
+    expectFailureLoggedWithoutKey("ENS reverse failed");
+});
+
+// The lookup's first line, at debug level, names the RPC endpoint; the check
+// of everything printed covers it too.
+test("the token lookup", async () => {
+    await expect(lookupTokenInfo(ADDRESS, RPC_URL, "mainnet")).rejects.toThrow(
+        "Not a valid ERC-20 token",
+    );
+    expectFailureLoggedWithoutKey("symbol() failed:");
+});
@@ -0,0 +1,146 @@
+// Which site a page's request is attributed to.
+//
+// The background takes a request's origin from what the browser says sent the
+// message: sender.origin, or on Firefox before 126, which has no
+// sender.origin, the origin of sender.url — the frame that sent it. It used to
+// fall back to the tab's page and then to an origin the message itself
+// carried, so a request from a frame was credited to the site embedding it,
+// and a request the browser said nothing about was credited to whatever the
+// page wrote (https://git.eeqj.de/sneak/AutistMask/issues/407).
+//
+// Every sender here lacks sender.origin, as on old Firefox. The connection
+// check on eth_accounts is what shows which site a request was credited to.
+
+const { makeStorageStub } = require("./support/storageStub");
+
+const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+// The site the persisted state has connected, and one it has never heard of.
+const CONNECTED_ORIGIN = "https://dapp.example";
+const STRANGER_ORIGIN = "https://stranger.example";
+
+async function settle() {
+    for (let i = 0; i < 50; i++) await Promise.resolve();
+}
+
+afterEach(() => {
+    delete global.chrome;
+});
+
+function loadBackground() {
+    jest.resetModules();
+
+    jest.doMock("../src/shared/balances", () => ({
+        getProvider: () => ({}),
+        refreshBalances: jest.fn(async () => {}),
+    }));
+    jest.doMock("../src/shared/phishingDomains", () => ({
+        isPhishingDomain: () => false,
+    }));
+    jest.doMock("../src/shared/alarms", () => ({
+        BALANCE_REFRESH_ALARM: "balance",
+        BALANCE_REFRESH_PERIOD_MINUTES: 1,
+        ensureRecurringAlarms: jest.fn(async () => {}),
+        registerAlarmHandlers: jest.fn(),
+    }));
+
+    const storage = makeStorageStub({
+        autistmask: {
+            networkId: "mainnet",
+            wallets: [
+                {
+                    name: "Wallet 1",
+                    type: "hd",
+                    addresses: [
+                        { address: ADDRESS, balance: "0", tokenBalances: [] },
+                    ],
+                },
+            ],
+            activeAddress: ADDRESS,
+            allowedSites: { [ADDRESS]: [CONNECTED_ORIGIN] },
+            deniedSites: {},
+        },
+    });
+
+    let messageListener = null;
+    global.chrome = {
+        storage,
+        runtime: {
+            getURL: (path) => "chrome-extension://autistmask/" + path,
+            onMessage: {
+                addListener: (fn) => {
+                    messageListener = fn;
+                },
+            },
+            onConnect: { addListener: () => {} },
+            lastError: null,
+        },
+        windows: { onRemoved: { addListener: () => {} } },
+        action: { setPopup: () => {} },
+    };
+
+    require("../src/background/index");
+
+    // Ask for eth_accounts. `claimedOrigin` is an origin written into the
+    // message, as the content script used to send.
+    return async function accounts(sender, claimedOrigin) {
+        let result = null;
+        messageListener(
+            {
+                type: "AUTISTMASK_RPC",
+                method: "eth_accounts",
+                params: [],
+                origin: claimedOrigin,
+            },
+            sender,
+            (r) => {
+                result = r;
+            },
+        );
+        await settle();
+        return result;
+    };
+}
+
+describe("a request is attributed to the frame that sent it", () => {
+    test("a stranger's frame on a connected site gets no address", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts({
+            url: STRANGER_ORIGIN + "/frame.html",
+            tab: { url: CONNECTED_ORIGIN + "/" },
+        });
+
+        expect(result).toEqual({ result: [] });
+    });
+
+    test("a connected site's frame on a stranger's page gets the address", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts({
+            url: CONNECTED_ORIGIN + "/frame.html",
+            tab: { url: STRANGER_ORIGIN + "/" },
+        });
+
+        expect(result).toEqual({ result: [ADDRESS] });
+    });
+});
+
+describe("a request the browser does not say the sender of", () => {
+    test("is refused, whatever the tab or the message says", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts(
+            { tab: { url: CONNECTED_ORIGIN + "/" } },
+            CONNECTED_ORIGIN,
+        );
+
+        expect(result).toEqual({
+            error: {
+                code: 4100,
+                message:
+                    "The wallet could not tell which site sent this request.",
+            },
+        });
+    });
+});
@@ -66,6 +66,7 @@ jest.mock("../src/shared/log", () => ({
        status: 200,
        json: async () => mockExplorer.items,
    })),
+    urlOrigin: () => "",
    setRuntimeDebug: () => {},
    isDebug: () => false,
 }));
@@ -232,7 +233,7 @@ async function confirmSend(amount, token = "ETH") {
 async function approveTxWithFeePerGas(maxFeePerGas) {
    approvalDetails = {
        type: "tx",
-        hostname: "dapp.example",
+        origin: "https://dapp.example",
        approvedFrom: HOLDER,
        approvedTx: {
            to: RECIPIENT,
@@ -0,0 +1,148 @@
+// What reaches the console when an endpoint check in Settings fails.
+//
+// fetch refuses a URL with a user name and password in it, or one it cannot
+// parse, with an error whose message carries the whole URL: the password, and
+// any API key in the path or query string. The checks behind the RPC and
+// Blockscout Save buttons printed that message
+// (https://git.eeqj.de/sneak/AutistMask/issues/410); they now name the
+// endpoint by its origin.
+//
+// The real fetch runs; it throws before making any request. Debug mode is on,
+// so every log level is printed.
+
+const SECRETS = ["SECRETPASS789", "PATHKEY123", "QUERYTOKEN456"];
+const RPC_WITH_PASSWORD =
+    "https://user:SECRETPASS789@rpc.example.invalid/v3/PATHKEY123?token=QUERYTOKEN456";
+// Port 99999 is out of range, so the URL does not parse.
+const RPC_UNPARSEABLE =
+    "https://rpc.example.invalid:99999/v3/PATHKEY123?token=QUERYTOKEN456";
+const BLOCKSCOUT_WITH_PASSWORD =
+    "https://user:SECRETPASS789@explorer.example.invalid/PATHKEY123/api/v2";
+
+const SAVED_RPC = "https://saved-rpc.example.invalid";
+const SAVED_BLOCKSCOUT = "https://saved-explorer.example.invalid/api/v2";
+
+let elements;
+let flashes;
+let printed;
+let state;
+
+// A stand-in for one DOM node: enough of an element for init() to set
+// properties on it and hang listeners off it.
+function fakeElement() {
+    return {
+        value: "",
+        checked: false,
+        textContent: "",
+        href: "",
+        style: {},
+        dataset: {},
+        classList: { add() {}, remove() {} },
+        listeners: {},
+        addEventListener(event, handler) {
+            this.listeners[event] = handler;
+        },
+        querySelectorAll: () => [],
+    };
+}
+
+function element(id) {
+    return (elements[id] ||= fakeElement());
+}
+
+function loadSettingsView() {
+    elements = {};
+    flashes = [];
+
+    jest.resetModules();
+
+    jest.doMock("../src/popup/views/helpers", () => ({
+        $: element,
+        showView: () => {},
+        updateDebugBanner: () => {},
+        showFlash: (msg) => flashes.push(msg),
+        escapeHtml: (s) => s,
+        flashCopyFeedback: () => {},
+        goBack: () => {},
+        pushCurrentView: () => {},
+        onViewLeave: () => {},
+        VIEWS: [],
+    }));
+
+    state = require("../src/shared/state").state;
+    state.rpcUrl = SAVED_RPC;
+    state.blockscoutUrl = SAVED_BLOCKSCOUT;
+    require("../src/shared/log").setRuntimeDebug(true);
+
+    require("../src/popup/views/settings").init({});
+}
+
+async function save(fieldId, buttonId, typed) {
+    element(fieldId).value = typed;
+    await element(buttonId).listeners.click();
+}
+
+// The check failed, nothing was saved, and nothing printed carries the
+// password or the key.
+function expectFailedWithoutSecrets(label) {
+    expect(flashes).toContain("Could not reach endpoint.");
+    expect(state.rpcUrl).toBe(SAVED_RPC);
+    expect(state.blockscoutUrl).toBe(SAVED_BLOCKSCOUT);
+    const line = printed.find((text) => text.includes(label));
+    expect(line).toBeDefined();
+    const all = printed.join("\n");
+    for (const secret of SECRETS) {
+        expect(all).not.toContain(secret);
+    }
+    return line;
+}
+
+beforeEach(() => {
+    printed = [];
+    for (const method of ["log", "warn", "error"]) {
+        jest.spyOn(console, method).mockImplementation((...args) => {
+            printed.push(args.map(String).join(" "));
+        });
+    }
+    globalThis.chrome = {
+        runtime: { sendMessage: () => {} },
+        storage: { local: { get: async () => ({}), set: async () => {} } },
+    };
+});
+
+afterEach(() => {
+    jest.dontMock("../src/popup/views/helpers");
+    delete globalThis.chrome;
+    jest.restoreAllMocks();
+});
+
+test("fetch puts the whole URL in the error it throws for such a URL", async () => {
+    for (const url of [RPC_WITH_PASSWORD, RPC_UNPARSEABLE]) {
+        const error = await fetch(url).catch((e) => e);
+        expect(error.message).toContain("PATHKEY123");
+    }
+});
+
+test("the RPC check of a URL with a user name and password", async () => {
+    loadSettingsView();
+    await save("settings-rpc", "btn-save-rpc", RPC_WITH_PASSWORD);
+    const line = expectFailedWithoutSecrets("RPC validation fetch failed");
+    expect(line).toContain("https://rpc.example.invalid");
+});
+
+test("the RPC check of a URL that does not parse", async () => {
+    loadSettingsView();
+    await save("settings-rpc", "btn-save-rpc", RPC_UNPARSEABLE);
+    expectFailedWithoutSecrets("RPC validation fetch failed");
+});
+
+test("the Blockscout check of a URL with a user name and password", async () => {
+    loadSettingsView();
+    await save(
+        "settings-blockscout",
+        "btn-save-blockscout",
+        BLOCKSCOUT_WITH_PASSWORD,
+    );
+    const line = expectFailedWithoutSecrets("Blockscout validation failed");
+    expect(line).toContain("https://explorer.example.invalid");
+});
@@ -270,31 +270,32 @@ describe("background refresh racing a wallet deleted on another page", () => {
    });
 });

