chore: cap every CI job with timeout-minutes (closes #294)

No workflow set timeout-minutes, so a hung build or browser held the
shared runner until the server's own limit, hours later. check now stops
at 10 minutes, e2e-firefox at 15 and e2e-chrome at 20: each is over two
and a half times the job's slowest cold-cache run. README "In CI" records
the measured times and the caps.

Model: opus-5-5

README.md

@@ -822,15 +822,13 @@ discoverable.
   on critical screens and when space is available to allow users to disambiguate
   addresses visually, as a security feature.
 - **Tailwind CSS**: Utility-first CSS via Tailwind. No custom CSS classes for
-  styling, and no `style="..."` attributes, which the
+  styling. Tailwind is configured with a minimal monochrome palette. This keeps
-  [Content Security Policy](#content-security-policy) refuses. Tailwind is
+  the styling co-located with the markup and eliminates CSS file management. The
-  configured with a minimal monochrome palette. This keeps the styling
+  handful of classes in `styles/main.css` are not styling: `.copy-flash-*`
-  co-located with the markup and eliminates CSS file management. The handful of
+  carries the copy feedback animation, and `.am-address` carries the rule that
-  classes in `styles/main.css` are not styling: `.copy-flash-*` carries the copy
+  an address never wraps. Both are invariants that hold in every place they
-  feedback animation, and `.am-address` carries the rule that an address never
+  appear, and spelling either out as repeated utilities is how one of those
-  wraps. Both are invariants that hold in every place they appear, and spelling
+  places drifts away from the rest.
-  either out as repeated utilities is how one of those places drifts away from
-  the rest.
 - **Vanilla JS**: No framework (React, Vue, Svelte, etc.). The popup UI is small
   enough that vanilla JS with simple view switching is sufficient. A framework
   would add bundle size, build complexity, and attack surface for no benefit at
@@ -2223,7 +2221,7 @@ a bare string in `manifest/firefox.json` (MV2):
 
 ```
 default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
-style-src 'self'; img-src 'self' data:;
+style-src 'self' 'unsafe-inline'; img-src 'self' data:;
 connect-src 'self' https: http:; frame-src 'none'; form-action 'none';
 base-uri 'none'
 ```
@@ -2235,17 +2233,15 @@ wallet's own UI. Escaping is the primary fix for that (see
 `src/shared/html.js`); this is the second line, so an escape that does slip
 cannot reach the network.
 
-`style-src 'self'` admits the stylesheet and nothing inline: both browsers
+Four directives are looser than `'self'`, each for a reason that does not
-refuse a `style="..."` attribute and a `<style>` block. So the popup's markup,
-in `src/popup/index.html` and in the HTML the view helpers build, carries
-Tailwind classes and never a `style` attribute. Script that sets `element.style`
-is not affected; that is how the views show and hide their error lines. An
-inline style that slips in anyway is refused with a console error, which fails
-both end-to-end suites.
-
-These directives differ from a plain `'self'`, each for a reason that does not
 generalise:
 
+- `style-src 'unsafe-inline'` — `src/popup/index.html` and the view helpers set
+  presentation through `style="..."` attributes, which CSP blocks without this.
+  Chrome enforces `style-src` on attributes, not only on `<style>` blocks, and
+  Firefox has never implemented `style-src-attr`, so there is no narrower
+  spelling that works on both targets. It permits inline **style**; script stays
+  under `script-src`, which does not allow `'unsafe-inline'`.
 - `img-src data:` — identicons are generated in the popup by
   `ethereum-blockies-base64` and assigned to `img.src` as `data:` PNGs.
 - `connect-src https: http:` — the RPC endpoint is user-configurable and a local

TODO.md

@@ -51,17 +51,6 @@ but the review is broader than any of them.
   slowest cold-cache run. A hung build or browser now ends its job instead of
   holding the shared runner for hours.
 
-- 2026-10-05: The popup's Content Security Policy no longer allows inline style
-  ([#328](https://git.eeqj.de/sneak/AutistMask/issues/328)): `style-src` is
-  `'self'` in both manifests, pinned in `tests/manifest.test.js`. The 42
-  `style="..."` attributes in `src/popup/index.html` and in the markup the view
-  helpers build are now Tailwind classes, each computing to the value it
-  replaced. The 16 address dot colours are written out as whole classes, because
-  Tailwind builds only the classes it finds in the source. The Settings debug
-  well is shown and hidden with the `hidden` class, since clearing an inline
-  `display` no longer uncovers it. Script that sets `element.style` is
-  unaffected.
-
 - 2026-10-05: `.prettierignore` no longer lists an AI vendor's tool directory
   ([#363](https://git.eeqj.de/sneak/AutistMask/issues/363)). The directory is
   not tracked, so the line ignored nothing.

