Add token-list enrichment tooling (scripts/)

2026-07-25 17:40:48 +07:00
21 changed files with 2399 additions and 781 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,4 @@
+.git
 node_modules
 .DS_Store
 dist
--- a/16
+++ b/16
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
+.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build clean dev

 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -37,20 +37,6 @@ hooks:
 build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
-	@script/verify-build
-
-# Development-only build: enables the red DEBUG / INSECURE banner and makes
-# the hardcoded test recovery phrase the output of wallet creation. Never
-# distribute the artifacts this produces.
-build-debug:
-	@echo "Building extension (DEBUG)..."
-	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
-	@AUTISTMASK_DEBUG=1 script/verify-build
-
-# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
-# the end of build and build-debug; separate target for re-running it alone.
-verify-build:
-	@script/verify-build

 clean:
 	@rm -rf dist/
--- a/README.md
+++ b/README.md
@@ -42,30 +42,6 @@ Load the extension:
 - **Firefox**: Navigate to `about:debugging#/runtime/this-firefox`, click "Load
  Temporary Add-on", and select `dist/firefox/manifest.json`.

-### Debug Builds
-
-`make build` always produces a release build: the build-time `DEBUG` constant is
-`false`, so wallet creation uses real entropy and the red banner is off. To
-produce a debug build instead, set `AUTISTMASK_DEBUG=1` in the environment:
-
-```bash
-make build-debug          # or: AUTISTMASK_DEBUG=1 make build
-```
-
-Only the exact value `1` enables it; any other value (including unset, empty, or
-`true`) yields a release build, so a typo cannot accidentally ship the debug
-behavior. The build prints which mode it used. See the
-[DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
-distribute a debug build** — every wallet it creates gets the same publicly
-known test recovery phrase.
-
-Both builds end by running `script/verify-build`, which reads the compiled
-`DEBUG` state back out of the emitted bundles and fails the build if it is not
-the one that was asked for. The test suite cannot check this: it loads
-`src/shared/constants.js` outside a bundle, so it only ever sees the fallback
-value. The assertion is on the artifacts because that is where the property
-lives.
-
 ## Entrypoints

 This repository adheres to the
@@ -84,12 +60,6 @@ provide:
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
-  `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
-  off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
-  `make build` and `make build-debug`; fails loudly rather than passing if it
-  cannot determine a bundle's state. Not part of `make check`, which does not
-  depend on build artifacts existing.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
@@ -698,19 +668,6 @@ flows, or alter program behavior beyond the banner and the hardcoded mnemonic.
 Adding new DEBUG-conditional branches requires explicit approval from the
 project owner.

-`DEBUG` is a build-time constant, not a runtime setting. `build.js` injects it
-into the bundle as the `__BUILD_DEBUG__` define — `false` unless the build was
-run with `AUTISTMASK_DEBUG=1` (see [Debug Builds](#debug-builds)) — and
-`src/shared/constants.js` reads it. It cannot be changed after the bundle is
-produced.
-
-The debug-mode toggle in settings is a separate, runtime-only flag. It raises
-the log level and turns the banner on, and that is all it may ever do: it feeds
-`isDebug()` in `src/shared/log.js`, which is deliberately not what
-`generateMnemonic()` consults. Mnemonic generation reads the build-time `DEBUG`
-constant directly, so no runtime toggle in a release build can reach the
-hardcoded test phrase.
-
 ### Key Decisions

 - **No framework**: The popup UI is vanilla JS and HTML. The extension is small
--- a/TODO.md
+++ b/TODO.md
@@ -10,35 +10,24 @@

 # Status

-pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. No
-other branch is in flight: the settings About well landed as #145 on 2026-07-26
-and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
-question is resolved. Full policy file set present. `make check` verified
-passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
-#149-#168.
+pre-1.0. Tagged v0.1.0 on 2026-02-27. Active development on branch
+feat/issue-144-settings-about (another agent working as of 2026-07-06). Full
+policy file set present; make check on main not verified.

 # Next Step

-Land #149: make `DEBUG` a build-time constant that defaults to off, injected as
-the `__BUILD_DEBUG__` esbuild define from `AUTISTMASK_DEBUG=1`, so a plain
-`make build` stops handing every newly created wallet the publicly committed
-test recovery phrase. Branch `fix/issue-149-debug-build-flag`; PR open, awaiting
-review.
+Land feat/issue-144-settings-about: finish the settings About well (build info,
+app name and repo link, release date, version click easter egg, git info derived
+inside Docker), resolve the untracked scripts/ directory (commit or gitignore),
+get review, merge to main.

 # Completed Steps

- 2026-08-09: Post-build assertion that every emitted bundle containing
-  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
-  `make build` path (#170). Branched from `fix/issue-149-debug-build-flag`;
-  merge after #169.
- 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
-  (#149-#168).
- 2026-07-26: About well in settings with build info, repo link and the version
-  click easter egg (#145); proper view navigation stack (#146).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-  shims, README Entrypoints section (#148)
- 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
-  in approve-tx view (#141).
+  shims, README Entrypoints section
+- 2026-03-01: About well in settings with build info and easter egg (in flight
+  on feature branch); USD display suppressed on testnets (#142); estimated USD
+  for ETH in approve-tx view (#141).
 - Sepolia testnet support (#137); etherscan links go to token-specific URLs
  (#136).
 - Transaction detail improvements: Type field and on-chain details (#130),
@@ -56,32 +45,12 @@ review.

 # Future Steps

- Fix the two `ReferenceError` crashes that make whole screens unreachable:
-  AddToken (#150) and TransactionDetail for every ERC-20 transfer (#151).
- Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
-  and cannot catch undefined identifiers, which is how #150 and #151 shipped.
- Make the Firefox target functional: Chrome callback APIs are used against the
-  promise-only `browser` namespace (#153).
- Send and transaction-flow correctness: gas fee excluded from the
-  insufficient-balance check (#154), WaitTx 60s timeout overwriting a rendered
-  success screen (#155), last-wallet deletion leaving inconsistent state (#156).
- Security: plaintext password crossing the extension messaging boundary during
-  dApp approvals (#157); MV3 service worker termination killing the background
-  refresh and the 24h phishing list update (#158).
- Test the crypto core — `wallet.js` derivation and `vault.js` encryption (#159)
-  — and the address-poisoning defense in `transactions.js` (#160).
- Wallet features for 1.0: show a wallet's recovery phrase behind the password
-  (#161), delete an address from an HD wallet (#162).
- Docs: `docs/README.md` contradicts the code on external services and names
-  competitors (#163); README Screen Map omits three shipped screens (#164).
- Owner decisions: Sepolia support versus "Non-Goals for 1.0", and `isMetaMask`
-  naming a competitor in shipped code (#165).
- Repo policy compliance sweep: test rerun pattern, `yarn`/`npx`, frozen
-  lockfile, undocumented Makefile targets (#166).
- Prune the 24 stale remote feature branches (#167).
- Remove dead exports and de-duplicate copy-pasted view helpers (#168).
+- Verify main passes make check after the feature branch merges (not verified
+  2026-07-06 because an agent was active in the tree); fix anything red. main
+  must always be green.
+- Prune stale branches: dozens of merged local and remote feature branches
+  remain (fix/_, feature/_, tx-\*); delete merged ones locally and on origin.
+- Continue the issue backlog toward a feature-complete wallet, then cut further
+  tags as milestones land.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag; #149 and #157 are parts of it, but the
-  review is broader than either.
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
-  land.
+  input validation) before any 1.0rc tag.
--- a/build.js
+++ b/build.js
@@ -3,168 +3,75 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");

