test: assert the #150 and #151 items the harness did not cover (closes #188)

The suite asserted that the two screens those issues broke now open
without throwing, which is narrower than their definition of done. The
four remaining items are asserted here, additively; nothing existing was
restructured.

Back navigation out of Add Token is checked against the persisted
navigation stack, read from extension storage, as a delta: the round trip
Home -> AddressDetail -> AddToken -> Back -> Back must leave the stack
exactly as it found it. A stale entry is invisible on screen until the
user presses Back one time too many, which is precisely the second-order
damage of #150, so the stack rather than the visible view is what gets
asserted. Stating it as a delta keeps it independent of whatever depth
earlier tests leave behind.

The quick-pick test clicks a button and requires the address field to
hold that button's contract address; the old assertion only counted the
buttons rendered.

The native ETH detail path needed a fixture: the normal-transactions
endpoint answered with an empty list unconditionally, so there was no
non-ERC-20 row to open at all. seedNativeTransfer serves one, and the
detail screen must show the native type, the value, the raw wei quantity
and no token contract row - the row whose branch is where a regression of
the non-ERC-20 case would land.

Tap-to-copy reads the real clipboard back rather than watching the
handler run, after seeding a sentinel so an untouched clipboard cannot
pass. Clipboard permissions are granted context-wide because an
origin-scoped grant is refused for chrome-extension: URLs.

Each of the four was demonstrated failing against a deliberately broken
build; the captured output is in the pull request.

TODO.md

@@ -45,6 +45,36 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-14: The parts of the
+  [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
+  [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
+  e2e suite did not cover are asserted. It had only shown that the two screens
+  open without throwing. Now: the Add Token round trip leaves the navigation
+  stack exactly as it found it, read out of extension storage rather than
+  inferred from which screen is up, so an orphaned entry — the second-order
+  damage of #150 — is caught where it happens rather than one Back press later;
+  a common-token quick-pick puts its contract address in the field; the native
+  ETH detail path renders with its own type, value and raw quantity and with the
+  token contract row still hidden, against a new `seedNativeTransfer` fixture,
+  since the normal-transactions endpoint answered `[]` unconditionally and there
+  was no non-ERC-20 row to open; and tapping the token contract address puts it
+  on the real clipboard, read back after a sentinel write. Each of the four was
+  demonstrated failing against a deliberately broken build
+  ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
+- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
+  rebuilt every failure as `new Error(error.message)`, so the code the
+  background produced and the content script relayed intact was dropped in the
+  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
+  the user deliberately declined was indistinguishable from one that broke. The
+  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
+  boundary sent one, `data`, passed through verbatim rather than matched against
+  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
+  here. An error the background sent with no code stays a plain `Error` with no
+  `code` property, and `message` is unchanged in every case. All four request
+  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
+  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
+  now requires it on the page's Error as well as on the wire, for all four
+  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
   it. A reopened popup renders the wallet list and the one screen it restores
   onto, so every screen further down the stack was still the blank template from

src/content/inpage.js

@@ -11,6 +11,39 @@
     let nextId = 1;
     const pending = {};
 
+    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
+    // rather than properties bolted onto an Error because this object crosses
+    // no boundary after construction — it is built in the page's own realm and
+    // handed straight to the caller's catch — so the prototype survives and
+    // `error.name` is a stable thing for a dApp to see.
+    class ProviderRpcError extends Error {
+        constructor(code, message, data) {
+            super(message);
+            this.name = "ProviderRpcError";
+            this.code = code;
+            if (data !== undefined) this.data = data;
+        }
+    }
+
+    // Rebuild a boundary error as the error the page catches, carrying the
+    // code (and data) the extension reported. Without this a dApp cannot tell
+    // a user's refusal (4001) from a wallet that broke, and retries or shows
+    // an error instead of accepting the refusal.
+    //
+    // Whatever code arrived is passed through verbatim rather than being
+    // matched against a list: the extension emits 4001, 4100 and 4902 today,
+    // and a code this file has never heard of is still the truth about what
+    // happened. An error reported with no code at all stays a plain Error —
+    // a ProviderRpcError whose `code` is undefined would advertise a
+    // conformance it does not have. `message` is untouched in every case.
+    function toPageError(error) {
+        const message = (error && error.message) || "Request failed";
+        if (error && error.code !== undefined && error.code !== null) {
+            return new ProviderRpcError(error.code, message, error.data);
+        }
+        return new Error(message);
+    }
+
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -20,7 +53,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(new Error(error.message || "Request failed"));
+            p.reject(toPageError(error));
         } else {
             p.resolve(result);
         }