manifest/chrome.json

@@ -7,7 +7,7 @@
     "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
     "content_security_policy": {
-        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
+        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
     },
     "icons": {
         "16": "icons/icon16.png",

manifest/firefox.json

@@ -4,7 +4,7 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
+    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
     "icons": {
         "16": "icons/icon16.png",
         "32": "icons/icon32.png",

src/popup/index.html

@@ -110,7 +110,8 @@
                     </div>
                     <div
                         id="add-wallet-phrase-warning"
-                        class="text-xs mb-2 border border-border border-dashed p-2 invisible"
+                        class="text-xs mb-2 border border-border border-dashed p-2"
+                        style="visibility: hidden"
                     >
                         Write these words down and keep them safe. Anyone with
                         them can take your funds; if you lose them, your wallet
@@ -261,7 +262,10 @@
 
                 <!-- recent transactions across all addresses -->
                 <div>
-                    <div class="font-bold bg-section py-1 px-2 -mx-2">
+                    <div
+                        class="font-bold bg-section py-1 px-2"
+                        style="margin-left: -0.5rem; margin-right: -0.5rem"
+                    >
                         Recent Transactions
                     </div>
                     <div id="home-tx-list">
@@ -269,7 +273,7 @@
                     </div>
                 </div>
 
-                <div class="py-1 -mx-2">&nbsp;</div>
+                <div class="py-1" style="margin: 0 -0.5rem">&nbsp;</div>
 
                 <div class="text-xs text-muted">
                     <span
@@ -405,7 +409,8 @@
                 </p>
                 <div
                     id="export-privkey-flash"
-                    class="text-xs mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div id="export-privkey-password-section" class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -537,7 +542,8 @@
                     />
                     <div
                         id="send-to-error"
-                        class="text-xs min-h-[1.25rem] text-[#cc0000]"
+                        class="text-xs"
+                        style="min-height: 1.25rem; color: #cc0000"
                     ></div>
                 </div>
                 <div class="mb-2">
@@ -613,7 +619,7 @@
                     <div class="text-xs text-muted mb-1">Your balance</div>
                     <div id="confirm-balance" class="text-xs"></div>
                 </div>
-                <div id="confirm-fee" class="mb-3 invisible">
+                <div id="confirm-fee" class="mb-3" style="visibility: hidden">
                     <div class="text-xs text-muted mb-1">Network fee</div>
                     <div id="confirm-fee-amount" class="text-xs"></div>
                     <!-- Holds its one line of space from the first paint, so
@@ -621,13 +627,22 @@
                     nothing. The placeholder is never seen. -->
                     <div
                         id="confirm-fee-reserve"
-                        class="text-xs text-muted invisible"
+                        class="text-xs text-muted"
+                        style="visibility: hidden"
                     >
                         reserve pending
                     </div>
                 </div>
-                <div id="confirm-warnings" class="mb-2 invisible"></div>
+                <div
-                <div id="confirm-recipient-warning" class="mb-2 invisible">
+                    id="confirm-warnings"
+                    class="mb-2"
+                    style="visibility: hidden"
+                ></div>
+                <div
+                    id="confirm-recipient-warning"
+                    class="mb-2"
+                    style="visibility: hidden"
+                >
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -640,9 +655,14 @@
                 in confirmTx.js sets it. -->
                 <div
                     id="confirm-contract-warning"
-                    class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500 invisible"
+                    class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
+                    style="visibility: hidden"
                 ></div>
-                <div id="confirm-burn-warning" class="mb-2 invisible">
+                <div
+                    id="confirm-burn-warning"
+                    class="mb-2"
+                    style="visibility: hidden"
+                >
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -650,7 +670,11 @@
                         here are permanently destroyed and cannot be recovered.
                     </div>
                 </div>
-                <div id="confirm-etherscan-warning" class="mb-2 invisible">
+                <div
+                    id="confirm-etherscan-warning"
+                    class="mb-2"
+                    style="visibility: hidden"
+                >
                     <div
                         class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
                     >
@@ -660,11 +684,13 @@
                 </div>
                 <div
                     id="confirm-errors"
-                    class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
+                    class="mb-2 border border-border border-dashed p-2"
+                    style="visibility: hidden; min-height: 1.25rem"
                 ></div>
                 <div
                     id="confirm-amount-fee-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
                 >
                     Your balance does not cover this amount plus the network
                     fee. Please go back and send a smaller amount.
@@ -673,13 +699,15 @@
                 in confirmTx.js sets it. -->
                 <div
                     id="confirm-gas-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
                 ></div>
                 <!-- Its sentence names why the fee could not be estimated,
                 so show() in confirmTx.js sets it. -->
                 <div
                     id="confirm-fee-unknown-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
@@ -691,7 +719,8 @@
                 </div>
                 <div
                     id="confirm-tx-password-error"
-                    class="text-xs mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <button
                     id="btn-confirm-send"
@@ -806,7 +835,8 @@
                 </button>
                 <div
                     id="receive-erc20-warning"
-                    class="text-xs border border-border border-dashed p-2 mt-3 invisible"
+                    class="text-xs border border-border border-dashed p-2 mt-3"
+                    style="visibility: hidden"
                 ></div>
             </div>
 