-const DIST = path.join(__dirname, "dist");
-const DIST_CHROME = path.join(DIST, "chrome");
-const DIST_FIREFOX = path.join(DIST, "firefox");
+const DIST_CHROME = path.join(__dirname, "dist", "chrome");
+const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
 const SRC = path.join(__dirname, "src");

-// The module whose compiled DEBUG state script/verify-build asserts, and the
-// manifest naming every emitted bundle that ends up containing it. The
-// manifest is derived from esbuild's own dependency graph rather than from a
-// hardcoded list, so it tracks the bundle layout instead of rotting with it.
-const AUDITED_MODULE = "src/shared/constants.js";
-const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
-
 function ensureDir(dir) {
    fs.mkdirSync(dir, { recursive: true });
 }

-// Repo-relative, forward-slashed, so the manifest reads the same on every
-// platform and can be consumed by a POSIX shell script without further work.
-function repoRelative(p) {
-    return path.relative(__dirname, p).split(path.sep).join("/");
-}
-
-// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
-// reports every input that contributed to an output in the metafile, which is
-// the authoritative answer to "is constants.js in this bundle" — unlike
-// searching the minified text, it does not depend on what survived minification.
-function outputsContainingAuditedModule(metafile) {
-    return Object.entries(metafile.outputs)
-        .filter(([outFile, info]) => {
-            if (!outFile.endsWith(".js")) return false;
-            return Object.keys(info.inputs).some(
-                (input) => repoRelative(input) === AUDITED_MODULE,
-            );
-        })
-        .map(([outFile]) => repoRelative(outFile));
-}
-
-// DEBUG is a build-time flag, off unless explicitly requested. It is the only
-// thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
-// exact: anything other than the literal "1" (unset, empty, "true", a typo)
-// produces a release build. Failing towards the safe mode is deliberate.
-function isDebugBuild() {
-    return process.env.AUTISTMASK_DEBUG === "1";
-}
-
-function getBuildInfo() {
-    const pkg = JSON.parse(
-        fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
-    );
-    let commitHash = "unknown";
-    try {
-        commitHash = execSync("git rev-parse --short HEAD", {
-            encoding: "utf8",
-        }).trim();
-    } catch (_) {
-        // not a git repo or git not available
-    }
-    let commitHashFull = "unknown";
-    try {
-        commitHashFull = execSync("git rev-parse HEAD", {
-            encoding: "utf8",
-        }).trim();
-    } catch (_) {
-        // not a git repo or git not available
-    }
-    return {
-        version: pkg.version,
-        license: pkg.license,
-        author: pkg.author,
-        commitHash,
-        commitHashFull,
-        buildDate: new Date().toISOString().slice(0, 10),
-    };
-}
-
 async function build() {
    console.log("Building AutistMask extension...");

-    const buildInfo = getBuildInfo();
-    console.log("Build info:", buildInfo);
-
-    const debugBuild = isDebugBuild();
-    console.log(
-        debugBuild
-            ? "Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)"
-            : "Build mode: release (DEBUG off)",
-    );
-
-    const define = {
-        __BUILD_DEBUG__: JSON.stringify(debugBuild),
-        __BUILD_VERSION__: JSON.stringify(buildInfo.version),
-        __BUILD_LICENSE__: JSON.stringify(buildInfo.license),
-        __BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
-        __BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
-        __BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
-        __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
-    };
-
-    // Emitted bundles that contain constants.js, accumulated across every
-    // esbuild run below and written out for script/verify-build.
-    const auditedBundles = [];
-
    // compile tailwind CSS
    console.log("Compiling Tailwind CSS...");
    const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(DIST, "styles.css");
-    ensureDir(DIST);
-
-    // Drop any manifest from a previous build before emitting anything, so a
-    // build that never gets around to writing one cannot be verified against
-    // a stale list.
-    fs.rmSync(BUNDLE_MANIFEST, { force: true });
+    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
+    ensureDir(path.join(__dirname, "dist"));
    execSync(
        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
        { stdio: "inherit" },
    );

-    // Every bundle goes through here, so metafile collection cannot be
-    // forgotten when a new entry point is added.
-    async function bundle(entryPoint, outfile) {
-        const result = await esbuild.build({
-            entryPoints: [entryPoint],
-            bundle: true,
-            format: "iife",
-            outfile,
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            metafile: true,
-            define,
-        });
-        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
-    }
-
    for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
        ensureDir(path.join(distDir, "src", "popup"));
        ensureDir(path.join(distDir, "src", "background"));
        ensureDir(path.join(distDir, "src", "content"));

        // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await bundle(
-            path.join(SRC, "popup", "index.js"),
-            path.join(distDir, "src", "popup", "index.js"),
-        );
+        await esbuild.build({
+            entryPoints: [path.join(SRC, "popup", "index.js")],
+            bundle: true,
+            format: "iife",
+            outfile: path.join(distDir, "src", "popup", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+        });

        // bundle background script
-        await bundle(
-            path.join(SRC, "background", "index.js"),
-            path.join(distDir, "src", "background", "index.js"),
-        );
+        await esbuild.build({
+            entryPoints: [path.join(SRC, "background", "index.js")],
+            bundle: true,
+            format: "iife",
+            outfile: path.join(distDir, "src", "background", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+        });

        // bundle content script
-        await bundle(
-            path.join(SRC, "content", "index.js"),
-            path.join(distDir, "src", "content", "index.js"),
-        );
+        await esbuild.build({
+            entryPoints: [path.join(SRC, "content", "index.js")],
+            bundle: true,
+            format: "iife",
+            outfile: path.join(distDir, "src", "content", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+        });