-// allowedSites/deniedSites: { [address]: [hostname, ...] }. Mutated in place
-// from two different contexts — src/background/index.js:592-599 pushes a
-// newly approved hostname onto state.allowedSites[activeAddress], and the
-// Settings "revoke" button (src/popup/views/settings.js:55-68) filters a
-// hostname out of state[key][addr] in place, deleting the address key
-// entirely once its list is empty — the exact membership-vs-whole-field
-// pattern that made the whole-field `wallets` diff unsafe, on a
-// security-relevant field: a stale whole-field save here can resurrect a
-// revoked permission or wipe a freshly granted one.
+// allowedSites/deniedSites: { [address]: [origin, ...] }. Mutated in place
+// from two different contexts — rememberSiteChoice() in
+// src/background/index.js pushes a newly approved origin onto
+// state.allowedSites[activeAddress], and the Settings "revoke" button
+// (forgetOrigin() in src/popup/views/settings.js) filters an origin out of
+// state[key][addr] in place, deleting the address key entirely once its list
+// is empty — the exact membership-vs-whole-field pattern that made the
+// whole-field `wallets` diff unsafe, on a security-relevant field: a stale
+// whole-field save here can resurrect a revoked permission or wipe a freshly
+// granted one.
 const ADDR1 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 const ADDR2 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";