tests/e2e/network.js

@@ -46,9 +46,24 @@ const STUB_TX_HASH =
 
 const STUB_BLOCK_NUMBER = 21000000;
 
+// The native ETH transfer, seeded by opts.seedNativeTransfer. Its own hash
+// and an older block, so it is a second row rather than a leg of the token
+// transfer: mergeTransactions() consolidates a native entry and a token
+// transfer that share a hash into one row, which would leave nothing native
+// to open. 0.25 ETH clears the 100000 gwei dust threshold the default
+// filters apply, so the row is not silently dropped.
+const STUB_NATIVE_TX_HASH =
+    "0xe7e0000000000000000000000000000000000000000000000000000000000e7e";
+
+const STUB_NATIVE_BLOCK_NUMBER = STUB_BLOCK_NUMBER - 1;
+
+const STUB_NATIVE_VALUE_WEI = "250000000000000000";
+
 // Fixed instant so timeAgo() output is stable across runs.
 const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
 
+const STUB_NATIVE_TX_TIMESTAMP = "2026-01-02T02:03:04.000000Z";
+
 // A 32-byte zero word. Returned for every eth_call, which is what makes
 // ethers' ENS reverse lookup resolve to "no resolver set" and return null
 // instead of throwing. A throw would be logged by src/shared/ens.js via
@@ -86,9 +101,11 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records `code` as it arrives. EIP-1193 says a user
+// The rejection branch records the whole observable shape of the error as it
-// rejection is a ProviderRpcError carrying code 4001; what the page can
+// arrives — name, message, and whether a `code` is present at all as distinct
-// actually see is recorded here rather than assumed, and asserted in run.js.
+// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// carrying code 4001; what the page can actually see is recorded here rather
+// than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -120,6 +137,7 @@ const DAPP_HTML = [
     "                    return {",
     "                        settled: 'rejected',",
     "                        message: String((error && error.message) || error),",
+    "                        name: error ? error.name : undefined,",
     "                        hasCode: !!error && 'code' in Object(error),",
     "                        code: error ? error.code : undefined,",
     "                    };",
@@ -255,6 +273,25 @@ function tokenTransferItems(address) {
     ];
 }
 
+// One received native ETH transfer, in the shape src/shared/transactions.js
+// parses. to.is_contract is false and there is no method, so parseTx() keeps
+// it a plain transfer rather than a contract call — which is what makes the
+// detail screen classify it "Native ETH Transfer" and leave the token
+// contract row hidden.
+function nativeTransactionItems(address) {
+    return [
+        {
+            hash: STUB_NATIVE_TX_HASH,
+            block_number: STUB_NATIVE_BLOCK_NUMBER,
+            timestamp: STUB_NATIVE_TX_TIMESTAMP,
+            from: { hash: STUB_COUNTERPARTY },
+            to: { hash: address, is_contract: false },
+            value: STUB_NATIVE_VALUE_WEI,
+            status: "ok",
+        },
+    ];
+}
+
 // A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
 // this is what puts an ERC-20 in the send screen's token dropdown, which is
 // the only way the confirmation screen's ERC-20 path can be reached.
@@ -267,12 +304,17 @@ function tokenBalanceItems() {
     ];
 }
 
-// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
+// Full details for either seeded transaction — the detail screen fetches
-// decoder short-circuits; the on-chain detail fields still populate.
+// them for whichever row was opened, and an unstubbed hash would be
-function transactionDetails() {
+// reported as escaping traffic. raw_input is "0x" so the calldata decoder
+// short-circuits; the on-chain detail fields still populate.
+function transactionDetails(hash) {
     return {
-        hash: STUB_TX_HASH,
+        hash: hash,
-        block_number: STUB_BLOCK_NUMBER,
+        block_number:
+            hash === STUB_NATIVE_TX_HASH
+                ? STUB_NATIVE_BLOCK_NUMBER
+                : STUB_BLOCK_NUMBER,
         nonce: 7,
         gas_used: "51000",
         gas_price: "1000000000",
@@ -476,6 +518,10 @@ function traceEnabled(raw) {
  * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
  *   transfer. Read at request time, so a test can flip it on the same
  *   options object without re-registering the route.
+ * @param {boolean} [opts.seedNativeTransfer]  serve the stubbed native ETH
+ *   transfer, read at request time like seedTokenTransfer. Without it the
+ *   normal-transactions endpoint answers with an empty list, so there is no
+ *   non-ERC-20 row to open.
  * @param {boolean} [opts.seedTokenBalance]  serve the stubbed ERC-20
  *   holding, which is what makes the token reachable from the send screen.
  * @param {string} [opts.ethBalanceWei]  hex wei answered to eth_getBalance;
@@ -547,7 +593,13 @@ async function installNetworkStubs(ctx, opts) {
         // Blockscout v2
         if (p.includes("/api/v2/")) {
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
-                return jsonResponse(route, { items: [] });
+                const addr = blockscoutAddress(p);
+                return jsonResponse(route, {
+                    items:
+                        opts.seedNativeTransfer && addr
+                            ? nativeTransactionItems(addr)
+                            : [],
+                });
             }
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
                 const addr = blockscoutAddress(p);
@@ -564,8 +616,10 @@ async function installNetworkStubs(ctx, opts) {
                     opts.seedTokenBalance ? tokenBalanceItems() : [],
                 );
             }
-            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
+            for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {
-                return jsonResponse(route, transactionDetails());
+                if (p.endsWith("/transactions/" + hash)) {
+                    return jsonResponse(route, transactionDetails(hash));
+                }
             }
         }
 
@@ -637,6 +691,8 @@ module.exports = {
     FEE_ESTIMATE_WEI,
     FEE_RESERVE_WEI,
     STUB_COUNTERPARTY,
+    STUB_NATIVE_TX_HASH,
+    STUB_NATIVE_VALUE_WEI,
     STUB_TOKEN,
     STUB_TX_HASH,
 };

tests/e2e/run.js

@@ -36,6 +36,8 @@ const {
     FEE_ESTIMATE_WEI,
     FEE_RESERVE_WEI,
     STUB_COUNTERPARTY,
+    STUB_NATIVE_TX_HASH,
+    STUB_NATIVE_VALUE_WEI,
     STUB_TOKEN,
     STUB_TX_HASH,
 } = require("./network");
@@ -169,6 +171,264 @@ test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
     assert(dots > 0, "token contract row rendered without its colour dot");
 });
 