        // bundle inpage script (injected into page context, separate file)
-        await bundle(
-            path.join(SRC, "content", "inpage.js"),
-            path.join(distDir, "src", "content", "inpage.js"),
-        );
+        await esbuild.build({
+            entryPoints: [path.join(SRC, "content", "inpage.js")],
+            bundle: true,
+            format: "iife",
+            outfile: path.join(distDir, "src", "content", "inpage.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+        });

        // copy popup HTML
        fs.copyFileSync(
@@ -189,16 +96,6 @@ async function build() {
        path.join(DIST_FIREFOX, "manifest.json"),
    );

-    // Written last so a build that died partway through leaves no manifest
-    // at all, which script/verify-build treats as a hard failure rather than
-    // as "nothing to check".
-    const manifest = [...new Set(auditedBundles)].sort();
-    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
-    console.log(
-        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
-            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
-    );
-
    console.log("Build complete: dist/chrome/ and dist/firefox/");
 }

--- a/script/verify-build
+++ b/script/verify-build
@@ -1,136 +0,0 @@
-#!/bin/sh
-# script/verify-build: assert the compiled DEBUG state of the emitted
-# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
-# make build / make build-debug.
-#
-# Why this exists: DEBUG makes the publicly committed test recovery phrase the
-# output of wallet creation, so a release artifact built with it live hands
-# every new wallet to anyone who reads the repo. The test suite cannot see
-# this, because it loads src/shared/constants.js outside a bundle and takes
-# the fallback branch; the property only exists in the emitted output, so it
-# has to be asserted against the emitted output.
-#
-# What it reads: dist/constants-bundles.txt, written by build.js from
-# esbuild's metafile, naming every emitted bundle that contains
-# src/shared/constants.js. Each of those must carry exactly one of the two
-# BUILD_DEBUG_MARKER literals that constants.js folds down to.
-#
-# It fails rather than passes whenever it cannot determine a bundle's state.
-# Minified output is not a stable contract, so "matched neither form" is not
-# evidence of anything and must never read as green.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-MANIFEST="dist/constants-bundles.txt"
-MARKER_ON="autistmask-build-debug=on"
-MARKER_OFF="autistmask-build-debug=off"
-
-# Set by read_marker.
-MARKER=""
-
-fail() {
-    echo "verify-build: FAIL: $*" >&2
-    exit 1
-}
-
-has_marker() {
-    grep -q -F "$1" "$2" 2>/dev/null
-}
-
-# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
-# present. Both means the ternary in constants.js was never folded, which is
-# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
-# DEBUG stops being known at build time and the debug branch is live again.
-# Neither means we are reading output we do not understand. Both are hard
-# failures; neither is ever treated as absence of a problem.
-read_marker() {
-    _file="$1"
-    _on=no
-    _off=no
-    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
-    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
-
-    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
-        fail "$_file carries both debug markers, so the build-time DEBUG value
-    was never resolved and the debug branch is still live. Check that build.js
-    still defines __BUILD_DEBUG__."
-    fi
-    if [ "$_on" = no ] && [ "$_off" = no ]; then
-        fail "$_file carries no debug marker, so its DEBUG state cannot be
-    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
-    or the emitted output changed shape. Refusing to report success."
-    fi
-
-    if [ "$_on" = yes ]; then
-        MARKER="$MARKER_ON"
-    else
-        MARKER="$MARKER_OFF"
-    fi
-}
-
-# The manifest says which bundles must carry a marker. This says no other
-# emitted bundle may carry one, which catches a manifest that has gone stale
-# or short rather than trusting whatever it happens to list.
-check_unlisted_bundles() {
-    _listing="$(find dist -type f -name '*.js' | sort)"
-    while read -r _file; do
-        [ -n "$_file" ] || continue
-        if grep -q -x -F "$_file" "$MANIFEST"; then
-            continue
-        fi
-        if has_marker "$MARKER_ON" "$_file" ||
-            has_marker "$MARKER_OFF" "$_file"; then
-            fail "$_file carries a debug marker but is absent from $MANIFEST,
-    so the manifest no longer describes the emitted bundles."
-        fi
-    done <<EOF
-$_listing
-EOF
-}
-
-# The requested mode, read from our own environment using build.js's exact
-# rule: only the literal 1 opts in. Deliberately not taken from anything
-# build.js records about itself, so build.js cannot vouch for build.js.
-expected_marker() {
-    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
-        echo "$MARKER_ON"
-    else
-        echo "$MARKER_OFF"
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    expected="$(expected_marker)"
-    echo "Verifying emitted bundles (expecting $expected)..."
-
-    [ -f "$MANIFEST" ] ||
-        fail "$MANIFEST is missing. build.js writes it at the end of a
-    successful build; run make build first."
-    [ -s "$MANIFEST" ] ||
-        fail "$MANIFEST is empty, so no emitted bundle was found to contain
-    src/shared/constants.js. That is never correct, so it is a failure and not
-    a pass."
-
-    count=0
-    while read -r file; do
-        [ -n "$file" ] || continue
-        [ -f "$file" ] ||
-            fail "$MANIFEST lists $file, which does not exist."
-        read_marker "$file"
-        [ "$MARKER" = "$expected" ] ||
-            fail "$file is $MARKER but this build expects $expected."
-        echo "  ok: $file ($MARKER)"
-        count=$((count + 1))
-    done <"$MANIFEST"
-
-    [ "$count" -gt 0 ] || fail "no bundles were inspected."
-
-    check_unlisted_bundles
-
-    echo "verify-build: $count bundle(s) verified $expected"
-}
-
-main "$@"
--- a/scripts/apply-enrichment.mjs
+++ b/scripts/apply-enrichment.mjs
@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// Apply enrichment data to tokenList.js: add name + url fields to each token.
+
+import { readFileSync, writeFileSync } from "fs";
+
+const enrichment = JSON.parse(
+    readFileSync("scripts/token-enrichment.json", "utf8"),
+);
+
+// Well-known URLs for major tokens not in ethereum-lists.
+// These are official project websites verified from public sources.
+const EXTRA_URLS = {
+    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
+    "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",
+    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": "https://www.bnbchain.org",
+    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": "https://www.circle.com/usdc",
+    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": "https://sky.money",
+    "0x2AF5D2aD76741191D15Dfe7bF6aC92d4Bd912Ca3": "https://www.bitfinex.com",
+    "0x514910771AF9Ca656af840dff83E8264EcF986CA": "https://chain.link",