-function approveSite(pageState, address, hostname) {
+function approveSite(pageState, address, origin) {
    if (!pageState.allowedSites[address]) {
        pageState.allowedSites[address] = [];
    }
-    if (!pageState.allowedSites[address].includes(hostname)) {
-        pageState.allowedSites[address].push(hostname);
+    if (!pageState.allowedSites[address].includes(origin)) {
+        pageState.allowedSites[address].push(origin);
    }
 }

-function revokeSite(pageState, hostname) {
+function revokeSite(pageState, origin) {
    for (const addr of Object.keys(pageState.allowedSites)) {
        pageState.allowedSites[addr] = pageState.allowedSites[addr].filter(
-            (h) => h !== hostname,
+            (o) => o !== origin,
        );
        if (pageState.allowedSites[addr].length === 0) {
            delete pageState.allowedSites[addr];
@@ -308,7 +309,7 @@ describe("a dApp approval racing a stale Settings page's later save", () => {
        await storage.set({
            autistmask: {
                wallets: [W1],
-                allowedSites: { [ADDR2]: ["other.example"] },
+                allowedSites: { [ADDR2]: ["https://other.example"] },
            },
        });

@@ -318,24 +319,24 @@ describe("a dApp approval racing a stale Settings page's later save", () => {
        await settings.state.loadState();

        // A dApp approval window, opened later, approves a new site for a
-        // different address and saves — the real sequence at
-        // src/background/index.js:592-599.
+        // different address and saves — the real sequence in
+        // rememberSiteChoice(), src/background/index.js.
        const approval = loadPage(storage);
        await approval.state.loadState();
-        approveSite(approval.state.state, ADDR1, "dapp.example");
+        approveSite(approval.state.state, ADDR1, "https://dapp.example");
        await approval.state.saveState();
        expect(
            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
-        ).toEqual(["dapp.example"]);
+        ).toEqual(["https://dapp.example"]);

-        // Settings revokes its own, unrelated site — the real sequence at
-        // src/popup/views/settings.js:55-68 — and saves from state loaded
-        // before the dApp approval ever happened.
-        revokeSite(settings.state.state, "other.example");
+        // Settings revokes its own, unrelated site — the real sequence in
+        // forgetOrigin(), src/popup/views/settings.js — and saves from state
+        // loaded before the dApp approval ever happened.
+        revokeSite(settings.state.state, "https://other.example");
        await settings.state.saveState();

        const persisted = (await storage.get("autistmask")).autistmask;
-        expect(persisted.allowedSites[ADDR1]).toEqual(["dapp.example"]);
+        expect(persisted.allowedSites[ADDR1]).toEqual(["https://dapp.example"]);
        expect(persisted.allowedSites[ADDR2]).toBeUndefined();
    });
 });
@@ -346,7 +347,7 @@ describe("a revoked site permission against a stale page's later save", () => {
        await storage.set({
            autistmask: {
                wallets: [W1],
-                allowedSites: { [ADDR1]: ["evil.example"] },
+                allowedSites: { [ADDR1]: ["https://evil.example"] },
            },
        });