@@ -834,7 +864,8 @@
                 </div>
                 <div
                     id="add-token-info"
-                    class="text-xs text-muted mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-muted mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs text-muted"
@@ -1020,7 +1051,8 @@
                             type="text"
                             inputmode="numeric"
                             id="settings-dust-threshold"
-                            class="border border-border p-1 text-xs bg-bg text-fg w-[10ch]"
+                            class="border border-border p-1 text-xs bg-bg text-fg"
+                            style="width: 10ch"
                         />
                         <span class="text-xs text-muted">gwei</span>
                     </div>
@@ -1097,7 +1129,8 @@
 
                 <div
                     id="settings-debug-well"
-                    class="bg-well p-3 mx-1 mb-3 hidden"
+                    class="bg-well p-3 mx-1 mb-3"
+                    style="display: none"
                 >
                     <h3 class="font-bold mb-1">Debug</h3>
                     <label
@@ -1125,7 +1158,8 @@
                 </p>
                 <div
                     id="delete-wallet-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -1198,7 +1232,8 @@
                 </div>
                 <div
                     id="delete-wallet-lost-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <button
                     id="btn-delete-wallet-lost-confirm"
@@ -1253,7 +1288,8 @@
                 </p>
                 <div
                     id="delete-address-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <button
                     id="btn-delete-address-confirm"
@@ -1282,7 +1318,8 @@
                 </div>
                 <div
                     id="show-phrase-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div id="show-phrase-password-section" class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -1364,7 +1401,8 @@
                     />
                     <div
                         id="settings-addtoken-info"
-                        class="text-xs text-muted mt-1 min-h-[1.25rem] invisible"
+                        class="text-xs text-muted mt-1 min-h-[1.25rem]"
+                        style="visibility: hidden"
                     ></div>
                     <button
                         id="btn-settings-addtoken-manual"
@@ -1597,7 +1635,8 @@
                 </div>
                 <div
                     id="approve-tx-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem] invisible"
+                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div class="flex justify-between">
                     <button
@@ -1633,7 +1672,15 @@
 
                 <div
                     id="approve-sign-danger-warning"
-                    class="mb-3 p-2 text-xs font-bold invisible min-h-[1.25rem] bg-[#fee2e2] text-[#991b1b] border-2 border-[#dc2626] rounded-[6px]"
+                    class="mb-3 p-2 text-xs font-bold"
+                    style="
+                        visibility: hidden;
+                        min-height: 1.25rem;
+                        background: #fee2e2;
+                        color: #991b1b;
+                        border: 2px solid #dc2626;
+                        border-radius: 6px;
+                    "
                 ></div>
 
                 <div class="mb-3">
@@ -1650,7 +1697,8 @@
                     <div class="text-xs text-muted mb-1">Message</div>
                     <div
                         id="approve-sign-message"
-                        class="text-xs break-all max-h-48 overflow-y-auto"
+                        class="text-xs break-all"
+                        style="max-height: 12rem; overflow-y: auto"
                     ></div>
                 </div>
 
@@ -1658,7 +1706,8 @@
                     <div class="text-xs text-muted mb-1">Raw data</div>
                     <div
                         id="approve-sign-hex"
-                        class="text-xs break-all max-h-24 overflow-y-auto"
+                        class="text-xs break-all"
+                        style="max-height: 6rem; overflow-y: auto"
                     ></div>
                 </div>
 