+    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": "https://ethena.fi",
+    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d":
+        "https://www.worldlibertyfinancial.com",
+    "0x6B175474E89094C44Da98b954EedeAC495271d0F": "https://makerdao.com",
+    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8":
+        "https://www.paypal.com/us/digital-wallet/manage-money/crypto/pyusd",
+    "0x95aD61b0a150d79219dCF64E1E6Cc01f0B64C4cE": "https://shibatoken.com",
+    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6":
+        "https://www.worldlibertyfinancial.com",
+    "0xA0b73E1Ff0B80914AB6fe0444E65848C4C34450b": "https://crypto.com",
+    "0x582d872A1B094FC48F5DE31D3B73F2D9bE47def1": "https://ton.org",
+    "0x68749665FF8D2d112Fa859AA293F07A622782F38": "https://gold.tether.to",
+    "0x196C20DA81Fbc324EcdF55501e95Ce9f0bD84d14": "https://polkadot.network",
+    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": "https://uniswap.org",
+    "0x45804880De22913dAFE09f4980848ECE6EcbAf78":
+        "https://www.paxos.com/paxgold",
+    "0x3c3a81e81dc49A522A592e7622A7E711c06bf354": "https://www.mantle.xyz",
+    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": "https://aave.com",
+    "0x75231F58b43240C9718Dd58B4967c5114342a86c": "https://www.okx.com",
+    "0x6982508145454Ce325dDbE47a25d4ec3d2311933": "https://www.pepe.vip",
+    "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599": "https://wbtc.network",
+    "0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84": "https://lido.fi",
+    "0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32": "https://lido.fi",
+    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": "https://ens.domains",
+    "0x7D1AfA7B718fb893dB30A3aBc0Cfc608AaCfeBB0": "https://polygon.technology",
+    "0x9f8F72aA9304c8B593d555F12eF6589cC3A579A2": "https://makerdao.com",
+    "0xD533a949740bb3306d119CC777fa900bA034cd52": "https://curve.fi",
+    "0x111111111117dC0aa78b770fA6A738034120C302": "https://1inch.io",
+    "0x163f8C2467924be0ae7B5347228CABF260318753": "https://worldcoin.org",
+    "0xba100000625a3754423978a60c9317c58a424e3D": "https://balancer.fi",
+    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": "https://synthetix.io",
+    "0x1a7e4e63778B4f12a199C062f3eFdD288afCBce8": "https://www.euler.finance",
+    "0xBBbbCA6A901c926F240b89EacB641d8Aec7AEafD": "https://loopring.org",
+    "0xC669928185DbCE49d2230CC9B0979BE6DC797957": "https://bitstable.finance",
+    "0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0": "https://lido.fi",
+    "0xBe9895146f7AF43049ca1c1AE358B0541Ea49704":
+        "https://www.coinbase.com/cbeth",
+    "0xfAbA6f8e4a5E8Ab82F62fe7C39859FA577269BE3": "https://ondo.finance",
+    "0x0C10bF8FcB7Bf5412187A595ab97a3609160b5c6": "https://decentraland.org",
+    "0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24": "https://www.render.com",
+    "0x4a220E6096B25EADb88358cb44068A3248254675": "https://www.quant.network",
+    "0xba5BDe662c17e2aDFF1075610382B9B691296350": "https://superrare.com",
+    "0x15D4c048F83bd7e37d49eA4C83a07267Ec4203dA": "https://galxe.com",
+    "0xc00e94Cb662C3520282E6f5717214004A7f26888": "https://compound.finance",
+    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": "https://0x.org",
+    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": "https://yearn.fi",
+    "0x6fB3e0A217407EFFf7Ca062D46c26E5d60a14d69": "https://iotex.io",
+    "0xD31a59c85aE9D8edEFec411D448f90841571b89c": "https://solana.com",
+    "0xa1faa113cbE53436Df28FF0aEe54275c13B40975": "https://alphafinance.io",
+    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": "https://immutable.com",
+    "0x0f5D2fB29fb7d3CFeE444a200298f468908cC942": "https://decentraland.org",
+    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": "https://www.sandbox.game",
+    "0x4d224452801ACEd8B2F0aebE155379bb5D594381": "https://apecoin.com",
+    "0x6810e776880C02933D47DB1b9fc05908e5386b96": "https://gnosis.io",
+    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": "https://www.liquity.org",
+    "0xd26114cd6EE289AccF82350c8d8487fedB8A0C07": "https://omg.network",
+    "0x0D8775F648430679A709E98d2b0Cb6250d2887EF":
+        "https://basicattentiontoken.org",
+    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": "https://thegraph.com",
+    "0x1985365e9f78359a9B6AD760e32412f4a445E862": "https://augur.net",
+    "0x4E15361FD6b4BB609Fa63C81A2be19d873717870": "https://fantom.foundation",
+    "0x853d955aCEf822Db058eb8505911ED77F175b99e": "https://frax.finance",
+    "0x0000000000085d4780B73119b644AE5ecd22b376": "https://www.trueusd.com",
+    "0x0cEC1A9154Ff802e7934Fc916Ed7Ca50bDE6844e": "https://polymesh.network",
+    "0x956F47F50A910163D8BF957Cf5846D573E7f87CA": "https://fei.money",
+    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": "https://frax.finance",
+    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": "https://curve.fi",
+    "0x0100546F2cD4C9D97f798fFC9755E47865FF7Ee6": "https://alchemix.fi",
+    "0x808507121B80c02388fAd14726482e061B8da827": "https://pendle.finance",
+    "0xCa14007Eff0dB1f8135f4C25B34De49AB0d42766": "https://starknet.io",
+    "0x8457CA5040ad67fdebbCC8EdCE889A335Bc0fbFB": "https://alt.layer",
+    "0x4C19596f5aAfF459fA38B0f7eD92F11AE6543784": "https://www.truflation.com",
+    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": "https://arbitrum.io",
+    "0x912CE59144191C1204E64559FE8253a0e49E6548": "https://arbitrum.io",
+    "0x6985884C4392D348587B19cb9eAAf157F13271cd": "https://layerzero.network",
+    "0xFe0c30065B384F05761f15d0CC899D4F9F9Cc0eB": "https://ethfi.org",
+    "0x18084fbA666a33d37592fA2633fD49a74DD93a88": "https://tbtc.network",
+    "0x9D39A5DE30e57443BfF2A8307A4256c8797A3497": "https://suilend.fi",
+    "0x5283D291DBCF85356A21bA090E6db59121208b44": "https://blur.io",
+    "0x43Dfc4159D86F3A37A5A4B3D4580b888ad7d4DDd": "https://dydx.exchange",
+    "0xCf0C122c6b73ff809C693DB761e7BaeBe62b6a2E": "https://floki.com",
+    "0xe53EC727dbDEB9E2d5456c3be40cFF031AB40A55": "https://superfarm.com",
+    "0x32353A6C91143bfd6C7d363B546e62a9A2489A20": "https://www.agora.finance",
+    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": "https://www.euro-coin.com",
+    "0x1a03eF3d1a80b5f214e468ACD97F55714E049393": "https://gemspad.io",
+    "0x7122985656e38BDC0302Db86685bb972b145bD3C": "https://stone.fi",
+    "0xa35923162C49cF95e6BF26623385eb431ad920D3": "https://www.turbo-eth.com",
+    "0xdBdb4d16EdA451D0503b854CF79D55697F90c8DF": "https://alchemix.fi",
+    "0x08c32b0726C5684024ea6e141C50aDe9690bBdcc": "https://stratis.io",
+    "0x65Ef703f5594D2573eb71Aaf55BC0CB548492df4": "https://multichain.org",
+    "0x1151CB3d861920e07a38e03eEAd12C32178567F6": "https://bonk.com",
+    "0x090185f2135308BaD17527004364eBcC2D37e5F6": "https://spell.club",
+    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": "https://stargate.finance",
+};
+
+// Apply extra URLs where enrichment has none
+for (const [addr, url] of Object.entries(EXTRA_URLS)) {
+    const e = enrichment[addr];
+    if (e && !e.url) {
+        e.url = url;
+    }