+// --------------------- the rest of the #150 and #151 definition of done
+//
+// The two tests above assert that the screens #150 and #151 broke now open
+// without throwing, which is narrower than what those issues asked for.
+// The four items below are the remainder (#188): the navigation stack out
+// of Add Token, the quick-pick actually populating the field, the native
+// ETH detail path the ERC-20 fix could have regressed, and tap-to-copy.
+
+// Leave the transaction detail screen for the address screen it was opened
+// from. The two tests above finish on it, and so does the last test here.
+async function leaveTransactionDetail(page) {
+    if (await page.isVisible("#view-transaction")) {
+        await page.click("#btn-tx-back");
+    }
+    await openAddressDetail(page);
+}
+
+// Back out to Home from wherever the previous test finished.
+async function goHome(page) {
+    await leaveTransactionDetail(page);
+    await page.click("#btn-address-back");
+    await visible(page, "#view-main");
+}
+
+// The navigation stack as it was actually persisted, read out of extension
+// storage rather than inferred from which screen is showing. A stale entry
+// left behind by a forward navigation that threw is invisible on screen
+// until the user presses Back one time too many — which is exactly the
+// second-order damage #150 did — so the stack itself is what gets asserted.
+function persistedViewStack(page) {
+    return page.evaluate(
+        () =>
+            new Promise((resolve) => {
+                chrome.storage.local.get("autistmask", (r) => {
+                    resolve((r.autistmask && r.autistmask.viewStack) || []);
+                });
+            }),
+    );
+}
+
+// saveState() is fired from showView() without being awaited, so the write
+// lands shortly after the screen does. Polling for the expected stack keeps
+// that race out of the assertion; a stack that never becomes the expected
+// one fails with what it actually was.
+const VIEW_STACK_SETTLE_MS = 5000;
+
+async function waitForViewStack(page, expected, where) {
+    const want = JSON.stringify(expected);
+    const deadline = Date.now() + VIEW_STACK_SETTLE_MS;
+    let seen;
+    for (;;) {
+        seen = await persistedViewStack(page);
+        if (JSON.stringify(seen) === want) return;
+        if (Date.now() >= deadline) break;
+        await sleep(50);
+    }
+    throw new Error(
+        "navigation stack " +
+            where +
+            " is " +
+            JSON.stringify(seen) +
+            ", expected " +
+            want,
+    );
+}
+
+// The invariant is stated as a delta against whatever the earlier tests
+// left on the stack, not as an absolute: a round trip into Add Token and
+// back out must leave the stack exactly as it found it. That is what "no
+// duplicated or orphaned stack entry" means, and it holds whatever the
+// starting depth is.
+test("Back from Add Token unwinds the stack exactly once (#150)", async (env) => {
+    await goHome(env.page);
+    const base = await persistedViewStack(env.page);
+
+    await env.page.locator("#wallet-list .btn-addr-info").first().click();
+    await visible(env.page, "#view-address");
+    await waitForViewStack(env.page, base.concat("main"), "on address detail");
+
+    await env.page.click("#btn-add-token");
+    await visible(env.page, "#view-add-token");
+    await waitForViewStack(
+        env.page,
+        base.concat("main", "address"),
+        "on the add token screen",
+    );
+
+    await env.page.click("#btn-add-token-back");
+    await visible(env.page, "#view-address");
+    assert(
+        !(await env.page.isVisible("#view-add-token")),
+        "the add token screen is still showing after Back",
+    );
+    await waitForViewStack(
+        env.page,
+        base.concat("main"),
+        "after Back from add token",
+    );
+
+    await env.page.click("#btn-address-back");
+    await visible(env.page, "#view-main");
+    await waitForViewStack(env.page, base, "after a second Back");
+});
+
+test("a common-token quick-pick fills in the contract address (#150)", async (env) => {
+    await openAddressDetail(env.page);
+    await env.page.click("#btn-add-token");
+    await visible(env.page, "#view-add-token");
+
+    const before = await env.page.inputValue("#add-token-address");
+    assert(
+        before === "",
+        "the add token screen opened with the address field already filled: " +
+            JSON.stringify(before),
+    );
+
+    const pick = env.page.locator("#common-token-list .common-token").first();
+    const wanted = await pick.getAttribute("data-address");
+    assert(
+        /^0x[0-9a-fA-F]{40}$/.test(wanted || ""),
+        "the first quick-pick button carries no contract address: " +
+            JSON.stringify(wanted),
+    );
+
+    await pick.click();
+    const after = await env.page.inputValue("#add-token-address");
+    assert(
+        after === wanted,
+        "clicking the " +
+            (await pick.innerText()).trim() +
+            " quick-pick left the address field as " +