@@ -354,23 +355,24 @@ describe("a revoked site permission against a stale page's later save", () => {
        const stale = loadPage(storage);
        await stale.state.loadState();

-        // Settings revokes it — src/popup/views/settings.js:55-68 — from a
-        // second page.
+        // Settings revokes it — forgetOrigin(), src/popup/views/settings.js —
+        // from a second page.
        const settings = loadPage(storage);
        await settings.state.loadState();
-        revokeSite(settings.state.state, "evil.example");
+        revokeSite(settings.state.state, "https://evil.example");
        await settings.state.saveState();
        expect(
            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
        ).toBeUndefined();

        // The stale page, unaware of the revoke, approves an unrelated site
-        // for a different address and saves — src/background/index.js:592-599.
-        approveSite(stale.state.state, ADDR2, "good.example");
+        // for a different address and saves — rememberSiteChoice(),
+        // src/background/index.js.
+        approveSite(stale.state.state, ADDR2, "https://good.example");
        await stale.state.saveState();

        const persisted = (await storage.get("autistmask")).autistmask;
-        expect(persisted.allowedSites[ADDR2]).toEqual(["good.example"]);
+        expect(persisted.allowedSites[ADDR2]).toEqual(["https://good.example"]);
        expect(persisted.allowedSites[ADDR1]).toBeUndefined();
    });
 });
@@ -148,6 +148,173 @@ describe("the destructive reset on the recovery screen", () => {
    });
 });