+}
+
+// Read original tokenList.js
+const original = readFileSync("src/shared/tokenList.js", "utf8");
+
+// Replace each token block: add name and url after decimals
+let result = original;
+let replacements = 0;
+
+for (const [addr, data] of Object.entries(enrichment)) {
+    // Escape special regex characters in the address
+    const escaped = addr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+    // Match the token block: { address: "...", symbol: "...", decimals: N, }
+    // The closing }, may have trailing whitespace
+    const blockRe = new RegExp(
+        `(\\{\\s*address:\\s*"${escaped}",\\s*symbol:\\s*"[^"]+",\\s*decimals:\\s*\\d+),?(\\s*\\})`,
+    );
+
+    const match = result.match(blockRe);
+    if (!match) {
+        console.error(`WARNING: Could not find block for ${addr}`);
+        continue;
+    }
+
+    // Build replacement: original fields + name + url
+    const nameEscaped = data.name.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    const urlEscaped = data.url.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    const replacement =
+        match[1] +
+        `,\n        name: "${nameEscaped}",` +
+        `\n        url: "${urlEscaped}",` +
+        match[2];
+
+    result = result.replace(blockRe, replacement);
+    replacements++;
+}
+
+console.error(`Applied ${replacements} enrichments to tokenList.js`);
+writeFileSync("src/shared/tokenList.js", result);
+console.error("Done!");
--- a/scripts/enrich-tokens.mjs
+++ b/scripts/enrich-tokens.mjs
@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+// Temporary script: fetch name + homepage URL for every token in tokenList.js
+// Phase 1: CoinGecko /coins/list (1 bulk call) for names — gets 100%
+// Phase 2: ethereum-lists GitHub repo for project URLs — gets ~15%
+
+import { readFileSync, writeFileSync } from "fs";
+
+const src = readFileSync("src/shared/tokenList.js", "utf8");
+
+const tokens = [];
+const re =
+    /\{\s*address:\s*"(0x[a-fA-F0-9]{40})",\s*symbol:\s*"([^"]+)",\s*decimals:\s*(\d+)/g;
+let m;
+while ((m = re.exec(src)) !== null) {
+    tokens.push({ address: m[1], symbol: m[2], decimals: parseInt(m[3]) });
+}
+console.error(`Parsed ${tokens.length} tokens`);
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// --- Phase 1: bulk names from CoinGecko ---
+console.error("Fetching CoinGecko coins list...");
+const listResp = await fetch(
+    "https://api.coingecko.com/api/v3/coins/list?include_platform=true",
+);
+if (!listResp.ok) throw new Error(`CoinGecko list HTTP ${listResp.status}`);
+const coins = await listResp.json();
+
+const addrMap = new Map();
+for (const coin of coins) {
+    const eth = (coin.platforms?.ethereum || "").toLowerCase().trim();
+    if (eth && eth.startsWith("0x")) {
+        addrMap.set(eth, { name: coin.name, id: coin.id });
+    }
+}
+console.error(`CoinGecko map: ${addrMap.size} Ethereum tokens`);
+
+const enriched = new Map();
+for (const t of tokens) {
+    const info = addrMap.get(t.address.toLowerCase());
+    enriched.set(t.address, { name: info?.name || t.symbol, url: "" });
+}
+console.error(
+    `Matched ${[...enriched.values()].filter((e) => e.name).length}/${tokens.length} names`,
+);
+
+// --- Phase 2: ethereum-lists GitHub for URLs ---
+console.error("Fetching URLs from ethereum-lists GitHub...");
+const CONCURRENT = 10;
+let urlsFound = 0;
+
+for (let i = 0; i < tokens.length; i += CONCURRENT) {
+    const batch = tokens.slice(i, i + CONCURRENT);
+    await Promise.allSettled(
+        batch.map(async (t) => {
+            try {
+                const r = await fetch(
+                    `https://raw.githubusercontent.com/ethereum-lists/tokens/master/tokens/eth/${t.address}.json`,
+                );
+                if (!r.ok) return;
+                const data = await r.json();
+                const website = (data.website || "").trim();
+                if (website && website !== "https://") {
+                    enriched.get(t.address).url = website;
+                    urlsFound++;
+                }
+            } catch {
+                // ignore
+            }
+        }),
+    );
+    if (i % 100 === 0) {
+        console.error(
+            `  GitHub: ${Math.min(i + CONCURRENT, tokens.length)}/${tokens.length}, ${urlsFound} URLs`,
+        );
+    }
+    await sleep(200);
+}
+console.error(`Phase 2 done: ${urlsFound} URLs from ethereum-lists`);
+
+// --- Output ---
+const output = {};
+for (const [addr, e] of enriched) {
+    output[addr] = { name: e.name, url: e.url };
+}
+writeFileSync("scripts/token-enrichment.json", JSON.stringify(output, null, 2));
+console.error(`Done! ${tokens.length} names, ${urlsFound} URLs.`);
--- a/scripts/token-enrichment.json
+++ b/scripts/token-enrichment.json
--- a/src/popup/index.html
+++ b/src/popup/index.html
@@ -1002,64 +1002,6 @@
                    </p>
                    <div id="settings-denied-sites"></div>
                </div>
-
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <h3 class="font-bold mb-1">About</h3>
-                    <p class="text-xs mb-2">
-                        <a
-                            href="https://git.eeqj.de/sneak/AutistMask"
-                            class="underline decoration-dashed"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            >AutistMask</a
-                        >
-                        — Minimal Ethereum wallet browser extension.
-                    </p>
-                    <div class="text-xs">
-                        <div class="mb-1">
-                            <span class="text-muted">License:</span>
-                            <span id="about-license"></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Author:</span>
-                            <span id="about-author"></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Version:</span>
-                            <span
-                                id="about-version"
-                                class="cursor-pointer select-none"
-                            ></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Release date:</span>
-                            <span id="about-release-date"></span>
-                        </div>
-                        <div>
-                            <span class="text-muted">Commit:</span>
-                            <a
-                                id="about-commit-link"
-                                class="underline decoration-dashed"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                            ></a>
-                        </div>
-                    </div>
-                </div>
-
-                <div
-                    id="settings-debug-well"
-                    class="bg-well p-3 mx-1 mb-3"
-                    style="display: none"
-                >
-                    <h3 class="font-bold mb-1">Debug</h3>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer"
-                    >
-                        <input type="checkbox" id="settings-debug-mode" />
-                        Enable debug mode
-                    </label>
-                </div>
            </div>