@@ -1672,7 +1721,8 @@
                 </div>
                 <div
                     id="approve-sign-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem] invisible"
+                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.875rem]"
+                    style="visibility: hidden"
                 ></div>
                 <div class="flex justify-between">
                     <button
@@ -1796,7 +1846,8 @@
                 </div>
                 <div
                     id="state-recovery-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem] invisible"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
                 ></div>
                 <button
                     id="btn-state-recovery-reset"

src/popup/views/addressDetail.js

@@ -181,10 +181,10 @@ function renderTransactions(txs) {
         // it on the line above rather than replacing it.
         const nameStr = escapeHtml(title || ensName || "");
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity-50" : "";
+        const opacity = tx.isError ? " opacity:0.5;" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
+        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, nameStr, amountStr);
         html += `</div>`;

src/popup/views/addressToken.js

@@ -258,10 +258,10 @@ function renderTransactions(txs) {
         // it on the line above rather than replacing it.
         const nameStr = escapeHtml(title || ensName || "");
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity-50" : "";
+        const opacity = tx.isError ? " opacity:0.5;" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
+        html += `<div class="tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, nameStr, amountStr);
         html += `</div>`;

src/popup/views/helpers.js

@@ -335,7 +335,7 @@ function balanceLine(symbol, amount, price, tokenId) {
         : "";
     return (
         `<div class="flex text-xs${clickClass}"${tokenAttr}>` +
-        `<span class="flex justify-between w-[42ch] max-w-full">` +
+        `<span class="flex justify-between" style="width:42ch;max-width:100%">` +
         `<span>${escapeHtml(displaySymbol(symbol))}</span>` +
         `<span>${qty}</span>` +
         `</span>` +
@@ -430,26 +430,23 @@ function truncateMiddle(str, maxLen) {
 
 // 16 colors evenly spaced around the hue wheel (22.5° apart),
 // all at HSL saturation 70%, lightness 50% for uniform vibrancy.
-// Each is a whole Tailwind class: Tailwind builds only the classes it finds
-// written out in the source, so the class name cannot be put together at
-// runtime.
 const ADDRESS_COLORS = [
-    "bg-[#d92626]",
+    "#d92626",
-    "bg-[#d96926]",
+    "#d96926",
-    "bg-[#d9ac26]",
+    "#d9ac26",
-    "bg-[#c2d926]",
+    "#c2d926",
-    "bg-[#80d926]",
+    "#80d926",
-    "bg-[#3dd926]",
+    "#3dd926",
-    "bg-[#26d953]",
+    "#26d953",
-    "bg-[#26d996]",
+    "#26d996",
-    "bg-[#26d9d9]",
+    "#26d9d9",
-    "bg-[#2696d9]",
+    "#2696d9",
-    "bg-[#2653d9]",
+    "#2653d9",
-    "bg-[#3d26d9]",
+    "#3d26d9",
-    "bg-[#8026d9]",
+    "#8026d9",
-    "bg-[#c226d9]",
+    "#c226d9",
-    "bg-[#d926ac]",
+    "#d926ac",
-    "bg-[#d92669]",
+    "#d92669",
 ];
 
 function addressColor(address) {
@@ -459,12 +456,12 @@ function addressColor(address) {
 
 function addressDotHtml(address) {
     const color = addressColor(address);
-    return `<span class="inline-block w-[8px] h-[8px] rounded-[50%] ${color} mr-[4px] align-middle shrink-0"></span>`;
+    return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
 }
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" class="inline-block rounded-[50%] [image-rendering:pixelated]">`;
+    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 // Look up an address across all wallets and return its title
@@ -574,7 +571,7 @@ function timeAgo(timestamp) {
 
 // Shared external-link icon SVG used across all views.
 const EXT_ICON =
-    `<span class="inline-block w-[10px] h-[10px] ml-[4px] align-middle">` +
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
     `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
     `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +

src/popup/views/home.js

@@ -131,10 +131,10 @@ function renderHomeTxList(ctx) {
         const title = addressTitle(counterparty, state.wallets);
         const titleStr = title ? escapeHtml(title) : "";
         const err = tx.isError ? " (failed)" : "";
-        const opacity = tx.isError ? " opacity-50" : "";
+        const opacity = tx.isError ? " opacity:0.5;" : "";
         const ago = escapeHtml(timeAgo(tx.timestamp));
         const iso = escapeHtml(isoDate(tx.timestamp));
-        html += `<div class="home-tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover${opacity}" data-tx="${i}">`;
+        html += `<div class="home-tx-row py-2 border-b border-border-light text-xs cursor-pointer hover:bg-hover" data-tx="${i}" style="${opacity}">`;
         html += `<div class="flex justify-between"><span class="text-muted" title="${iso}">${ago}</span><span>${dirLabel}${err}</span></div>`;
         html += txCounterpartyHtml(counterparty, titleStr, amountStr);
         html += `</div>`;
@@ -241,7 +241,7 @@ function walletListHtml() {
     state.wallets.forEach((wallet, wi) => {
         const defect = walletDefect(wallet);
         html += `<div>`;
-        html += `<div class="flex justify-between items-center bg-section py-1 px-2 -mx-2">`;
+        html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
         // No "+" on a defective wallet: deriving another address from that
         // xpub would only add one more address the key does not produce
@@ -255,12 +255,12 @@ function walletListHtml() {
         wallet.addresses.forEach((addr, ai) => {
             html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
             const isActive = state.activeAddress === addr.address;
-            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg p-0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
+            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
             // Only where a wallet can spare the address: a wallet holding a
             // single address has no remove control, because its last address
             // is never removable.
             const removeBtn = canRemoveAddress(wallet)
-                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1 p-0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
+                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1" style="padding:0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
                 : "";
             const dot = addressDotHtml(addr.address);
             const titleBold = isActive ? "font-bold" : "";