+describe("a popup already open when the stored profile becomes unreadable", () => {
+    // https://git.eeqj.de/sneak/AutistMask/issues/373. The popup used to stay
+    // on the wallet list with the last good balances, and only a reopen
+    // reached the recovery screen.
+    test("moves to the recovery screen at its next refresh", async () => {
+        const env = await bootPopup(unversionedValidProfile());
+        expect(env.visibleViews()).toEqual(["main"]);
+
+        env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
+        await env.tick();
+
+        expect(env.visibleViews()).toEqual(["state-recovery"]);
+        expect(env.text("state-recovery-problem").length).toBeGreaterThan(10);
+        expect(env.hidden("btn-settings")).toBe(true);
+        expect(env.storage.read("autistmask")).toEqual(CORRUPT_BLOBS[0].blob);
+    });
+
+    test("stops the ten-second refresh", async () => {
+        const env = await bootPopup(unversionedValidProfile());
+        env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
+        await env.tick();
+        const { refreshBalances } = require("../src/shared/balances");
+        const calls = refreshBalances.mock.calls.length;
+
+        await env.tick();
+
+        expect(refreshBalances).toHaveBeenCalledTimes(calls);
+    });
+
+    test("a later save does not clear what the user exported or typed", async () => {
+        const env = await bootPopup(unversionedValidProfile());
+        env.storage.write("autistmask", CORRUPT_BLOBS[2].blob);
+        await env.tick();
+
+        await env.click("btn-state-recovery-export");
+        env.node("state-recovery-reset-input").value = "erase my";
+        // Such as the save of a refresh already in flight when the screen
+        // went up.
+        const { saveState } = require("../src/shared/state");
+        await expect(saveState()).rejects.toThrow();
+        await env.settle();
+
+        expect(env.visibleViews()).toEqual(["state-recovery"]);
+        expect(env.hidden("state-recovery-blob")).toBe(false);
+        expect(env.value("state-recovery-reset-input")).toBe("erase my");
+    });
+
+    // The record can become readable again under this popup, erased from the
+    // recovery screen of another window, so a save from this one can succeed.
+    test("a popup opened after the record is erased elsewhere shows a screen", async () => {
+        const env = await bootPopup(unversionedValidProfile());
+        env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
+        await env.tick();
+        expect(env.visibleViews()).toEqual(["state-recovery"]);
+
+        await env.storage.remove("autistmask");
+        const { saveState } = require("../src/shared/state");
+        await saveState();
+
+        const reopened = await bootPopup(env.storage.read("autistmask"));
+        expect(reopened.visibleViews()).toEqual(["welcome"]);
+    });
+
+    test("a stored current view of the recovery screen does not blank the popup", async () => {
+        const env = await bootPopup(
+            unversionedValidProfile({ currentView: "state-recovery" }),
+        );
+        expect(env.visibleViews()).toEqual(["main"]);
+    });
+
+    test("a transaction wait that ends under it does not replace it", async () => {
+        const env = await bootPopup(
+            unversionedValidProfile({
+                currentView: "wait-tx",
+                viewData: {
+                    pendingWait: {
+                        hash: "0x1",
+                        txInfo: { to: ADDRESS, amount: "1", token: "ETH" },
+                        broadcastTime: Date.now(),
+                    },
+                },
+            }),
+        );
+        expect(env.visibleViews()).toEqual(["wait-tx"]);
+        env.storage.write("autistmask", CORRUPT_BLOBS[2].blob);
+        await env.tick();
+        await env.click("btn-state-recovery-export");
+        env.node("state-recovery-reset-input").value = "erase my";
+
+        // The test provider answers no receipt lookup, and six that fail in
+        // a row end the wait with an error.
+        for (let i = 0; i < 6; i++) await env.tick();
+
+        expect(env.text("error-tx-message")).toMatch(/could not be reached/);
+        expect(env.visibleViews()).toEqual(["state-recovery"]);
+        expect(env.hidden("state-recovery-blob")).toBe(false);
+        expect(env.value("state-recovery-reset-input")).toBe("erase my");
+    });
+
+    test("a storage read that fails once leaves the wallet list up", async () => {
+        const env = await bootPopup(unversionedValidProfile());
+
+        env.storage.local.get.mockRejectedValueOnce(
+            new Error("IO error: storage busy"),
+        );
+        await env.tick();
+
+        // Reported as a failed save, not mistaken for an unreadable profile.
+        expect(env.visibleViews()).toEqual(["main"]);
+        expect(env.node("save-failure-banner")).not.toBeNull();
+
+        await env.tick();
+        expect(env.visibleViews()).toEqual(["main"]);
+    });
+
+    // The screen it replaces is left as any navigation leaves it: the rules
+    // at the top of src/popup/views/showPhrase.js and exportPrivkey.js hold
+    // for this way off them too.
+    describe("from a screen holding a secret", () => {
+        const PHRASE =
+            "abandon abandon abandon abandon abandon abandon abandon" +
+            " abandon abandon abandon abandon about";
+
+        afterEach(() => jest.dontMock("../src/shared/vault"));
+
+        test("a recovery phrase on screen is wiped", async () => {
+            jest.doMock("../src/shared/vault", () => ({
+                decryptWithPassword: async () => PHRASE,
+            }));
+            const env = await bootPopup(unversionedValidProfile());
+            require("../src/popup/views/showPhrase").show(0);
+            env.node("show-phrase-password").value = "password";
+            await env.click("btn-show-phrase-reveal");
+            expect(env.text("show-phrase-value")).toBe(PHRASE);
+
+            env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
+            await env.tick();
+
+            expect(env.visibleViews()).toEqual(["state-recovery"]);
+            expect(env.text("show-phrase-value")).toBe("");
+        });
+
+        test("a private key still being decrypted is never written", async () => {
+            let answer;
+            jest.doMock("../src/shared/vault", () => ({
+                decryptWithPassword: () =>
+                    new Promise((resolve) => {
+                        answer = resolve;
+                    }),
+            }));
+            const env = await bootPopup(unversionedValidProfile());
+            require("../src/popup/views/exportPrivkey").show(0, 0);
+            env.node("export-privkey-password").value = "password";
+            const revealing = env.click("btn-export-privkey-confirm");
+
+            env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
+            await env.tick();
+            expect(env.visibleViews()).toEqual(["state-recovery"]);
+            expect(env.value("export-privkey-password")).toBe("");
+
+            answer(PHRASE);
+            await revealing;
+            expect(env.text("export-privkey-value")).toBe("");
+        });
+    });
+});
+
 describe("an unversioned profile that is perfectly valid", () => {
    // The upgrade case. Every install in the field is in this state, and the
    // popup must load it, not offer to wipe it.
@@ -167,7 +334,9 @@ describe("an unversioned profile that is perfectly valid", () => {
        expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
        expect(stored.wallets[0].addresses[0].address).toBe(ADDRESS);
        expect(stored.activeAddress).toBe(ADDRESS);
-        expect(stored.allowedSites).toEqual({ [ADDRESS]: ["dapp.example"] });
+        expect(stored.allowedSites).toEqual({
+            [ADDRESS]: ["https://dapp.example"],
+        });
    });
 });

@@ -20,6 +20,30 @@ const path = require("path");

 const { makeStorageStub } = require("./storageStub");