            <!-- ============ DELETE WALLET CONFIRM ============ -->
--- a/src/popup/index.js
+++ b/src/popup/index.js
@@ -1,14 +1,18 @@
 // AutistMask popup entry point.
 // Loads state, initializes views, triggers first render.

-const { state, saveState, loadState } = require("../shared/state");
-const { setRuntimeDebug } = require("../shared/log");
+const { DEBUG } = require("../shared/constants");
+const {
+    state,
+    saveState,
+    loadState,
+    currentNetwork,
+} = require("../shared/state");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
 const {
    $,
    showView,
-    updateDebugBanner,
    setRenderMain,
    pushCurrentView,
    goBack,
@@ -205,11 +209,21 @@ async function init() {
    await loadState();
    applyTheme(state.theme);

-    // Sync runtime debug flag from persisted state before first render
-    setRuntimeDebug(state.debugMode);
-
-    // Create the debug/testnet banner if needed (uses runtime debug state)
-    updateDebugBanner();
+    const net = currentNetwork();
+    if (DEBUG || net.isTestnet) {
+        const banner = document.createElement("div");
+        banner.id = "debug-banner";
+        if (DEBUG && net.isTestnet) {
+            banner.textContent = "DEBUG / INSECURE [TESTNET]";
+        } else if (net.isTestnet) {
+            banner.textContent = "[TESTNET]";
+        } else {
+            banner.textContent = "DEBUG / INSECURE";
+        }
+        banner.style.cssText =
+            "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
+        document.body.prepend(banner);
+    }

    // Auto-default active address
    if (
--- a/src/popup/styles/main.css
+++ b/src/popup/styles/main.css
@@ -10,7 +10,7 @@
    --color-border: #000000;
    --color-border-light: #cccccc;
    --color-hover: #eeeeee;
-    --color-well: #e8e8e8;
+    --color-well: #f5f5f5;
    --color-danger-well: #fef2f2;
    --color-section: #dddddd;
 }
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -1,6 +1,6 @@
 // Shared DOM helpers used by all views.

-const { isDebug } = require("../../shared/log");
+const { DEBUG } = require("../../shared/constants");
 const {
    formatUsd,
    getPrice,
@@ -59,37 +59,19 @@ function showView(name) {
    clearFlash();
    state.currentView = name;
    saveState();
-    updateDebugBanner(name);
-}
-
-// Create or update the debug/insecure warning banner.
-// Called on every view switch and after the settings debug toggle changes.
-// The banner is shown when the compile-time DEBUG constant is true OR when
-// the user has enabled runtime debug mode via the settings easter egg, OR
-// when the active network is a testnet.
-function updateDebugBanner(viewName) {
-    const debug = isDebug();
    const net = currentNetwork();
-    const show = debug || net.isTestnet;
-    let banner = document.getElementById("debug-banner");
-    if (show) {
-        if (!banner) {
-            banner = document.createElement("div");
-            banner.id = "debug-banner";
-            banner.style.cssText =
-                "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
-            document.body.prepend(banner);
-        }
-        const suffix = viewName ? " (" + viewName + ")" : "";
-        if (debug && net.isTestnet) {
-            banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
+    if (DEBUG || net.isTestnet) {
+        const banner = document.getElementById("debug-banner");
+        if (banner) {
+            if (DEBUG && net.isTestnet) {
+                banner.textContent =
+                    "DEBUG / INSECURE [TESTNET] (" + name + ")";
            } else if (net.isTestnet) {
-            banner.textContent = "[TESTNET]" + suffix;
+                banner.textContent = "[TESTNET]";
            } else {
-            banner.textContent = "DEBUG / INSECURE" + suffix;
+                banner.textContent = "DEBUG / INSECURE (" + name + ")";
+            }
        }
-    } else if (banner) {
-        banner.remove();
    }
 }

@@ -435,7 +417,6 @@ module.exports = {
    showError,
    hideError,
    showView,
-    updateDebugBanner,
    setRenderMain,
    pushCurrentView,
    goBack,
--- a/src/popup/views/settings.js
+++ b/src/popup/views/settings.js
@@ -1,10 +1,8 @@
 const {
    $,
    showView,
-    updateDebugBanner,
    showFlash,
    escapeHtml,
-    flashCopyFeedback,
    goBack,
    pushCurrentView,
 } = require("./helpers");
@@ -12,23 +10,12 @@ const { applyTheme } = require("../theme");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
-const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
+const { log, debugFetch } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
-const {
-    BUILD_VERSION,
-    BUILD_LICENSE,
-    BUILD_AUTHOR,
-    BUILD_COMMIT,
-    BUILD_DATE,
-    GITEA_COMMIT_URL,
-} = require("../../shared/buildInfo");

 const runtime =
    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;

-let versionClickCount = 0;
-let versionClickTimer = null;
-
 function renderSiteList(containerId, siteMap, stateKey) {
    const container = $(containerId);
    const hostnames = [...new Set(Object.values(siteMap).flat())];
@@ -155,28 +142,6 @@ function show() {
    renderSiteLists();
    renderWalletListSettings();