+            JSON.stringify(after) +
+            ", expected " +
+            JSON.stringify(wanted),
+    );
+
+    await env.page.click("#btn-add-token-back");
+    await visible(env.page, "#view-address");
+});
+
+// The native amount as the transaction list writes it (four decimals) and
+// as the detail screen writes it (full precision). Both are rendered here
+// from the fixture rather than read off the screen, so the assertions
+// compare against the wei the stub served.
+const NATIVE_ROW_TEXT =
+    parseFloat(formatEther(STUB_NATIVE_VALUE_WEI)).toFixed(4) + " ETH";
+const NATIVE_DETAIL_TEXT = formatEther(STUB_NATIVE_VALUE_WEI) + " ETH";
+
+test("the native ETH transaction detail still renders (#151)", async (env) => {
+    // The ERC-20 fix could only have regressed this path by making the
+    // token-contract branch run for a transfer that has no contract, so
+    // the assertions below are as much about that row staying hidden as
+    // about the screen coming up.
+    env.routeOpts.seedNativeTransfer = true;
+    await env.page.reload();
+    await openAddressDetail(env.page);
+
+    const row = env.page
+        .locator("#tx-list .tx-row")
+        .filter({ hasText: NATIVE_ROW_TEXT });
+    await row.waitFor({ state: "visible", timeout: 30000 });
+    await row.click();
+    await visible(env.page, "#view-transaction");
+
+    const hash = await env.page.locator("#tx-detail-hash").innerText();
+    assert(
+        hash.includes(STUB_NATIVE_TX_HASH),
+        "the native transaction detail shows the wrong hash: " + hash,
+    );
+
+    const type = (await env.page.locator("#tx-detail-type").innerText()).trim();
+    assert(
+        type === "Native ETH Transfer",
+        "the native transaction was classified " + JSON.stringify(type),
+    );
+
+    const value = await env.page.locator("#tx-detail-value").innerText();
+    assert(
+        value.includes(NATIVE_DETAIL_TEXT),
+        "the native transaction detail shows " +
+            JSON.stringify(value) +
+            ", expected it to contain " +
+            NATIVE_DETAIL_TEXT,
+    );
+
+    const native = await env.page.locator("#tx-detail-native").innerText();
+    assert(
+        native.includes(STUB_NATIVE_VALUE_WEI + " wei"),
+        "the raw quantity row shows " +
+            JSON.stringify(native) +
+            ", expected the value in wei",
+    );
+
+    assert(
+        !(await env.page.isVisible("#tx-detail-token-contract-section")),
+        "the token contract row is showing on a transfer that has no token " +
+            "contract",
+    );
+
+    // Back to one seeded transaction for everything after this: the tests
+    // below were written against a list holding the token transfer alone.
+    env.routeOpts.seedNativeTransfer = false;
+});
+
+test("tap-to-copy on the transaction detail screen copies the address (#151)", async (env) => {
+    // Read the clipboard back rather than watching the handler run: what
+    // #151 asks for is the address reaching the clipboard, and a spy on
+    // navigator.clipboard would assert the call and not the effect.
+    //
+    // Granted context-wide rather than for the popup's origin: an
+    // origin-scoped grant is refused for chrome-extension: URLs, which
+    // both Playwright and Chrome treat as opaque here.
+    await env.ctx.grantPermissions(["clipboard-read", "clipboard-write"]);
+
+    await leaveTransactionDetail(env.page);
+    const row = env.page
+        .locator("#tx-list .tx-row")
+        .filter({ hasText: STUB_TOKEN.symbol });
+    await row.waitFor({ state: "visible", timeout: 30000 });
+    await row.click();
+    await visible(env.page, "#view-transaction");
+    await visible(env.page, "#tx-detail-token-contract-section");
+
+    // Seed a sentinel first, so a clipboard that nothing writes to cannot
+    // pass on whatever was left in it.
+    const SENTINEL = "e2e-clipboard-untouched";
+    await env.page.evaluate((s) => navigator.clipboard.writeText(s), SENTINEL);
+    const seeded = await env.page.evaluate(() =>
+        navigator.clipboard.readText(),
+    );
+    assert(
+        seeded === SENTINEL,
+        "the harness could not seed the clipboard, so the assertion below " +
+            "would prove nothing; it read back " +
+            JSON.stringify(seeded),
+    );
+
+    await env.page.locator("#tx-detail-token-contract [data-copy]").click();
+
+    const copied = await env.page.evaluate(() =>
+        navigator.clipboard.readText(),
+    );
+    assert(
+        copied.toLowerCase() === STUB_TOKEN.address,
+        "tapping the token contract address put " +
+            JSON.stringify(copied) +
+            " on the clipboard, expected " +
+            STUB_TOKEN.address,
+    );
+
+    const flash = await env.page.locator("#flash-msg").innerText();
+    assert(
+        flash.trim() === "Copied!",
+        "the copy gave no confirmation, flash line reads " +
+            JSON.stringify(flash),
+    );
+});
+
 // -------------------------------------------- recovery phrase (#161)
 