+// The four libraries the popup loads from node_modules, loaded once per test
+// file and handed to every boot. jest.resetModules() in bootPopup() empties the
+// module cache but keeps what jest.doMock() registered, so these registrations
+// hold for every boot in the file and the libraries are not loaded again. None
+// of them holds popup state; everything under src/ is still loaded fresh on
+// each boot.
+//
+// A test's own mock of one of them: a jest.doMock() made inside the test
+// replaces the registration here, as it would for any module. A top-of-file
+// jest.mock() is what the require() below gets, so it is kept, but its factory
+// runs once per file and every boot shares the same mock object.
+const ethers = require("ethers");
+const sodium = require("libsodium-wrappers-sumo");
+const QRCode = require("qrcode");
+const makeBlockie = require("ethereum-blockies-base64");
+jest.doMock("ethers", () => ethers);
+jest.doMock("libsodium-wrappers-sumo", () => sodium);
+jest.doMock("qrcode", () => QRCode);
+jest.doMock("ethereum-blockies-base64", () => makeBlockie);
+
+// Taken before any boot replaces them; see bootPopup().
+const realSetInterval = globalThis.setInterval;
+const realClearInterval = globalThis.clearInterval;
+
 const POPUP_HTML = fs.readFileSync(
    path.join(__dirname, "..", "..", "src", "popup", "index.html"),
    "utf8",
@@ -51,7 +75,7 @@ function unversionedValidProfile(extra) {
        networkId: "mainnet",
        rpcUrl: "https://ethereum-rpc.publicnode.com",
        blockscoutUrl: "https://eth.blockscout.com/api/v2",
-        allowedSites: { [ADDRESS]: ["dapp.example"] },
+        allowedSites: { [ADDRESS]: ["https://dapp.example"] },
        deniedSites: {},
        trackedTokens: [],
        theme: "system",
@@ -272,9 +296,20 @@ async function bootPopup(stored, options) {
        }),
        addEventListener: () => {},
    };
-    // The 10s refresh loop init() starts would outlive the test.
-    const realSetInterval = globalThis.setInterval;
-    globalThis.setInterval = () => 0;
+    // The ten-second refresh init() starts, and a transaction wait's timers,
+    // would outlive the test. So every interval is recorded rather than
+    // started, clearInterval() removes it as a browser would, and tick() below
+    // runs the ones still set. Put back by cleanupPopup().
+    const intervals = new Map();
+    let lastId = 0;
+    globalThis.setInterval = (fn) => {
+        lastId += 1;
+        intervals.set(lastId, fn);
+        return lastId;
+    };
+    globalThis.clearInterval = (id) => {
+        intervals.delete(id);
+    };

    require("../../src/popup/index");

@@ -296,8 +331,6 @@ async function bootPopup(stored, options) {
    }
    await settle();

-    globalThis.setInterval = realSetInterval;
-
    return {
        storage,
        document,
@@ -317,6 +350,12 @@ async function bootPopup(stored, options) {
            for (const fn of fns) await fn();
            await settle();
        },
+        // Every interval still set runs once: the ten-second refresh, and a
+        // transaction wait's receipt poll and elapsed counter while one runs.
+        tick: async () => {
+            for (const fn of intervals.values()) await fn();
+            await settle();
+        },
        settle,
        // The view ids whose section is not hidden, as the audit measured them.
        visibleViews: () => {
@@ -334,6 +373,8 @@ function cleanupPopup() {
    delete globalThis.chrome;
    delete globalThis.document;
    delete globalThis.window;
+    globalThis.setInterval = realSetInterval;
+    globalThis.clearInterval = realClearInterval;
 }

 module.exports = {
@@ -44,6 +44,7 @@ jest.mock("../src/shared/log", () => ({
        errorf: () => {},
    },
    debugFetch: jest.fn(),
+    urlOrigin: () => "",
    setRuntimeDebug: () => {},
    isDebug: () => false,
 }));
@@ -4,7 +4,7 @@
 // contract at signing time, with nothing comparing the two, so a token whose
 // on-chain scale differed signed an amount that was never displayed.

-const { parseUnits } = require("ethers");
+const { formatUnits, parseUnits } = require("ethers");
 const {
    displayedDecimals,
    transferAmountUnits,
@@ -25,7 +25,17 @@ describe("displayedDecimals", () => {
        expect(displayedDecimals(MAX_DECIMALS)).toBe(MAX_DECIMALS);
    });

-    test("refuses anything that is not a uint8", () => {
+    // decimals() is a uint8, but formatUnits() and parseUnits() stop at 80
+    // places, so a larger scale cannot be shown or encoded
+    // (https://git.eeqj.de/sneak/AutistMask/issues/350).
+    test("accepts exactly the scales the formatter accepts", () => {
+        expect(() => formatUnits(1n, MAX_DECIMALS)).not.toThrow();
+        expect(() => parseUnits("1", MAX_DECIMALS)).not.toThrow();
+        expect(() => formatUnits(1n, MAX_DECIMALS + 1)).toThrow();
+        expect(() => parseUnits("1", MAX_DECIMALS + 1)).toThrow();
+    });
+
+    test("refuses anything that is not a uint8 the formatter accepts", () => {
        for (const bad of [
            null,
            undefined,
@@ -471,7 +471,7 @@ async function openSignScreen(data) {
            if (msg.type !== "AUTISTMASK_GET_APPROVAL") return reply(null);
            reply({
                type: "sign",
-                hostname: "dapp.example",
+                origin: "https://dapp.example",
                isPhishingDomain: false,
                approvedFrom: OWNER,
                signParams: request(data),
@@ -126,6 +126,19 @@ describe("a swap of a token outside the bundled list", () => {
    test("a bundled token on the other side still formats", () => {
        expect(swapDetail(data(), "Min. received").value).toBe("0.5000 WETH");
    });
+
+    // A token added by hand carries whatever its decimals() returned, and a
+    // uint8 reaches 255, but formatUnits() throws above 80. The throw left the
+    // whole swap undecoded rather than refused
+    // (https://git.eeqj.de/sneak/AutistMask/issues/350).
+    test("refuses to format when the token reports more than 80 decimals", () => {
+        state.trackedTokens = [
+            { address: NOVEL, symbol: "NOVEL", decimals: 81 },
+        ];
+        expect(swapDetail(data(), "Amount").value).toBe(
+            "1000000000 base units (decimals unknown)",
+        );
+    });
 });