-    // Populate About well
-    $("about-license").textContent = BUILD_LICENSE;
-    // Show only the name part of the author field (strip email)
-    const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
-    $("about-author").textContent = authorName;
-    $("about-version").textContent = BUILD_VERSION;
-    $("about-release-date").textContent = BUILD_DATE;
-    $("about-commit-link").textContent = BUILD_COMMIT;
-    $("about-commit-link").href = GITEA_COMMIT_URL;
-
-    // Reset version click counter each time settings opens
-    versionClickCount = 0;
-
-    // Show debug well if debug mode is already enabled
-    const debugWell = $("settings-debug-well");
-    if (state.debugMode) {
-        debugWell.style.display = "";
-    } else {
-        debugWell.style.display = "none";
-    }
-    $("settings-debug-mode").checked = state.debugMode;
-
    showView("settings");
 }

@@ -324,66 +289,6 @@ function init(ctx) {
        ctx.showSettingsAddTokenView,
    );

-    // Bright saturated colors for easter egg flashes (clicks 6–10)
-    const easterEggColors = [
-        "#ff0055", // hot pink
-        "#00cc44", // vivid green
-        "#3366ff", // electric blue
-        "#ff9900", // bright orange
-        "#aa00ff", // vivid purple
-    ];
-
-    // Easter egg: click version 10 times to reveal the debug well.
-    // Each click does a copy-flash animation. After 5 clicks, each
-    // additional click flashes a different bright saturated color.
-    $("about-version").addEventListener("click", () => {
-        versionClickCount++;
-        clearTimeout(versionClickTimer);
-        // Reset counter if user stops clicking for 3 seconds
-        versionClickTimer = setTimeout(() => {
-            versionClickCount = 0;
-        }, 3000);
-
-        const el = $("about-version");
-
-        if (versionClickCount > 5) {
-            // Colored flash for clicks 6–10
-            const colorIdx = versionClickCount - 6;
-            const color = easterEggColors[colorIdx % easterEggColors.length];
-            el.classList.remove("copy-flash-fade");
-            el.style.backgroundColor = color;
-            el.style.color = "#ffffff";
-            setTimeout(() => {
-                el.style.backgroundColor = "";
-                el.style.color = "";
-                el.classList.add("copy-flash-fade");
-                setTimeout(() => {
-                    el.classList.remove("copy-flash-fade");
-                }, 275);
-            }, 75);
-        } else {
-            // Standard copy-flash for clicks 1–5
-            flashCopyFeedback(el);
-        }
-
-        if (versionClickCount >= 10) {
-            versionClickCount = 0;
-            clearTimeout(versionClickTimer);
-            $("settings-debug-well").style.display = "";
-        }
-    });
-
-    // Debug mode toggle — update runtime flag, persist, and re-render banner
-    $("settings-debug-mode").addEventListener("change", async () => {
-        state.debugMode = $("settings-debug-mode").checked;
-        setRuntimeDebug(state.debugMode);
-        await saveState();
-        updateDebugBanner(state.currentView);
-    });
-
-    // Sync runtime debug flag on init
-    setRuntimeDebug(state.debugMode);
-
    $("btn-settings-back").addEventListener("click", () => {
        goBack();
    });
--- a/src/shared/buildInfo.js
+++ b/src/shared/buildInfo.js
@@ -1,35 +0,0 @@
-// Build-time constants injected by esbuild define in build.js.
-// These globals are replaced at bundle time with string literals.
-
-/* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
-          __BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
-
-const BUILD_VERSION =
-    typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
-const BUILD_LICENSE =
-    typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
-const BUILD_AUTHOR =
-    typeof __BUILD_AUTHOR__ !== "undefined"
-        ? __BUILD_AUTHOR__
-        : "sneak <sneak@sneak.berlin>";
-const BUILD_COMMIT =
-    typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
-const BUILD_COMMIT_FULL =
-    typeof __BUILD_COMMIT_FULL__ !== "undefined"
-        ? __BUILD_COMMIT_FULL__
-        : "unknown";
-const BUILD_DATE =
-    typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
-
-const GITEA_COMMIT_URL =
-    "https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
-
-module.exports = {
-    BUILD_VERSION,
-    BUILD_LICENSE,
-    BUILD_AUTHOR,
-    BUILD_COMMIT,
-    BUILD_COMMIT_FULL,
-    BUILD_DATE,
-    GITEA_COMMIT_URL,
-};
--- a/src/shared/constants.js
+++ b/src/shared/constants.js
@@ -1,27 +1,4 @@
-// DEBUG is a build-time constant injected by esbuild's define in build.js
-// (see src/shared/buildInfo.js for the same pattern). It is false unless the
-// bundle was produced with AUTISTMASK_DEBUG=1, and it is false whenever the
-// module is loaded outside a bundle (tests, plain require). It must never be
-// derived from anything the user can change at runtime: it is what gates the
-// hardcoded test mnemonic below.
-/* global __BUILD_DEBUG__ */
-const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
-
-// Machine-readable record of the compiled DEBUG state, read out of the emitted
-// bundles by script/verify-build. It is derived from DEBUG itself so the two
-// cannot disagree, and it is a plain string literal rather than a minifier
-// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
-// staying byte-stable across versions.
-//
-// The ambiguity is the point. When DEBUG is known at build time the bundler
-// folds this to exactly one of the two literals. When it is not — which is
-// exactly what happens if the __BUILD_DEBUG__ define goes missing from
-// build.js — the ternary survives, both literals appear in the bundle, and
-// verify-build fails rather than guessing.
-const BUILD_DEBUG_MARKER = DEBUG
-    ? "autistmask-build-debug=on"
-    : "autistmask-build-debug=off";
-
+const DEBUG = true;
 const DEBUG_MNEMONIC =
    "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";

@@ -59,7 +36,6 @@ function isBurnAddress(address) {

 module.exports = {
    DEBUG,
-    BUILD_DEBUG_MARKER,
    DEBUG_MNEMONIC,
    ETHEREUM_MAINNET_CHAIN_ID,
    ETHEREUM_SEPOLIA_CHAIN_ID,
--- a/src/shared/log.js
+++ b/src/shared/log.js
@@ -1,27 +1,12 @@
 // Leveled logger. Outputs to console with [AutistMask] prefix.
-// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
-// debugMode state flag is enabled.  The runtime flag is checked lazily so it
-// responds immediately when toggled in settings.
+// Level is DEBUG when the DEBUG constant is true, INFO otherwise.