 // The gear toggles, so pressing it while Settings is already up leaves it.
@@ -1757,15 +2017,14 @@ async function lastResponseError(page) {
 }
 
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and the response that crossed the
+// rather than hanging or resolving, and EIP-1193 code 4001 is present both
-// boundary carried EIP-1193 code 4001.
+// on the wire and on the Error the calling page catches.
 //
-// The code is asserted on the wire because that is the only place it
+// Both ends matter because they used to disagree. The code crossed the
-// survives. src/content/inpage.js rebuilds the rejection as `new
+// boundary correctly and src/content/inpage.js then threw it away, rebuilding
-// Error(error.message)`, so the Error the calling page catches carries the
+// every rejection as `new Error(error.message)` — so a dApp branching on
-// message and no code. That is reported rather than asserted either way —
+// `err.code === 4001` saw undefined and could not tell a refusal from a
-// locking in the current behaviour would make the gap permanent, and
+// failure (#274). Asserting only the wire would leave that gap invisible.
-// asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
     const outcome = await settleRequest(page, key);
     assert(
@@ -1787,15 +2046,32 @@ async function assertUserRejection(page, key, label) {
             " did not carry EIP-1193 code 4001 across the boundary: " +
             JSON.stringify(error),
     );
+    assert(
+        outcome.hasCode,
+        label +
+            " reached the page as an error with no code property at all, so a " +
+            "dApp cannot tell the user's refusal from a failure: " +
+            JSON.stringify(outcome),
+    );
+    assert(
+        outcome.code === 4001,
+        label +
+            " reached the page with code " +
+            JSON.stringify(outcome.code) +
+            " rather than EIP-1193 4001",
+    );
+    assert(
+        outcome.name === "ProviderRpcError",
+        label +
+            " reached the page as " +
+            JSON.stringify(outcome.name) +
+            " rather than an EIP-1193 ProviderRpcError",
+    );
     console.log(
         "# " +
             label +
-            ": boundary code=" +
+            ": code 4001 on the wire and on the page's " +
-            error.code +
+            outcome.name,
-            " page Error.code=" +
-            JSON.stringify(outcome.code) +
-            " page Error carries a code=" +
-            outcome.hasCode,
     );
     return outcome;
 }
@@ -2355,6 +2631,7 @@ async function main() {
     // starting state of a run is readable without hunting through tests.
     const routeOpts = {
         seedTokenTransfer: false,
+        seedNativeTransfer: false,
         seedTokenBalance: false,
         ethBalanceWei: null,
         failGasEstimate: false,