 describe("the Min. received line takes the same rule", () => {
@@ -28,11 +28,14 @@ function makeState(overrides = {}) {
        selectedAddress: 0,
        activeAddress: A0,
        allowedSites: {
-            [A0]: ["a.example"],
-            [A1]: ["b.example"],
-            [B0]: ["c.example"],
+            [A0]: ["https://a.example"],
+            [A1]: ["https://b.example"],
+            [B0]: ["https://c.example"],
+        },
+        deniedSites: {
+            [A1]: ["https://d.example"],
+            [C0]: ["https://e.example"],
        },
-        deniedSites: { [A1]: ["d.example"], [C0]: ["e.example"] },
        ...overrides,
    };
 }
@@ -41,7 +44,7 @@ describe("removeWalletFromState", () => {
    test("deleting the last wallet clears hasWallet", () => {
        const state = makeState({
            wallets: [wallet("A", [A0])],
-            allowedSites: { [A0]: ["a.example"] },
+            allowedSites: { [A0]: ["https://a.example"] },
            deniedSites: {},
        });

@@ -109,8 +112,8 @@ describe("removeWalletFromState", () => {

        removeWalletFromState(state, 0);

-        expect(state.allowedSites).toEqual({ [B0]: ["c.example"] });
-        expect(state.deniedSites).toEqual({ [C0]: ["e.example"] });
+        expect(state.allowedSites).toEqual({ [B0]: ["https://c.example"] });
+        expect(state.deniedSites).toEqual({ [C0]: ["https://e.example"] });
    });
 });

@@ -126,8 +129,14 @@ function makeAddressState(overrides = {}) {
        selectedWallet: 0,
        selectedAddress: 0,
        activeAddress: A0,
-        allowedSites: { [A0]: ["a.example"], [A1]: ["b.example"] },
-        deniedSites: { [A1]: ["d.example"], [B0]: ["e.example"] },
+        allowedSites: {
+            [A0]: ["https://a.example"],
+            [A1]: ["https://b.example"],
+        },
+        deniedSites: {
+            [A1]: ["https://d.example"],
+            [B0]: ["https://e.example"],
+        },
        ...overrides,
    };
 }
@@ -273,8 +282,8 @@ describe("removeAddressFromState", () => {

        removeAddressFromState(state, 0, 1);

-        expect(state.allowedSites).toEqual({ [A0]: ["a.example"] });
-        expect(state.deniedSites).toEqual({ [B0]: ["e.example"] });
+        expect(state.allowedSites).toEqual({ [A0]: ["https://a.example"] });
+        expect(state.deniedSites).toEqual({ [B0]: ["https://e.example"] });
    });