src/popup/views/settings.js

@@ -213,7 +213,12 @@ function show() {
     versionClickCount = 0;
 
     // Show debug well if debug mode is already enabled
-    $("settings-debug-well").classList.toggle("hidden", !state.debugMode);
+    const debugWell = $("settings-debug-well");
+    if (state.debugMode) {
+        debugWell.style.display = "";
+    } else {
+        debugWell.style.display = "none";
+    }
     $("settings-debug-mode").checked = state.debugMode;
 
     showView("settings");
@@ -429,7 +434,7 @@ function init(ctx) {
         if (versionClickCount >= 10) {
             versionClickCount = 0;
             clearTimeout(versionClickTimer);
-            $("settings-debug-well").classList.remove("hidden");
+            $("settings-debug-well").style.display = "";
         }
     });
 

tests/contractCreation.test.js

@@ -301,7 +301,7 @@ describe.each([
     test("a contract creation's row says so, with no colour dot and no address line", async () => {
         const html = await rowsFor(historyTx(""));
         expect(html).toContain(SENTENCE);
-        expect(html).not.toContain("bg-[#");
+        expect(html).not.toContain("background:");
         expect(html).not.toContain("am-address");
         expect(html).not.toContain("undefined");
     });
@@ -309,7 +309,7 @@ describe.each([
     test("a transaction with a recipient shows its colour dot and address", async () => {
         const html = await rowsFor(historyTx(RECIPIENT));
         expectAddressLine(html);
-        expect(html).toContain("bg-[#");
+        expect(html).toContain("background:#");
         expect(html).toContain(`<div class="am-address">${RECIPIENT}</div>`);
     });
 });

tests/e2e/run.js

@@ -311,7 +311,7 @@ test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
         "token contract row missing the contract address, got: " +
             JSON.stringify(contractText),
     );
-    const dots = await contract.locator('span[class*="rounded-[50%]"]').count();
+    const dots = await contract.locator('span[style*="border-radius"]').count();
     assert(dots > 0, "token contract row rendered without its colour dot");
 });
 

tests/manifest.test.js

@@ -21,14 +21,15 @@
 // escaping in src/shared/html.js is the primary fix; default-src is what
 // stops the next escape that slips from reaching the network.
 //
-// And for #328: style-src is 'self' alone, so the browser refuses every
+// Every directive below is pinned exactly, because each of the four
-// style="..." attribute in the popup's markup, including one an escape lets
-// through. The popup styles with classes; script setting element.style is
-// not affected.
-//
-// Every directive below is pinned exactly, because each of the three
 // loosenings is load-bearing and none of them may grow:
 //
+//   style-src 'unsafe-inline'  src/popup/index.html and the view helpers
+//                              use style="..." attributes throughout, which
+//                              CSP blocks without it. Chrome enforces this
+//                              on attributes, not just <style> blocks, and
+//                              Firefox has never implemented style-src-attr,
+//                              so there is no narrower spelling available.
 //   img-src data:              blockies are data: PNGs assigned to img.src.
 //   connect-src https: http:   the RPC endpoint is user-configurable, and a
 //                              local node over http://127.0.0.1 is a
@@ -57,7 +58,7 @@ const EXPECTED_DIRECTIVES = {
     "default-src": ["'self'"],
     "script-src": ["'self'", "'wasm-unsafe-eval'"],
     "object-src": ["'self'"],
-    "style-src": ["'self'"],
+    "style-src": ["'self'", "'unsafe-inline'"],
     "img-src": ["'self'", "data:"],
     "connect-src": ["'self'", "http:", "https:"],
     "frame-src": ["'none'"],