tests/inpageErrors.test.js

@@ -0,0 +1,310 @@
+// The EIP-1193 error the page actually catches (src/content/inpage.js).
+//
+// The bug this pins down (issue #274): the provider rebuilt every failure as
+// `new Error(error.message)`, so the `code` the background produced and the
+// content script relayed intact was thrown away in the last hop. A dApp
+// checking `err.code === 4001` — the standard way to tell "the user said no"
+// from "the wallet broke" — saw undefined, and well-behaved sites showed an
+// error or retried instead of accepting the refusal.
+//
+// inpage.js is a bare IIFE injected into the page's JS context, not a module:
+// it takes no import and exports nothing, and reaches for `window` at load.
+// So it is evaluated here the way the browser evaluates it, against a stub
+// window, and the provider is collected from `window.ethereum`. The globals it
+// touches are passed in as function parameters rather than assigned to
+// globalThis: nothing leaks between tests, and the source is compiled in this
+// realm, so the errors it constructs are comparable against this file's own
+// `Error` — which a second realm's intrinsics would silently defeat.
+//
+// There is no jsdom in this repo; see tests/txStatus.test.js.
+
+const fs = require("fs");
+const path = require("path");
+const { webcrypto } = require("crypto");
+
+const SOURCE = fs.readFileSync(
+    path.join(__dirname, "..", "src", "content", "inpage.js"),
+    "utf8",
+);
+
+const loadInto = new Function(
+    "window",
+    "self",
+    "crypto",
+    "Event",
+    "CustomEvent",
+    SOURCE,
+);
+
+class StubEvent {
+    constructor(type) {
+        this.type = type;
+    }
+}
+
+class StubCustomEvent extends StubEvent {
+    constructor(type, init) {
+        super(type);
+        this.detail = init && init.detail;
+    }
+}
+
+// Every code the background emits on the RPC path today, read out of
+// src/background/index.js. The provider must not know this list — it passes
+// through whatever arrived — but the cases below are the real ones.
+const REJECTED = 4001; // user rejected the request
+const UNAUTHORIZED = 4100; // site not connected / wrong address
+const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
+
+// A stub window with the four things inpage.js touches: message listeners,
+// postMessage out to the content script, window.ethereum, and dispatchEvent
+// for the EIP-6963 announcement.
+function loadProvider() {
+    const messageListeners = [];
+    const posted = [];
+
+    const win = {
+        addEventListener(type, fn) {
+            if (type === "message") messageListeners.push(fn);
+        },
+        removeEventListener(type, fn) {
+            const i = messageListeners.indexOf(fn);
+            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
+        },
+        postMessage(data) {
+            posted.push(data);
+        },
+        dispatchEvent() {
+            return true;
+        },
+    };
+    win.window = win;
+
+    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
+
+    // Deliver the content script's answer to an outstanding request. The id is
+    // read back off the wire rather than assumed: inpage.js issues its own
+    // eth_chainId at load, so the first id a test sees is not 1.
+    function respond(response) {
+        const request = posted
+            .filter((m) => m.type === "AUTISTMASK_REQUEST")
+            .pop();
+        expect(request).toBeDefined();
+        const event = {
+            source: win,
+            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
+        };
+        for (const fn of messageListeners.slice()) fn(event);
+    }
+
+    return { provider: win.ethereum, posted, respond };
+}
+
+// Start a request, answer it with `response`, and hand back the rejection.
+// Fails the test if the call resolves instead.
+async function rejectionFrom(start, response) {
+    const { provider, respond } = loadProvider();
+    const settled = start(provider).then(
+        (result) => ({ resolved: result }),
+        (error) => ({ error }),
+    );
+    // The provider posts synchronously, so the request is already on the wire.
+    respond(response);
+    const outcome = await settled;
+    expect(outcome).not.toHaveProperty("resolved");
+    return outcome.error;
+}
+
+describe("an EIP-1193 code reaches the page", () => {
+    test("a user rejection arrives as code 4001", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect(err.code).toBe(REJECTED);
+        expect(err.message).toBe("User rejected the request.");
+    });
+
+    test("it is a ProviderRpcError, and an Error", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect(err).toBeInstanceOf(Error);
+        expect(err.name).toBe("ProviderRpcError");
+    });
+
+    test("4100 unauthorized arrives intact", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
+            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