    // The derivation counter is a high-water mark, never rewound: "+" derives
Author	SHA1	Message	Date
sneak	057d49d5b2	fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 3s Details A popup already open when the stored profile became unreadable stayed on the last good profile until reopened. Every save already runs the check loadState() runs at open; a save refused by it now stops the ten-second refresh, runs the leave cleanup of the current screen, and raises the recovery screen. From then on showView() shows nothing else in that popup, so a transaction wait or a later save cannot take the user off it or clear an export or a typed confirmation. That is held in memory, never as the saved current view, so a popup opened after the record is erased elsewhere opens normally. Any other failed save keeps the "NOT SAVED" banner. The popup test harness now honours clearInterval(). Model: opus-5-5	2026-10-04 21:08:37 +00:00
clawbot	375998beaf	harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 2s Details The signature screen showed only the text a personal message decodes to, with bidirectional, right-to-left and zero-width characters acting on it, so a site could make the message read differently from the bytes that are signed, and a message that was not hex was decoded into NUL characters. The screen now shows the hex as "Raw data" alongside the text, lays the text out left to right in byte order, and shows each control character, line and paragraph separator, and character that paints nothing (the set src/shared/symbolSpoof.js already strips) as a U+XXXX mark. A message is hex when getBytes, which signing uses, reads it; one that is not cannot be signed, so it is shown as plain text with "Sign" disabled. Model: opus-5-5	2026-10-04 22:09:07 +02:00
clawbot	3b713809c8	harden: a token scale above 80 decimal places is refused as unknown (closes #350 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 3s Details e2e / e2e-firefox (push) Failing after 2s Details toDecimals() accepted any uint8 scale, but formatUnits() and parseUnits() refuse more than 80 decimal places. A token reporting 81 to 255 made the formatter throw, and the catch in the swap decoder and in the ERC-20 decoder turned that into an undecoded approval screen with nothing saying why. MAX_DECIMALS is now 80, the formatter's own limit, so such a scale is treated exactly like an unknown one: both approval paths show the base-unit amount with the scale stated as unknown. The balance list, the history list and the Send screen use the same check. Model: opus-5-5	2026-10-04 21:43:11 +02:00
clawbot	8ac2c87c2c	harden: debug mode logs only a request's origin and JSON-RPC method (closes #410 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 1s Details e2e / e2e-firefox (push) Failing after 2s Details With debug mode on, debugFetch logged every request's full URL and body, so an RPC endpoint with an API key in its path or query string printed that key to the console on every request. It now logs the HTTP method, the URL's origin and, for a JSON-RPC body, the method name. The balance refresh and token lookup log the RPC endpoint by its origin too. Failed RPC calls print ethers' short message, since its full message for an HTTP error carries the request URL. A failed endpoint check in settings prints the endpoint's origin, since fetch's error for a URL with a user name and password carries the whole URL. The README's DEBUG Mode Policy says what debug mode logs. Model: opus-5-5	2026-10-04 21:09:04 +02:00
clawbot	d1751beb32	harden: one connection and one signature prompt per site at a time (closes #405 ) check / check (push) Failing after 1s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 2s Details Each eth_requestAccounts or personal_sign call opened another approval window, so a page calling in a loop could cover the screen with identical prompts. While a site's connection or signature prompt is unanswered, a further request of that kind from the same site is now refused with EIP-1193 -32002 and opens no window; all signing methods count as one kind. A connection prompt whose toolbar popup closed before it connected, and which the toolbar popup no longer opens, is shown again by the site's next request instead of refusing the site until the address changes. Model: opus-5-5	2026-10-04 19:43:11 +02:00
clawbot	de3f7a9a11	harden: ignore a nonce the page supplies with eth_sendTransaction (closes #404 ) check / check (push) Failing after 3s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 2s Details A site could fix the nonce of the transaction the user was asked to sign: the same nonce as a pending transaction, at a higher fee, replaces it, and a nonce above the account's next one leaves the new transaction stuck behind a gap. `nonce` is no longer one of the fields taken from the request, so the transaction always gets the account's next nonce from the network, and that is the nonce the approval screen shows and the popup signs. Model: opus-5-5	2026-10-04 18:43:04 +02:00
clawbot	1144fdb71b	harden: key remembered site permissions by full origin (closes #402 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 1s Details allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 18:09:04 +02:00
clawbot	f24b5bca19	harden: take a request's origin from the frame that sent it (closes #407 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 3s Details e2e / e2e-firefox (push) Failing after 2s Details Where the browser gives no sender.origin (Firefox before 126), the background credited a page's request to the tab's page, so a frame from another site counted as the site embedding it, and with no tab it used an origin the page wrote into the message. It now uses the origin of sender.url, the frame that sent the message, and refuses the request with code 4100 when the browser gives neither. The content script no longer writes an origin into the message. Model: opus-5-5	2026-10-04 17:26:05 +02:00
clawbot	9f0e88e963	test: load the popup's libraries once per test file, not on every boot (closes #428 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 2s Details Every popup boot in the tests resets jest's module registry so that src/ loads fresh, and that also reloaded ethers, libsodium-wrappers-sumo, qrcode and ethereum-blockies-base64 each time. tests/support/popupBoot.js now loads those four once per test file and registers them once with jest.doMock(), which jest.resetModules() keeps, so every boot gets the same copies. No test or assertion changed. make test takes 8-13s on the shared build host, down from 17-25s, measured in alternating runs before and after the change. Model: opus-5-5	2026-10-04 16:59:12 +02:00
clawbot	45f11ee920	fix: say an unknown-scale balance the same way on Send and on confirm (closes #377 ) check / check (push) Failing after 2s Details e2e / e2e-chrome (push) Failing after 2s Details e2e / e2e-firefox (push) Failing after 1s Details When two addresses' explorer reports disagree on a token's decimals, the Send screen showed the stored figure while the confirmation screen said the balance was unknown. One function in send.js now gives both the balance and scale, so both read `unknown (SYMBOL)`. The confirmation screen's fee-unknown message names its cause: for an unknown scale it says the wallet does not know the token's decimal places and the transaction cannot be sent, instead of asking for a retry that cannot help. Other causes keep the old sentence. Model: opus-5-5	2026-10-04 15:59:15 +02:00