+        );
+        expect(err.code).toBe(UNAUTHORIZED);
+        expect(err.message).toBe("Unauthorized");
+    });
+
+    test("4902 unrecognized chain arrives intact", async () => {
+        const message =
+            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "wallet_switchEthereumChain" }),
+            { error: { code: UNRECOGNIZED_CHAIN, message } },
+        );
+        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
+        expect(err.message).toBe(message);
+    });
+
+    // The provider is not allowed to know the list above: a code added to the
+    // background later must reach the page without this file being edited.
+    test("a code the provider has never heard of is passed through", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_accounts" }),
+            { error: { code: 4900, message: "Disconnected" } },
+        );
+        expect(err.code).toBe(4900);
+    });
+
+    test("data is carried when the boundary sent it", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_call" }),
+            {
+                error: {
+                    code: -32000,
+                    message: "execution reverted",
+                    data: "0x08c379a0",
+                },
+            },
+        );
+        expect(err.code).toBe(-32000);
+        expect(err.data).toBe("0x08c379a0");
+    });
+
+    test("no data property is invented when the boundary sent none", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect("data" in err).toBe(false);
+    });
+});
+
+describe("the message is untouched", () => {
+    test("a coded error keeps the message byte for byte", async () => {
+        const message =
+            "This site asked to sign as an address that is not " +
+            "the active one.";
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "personal_sign" }),
+            { error: { code: UNAUTHORIZED, message } },
+        );
+        expect(err.message).toBe(message);
+    });
+
+    test("an error the background sent with no code keeps its message", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { message: "No accounts available" } },
+        );
+        expect(err.message).toBe("No accounts available");
+    });
+
+    // A ProviderRpcError whose code is undefined would claim a conformance it
+    // does not have, and `'code' in err` is exactly what a careful dApp asks.
+    test("an error with no code gets no code property at all", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { message: "No accounts available" } },
+        );
+        expect(err).toBeInstanceOf(Error);
+        expect("code" in err).toBe(false);
+    });
+
+    test("an error with no message keeps the generic fallback", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { code: REJECTED } },
+        );
+        expect(err.message).toBe("Request failed");
+        expect(err.code).toBe(REJECTED);
+    });
+});
+
+// Every entry point the provider exposes, not just eth_requestAccounts. They
+// all funnel through the same response listener, and this is what says so.
+describe("every request path carries the code", () => {
+    const rejection = {
+        error: { code: REJECTED, message: "User rejected the request." },
+    };
+
+    test("request()", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("enable()", async () => {
+        const err = await rejectionFrom((p) => p.enable(), rejection);
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("send(method, params)", async () => {
+        const err = await rejectionFrom(
+            (p) => p.send("eth_requestAccounts", []),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("send({ method, params })", async () => {
+        const err = await rejectionFrom(
+            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("sendAsync() hands the code to its callback", async () => {
+        const { provider, respond } = loadProvider();
+        const called = new Promise((resolve) => {
+            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
+                resolve(e),
+            );
+        });
+        respond(rejection);
+        const err = await called;
+        expect(err.name).toBe("ProviderRpcError");
+        expect(err.code).toBe(REJECTED);
+        expect(err.message).toBe("User rejected the request.");
+    });
+});
+
+describe("the success path is unchanged", () => {
+    test("a result still resolves", async () => {
+        const { provider, respond } = loadProvider();
+        const settled = provider.request({ method: "eth_requestAccounts" });
+        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
+        await expect(settled).resolves.toEqual([
+            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
+        ]);
+        expect(provider.selectedAddress).toBe(
+            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
+        );
+    });
+});