 const { DEBUG } = require("./constants");

 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
-
-// Runtime debug mode flag — set by settings.js when the user toggles debug
-// mode via the easter egg.  Kept here as a simple mutable reference so it can
-// be updated without circular dependency issues with state.js.
-let _runtimeDebug = false;
-
-function setRuntimeDebug(enabled) {
-    _runtimeDebug = enabled;
-}
-
-function isDebug() {
-    return DEBUG || _runtimeDebug;
-}
+const threshold = DEBUG ? LEVELS.debug : LEVELS.info;

 function emit(level, method, args) {
-    const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
    if (LEVELS[level] >= threshold) {
        console[method]("[AutistMask]", ...args);
    }
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
    return resp;
 }

-module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
+module.exports = { log, debugFetch };
--- a/src/shared/state.js
+++ b/src/shared/state.js
@@ -29,7 +29,6 @@ const DEFAULT_STATE = {
    fraudContracts: [],
    tokenHolderCache: {},
    theme: "system",
-    debugMode: false,
 };

 const state = {
@@ -69,7 +68,6 @@ async function saveState() {
        fraudContracts: state.fraudContracts,
        tokenHolderCache: state.tokenHolderCache,
        theme: state.theme,
-        debugMode: state.debugMode,
        currentView: state.currentView,
        selectedWallet: state.selectedWallet,
        selectedAddress: state.selectedAddress,
@@ -130,8 +128,6 @@ async function loadState() {
        state.fraudContracts = saved.fraudContracts || [];
        state.tokenHolderCache = saved.tokenHolderCache || {};
        state.theme = saved.theme || "system";
-        state.debugMode =
-            saved.debugMode !== undefined ? saved.debugMode : false;
        state.currentView = saved.currentView || null;
        state.selectedWallet =
            saved.selectedWallet !== undefined ? saved.selectedWallet : null;
--- a/src/shared/wallet.js
+++ b/src/shared/wallet.js
@@ -5,10 +5,6 @@ const { Mnemonic, HDNodeWallet, Wallet } = require("ethers");
 const { DEBUG, DEBUG_MNEMONIC, BIP44_ETH_PATH } = require("./constants");

 function generateMnemonic() {
-    // This must stay the compile-time DEBUG constant. Do NOT switch it to
-    // isDebug() from log.js: that also ORs in the runtime debugMode flag the
-    // settings toggle drives, which would let a user of a release build turn
-    // the hardcoded, publicly known test phrase back on for real wallets.
    if (DEBUG) return DEBUG_MNEMONIC;
    const m = Mnemonic.fromEntropy(
        globalThis.crypto.getRandomValues(new Uint8Array(16)),
--- a/tests/constants.test.js
+++ b/tests/constants.test.js
@@ -1,6 +1,4 @@
 const {
-    DEBUG,
-    BUILD_DEBUG_MARKER,
    ETHEREUM_MAINNET_CHAIN_ID,
    DEFAULT_RPC_URL,
    BIP44_ETH_PATH,
@@ -21,24 +19,6 @@ describe("constants", () => {
        expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
    });

-    // This does not replace script/verify-build, which is the only thing that
-    // can see the compiled DEBUG state of a real bundle. It pins the source
-    // invariant that the marker tracks DEBUG, so the two cannot be edited
-    // apart and leave verify-build asserting something that is no longer the
-    // flag the code branches on.
-    test("build debug marker is derived from DEBUG", () => {
-        expect(BUILD_DEBUG_MARKER).toBe(
-            DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
-        );
-    });
-
-    // Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
-    // must be the safe one.
-    test("DEBUG is off when loaded outside a bundle", () => {
-        expect(DEBUG).toBe(false);
-        expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
-    });
-
    test("exports ERC-20 ABI with expected functions", () => {
        expect(Array.isArray(ERC20_ABI)).toBe(true);
        expect(ERC20_ABI.length).toBeGreaterThan(0);
--- a/tests/wallet.test.js
+++ b/tests/wallet.test.js
@@ -1,94 +0,0 @@
-// Tests for the DEBUG build flag as it gates mnemonic generation.
-//
-// The modules read the __BUILD_DEBUG__ global that esbuild replaces at bundle
-// time. Under jest the global is absent, which is exactly the release-build
-// case; the debug-build case is exercised by defining the global and
-// re-requiring the modules with a fresh registry.
-
-const WORDS_IN_12_WORD_PHRASE = 12;
-
-function loadWallet() {
-    const constants = require("../src/shared/constants");
-    const wallet = require("../src/shared/wallet");
-    const log = require("../src/shared/log");
-    return { constants, wallet, log };
-}
-
-describe("generateMnemonic in a release build", () => {
-    beforeEach(() => {
-        jest.resetModules();
-        delete globalThis.__BUILD_DEBUG__;
-    });
-
-    test("DEBUG defaults to false when the build define is absent", () => {
-        const { constants } = loadWallet();
-        expect(constants.DEBUG).toBe(false);
-    });
-
-    test("returns fresh, valid 12-word phrases that are not the test phrase", () => {
-        const { constants, wallet } = loadWallet();
-
-        const first = wallet.generateMnemonic();
-        const second = wallet.generateMnemonic();
-
-        expect(first).not.toBe(second);
-        for (const phrase of [first, second]) {
-            expect(wallet.isValidMnemonic(phrase)).toBe(true);
-            expect(phrase.split(" ")).toHaveLength(WORDS_IN_12_WORD_PHRASE);
-            expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
-        }
-    });
-
-    test("derives a usable HD wallet from the generated phrase", () => {
-        const { wallet } = loadWallet();
-
-        const { xpub, firstAddress } = wallet.hdWalletFromMnemonic(
-            wallet.generateMnemonic(),
-        );
-
-        expect(xpub.startsWith("xpub")).toBe(true);
-        expect(firstAddress).toMatch(/^0x[0-9a-fA-F]{40}$/);
-    });
-
-    test("the runtime debug toggle cannot re-enable the test phrase", () => {
-        const { constants, wallet, log } = loadWallet();
-
-        // What the settings easter-egg toggle does at runtime.
-        log.setRuntimeDebug(true);
-        expect(log.isDebug()).toBe(true);
-
-        const phrase = wallet.generateMnemonic();
-        expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
-        expect(wallet.isValidMnemonic(phrase)).toBe(true);
-        expect(phrase).not.toBe(wallet.generateMnemonic());
-
-        log.setRuntimeDebug(false);
-    });
-});
-
-describe("generateMnemonic in a debug build", () => {
-    beforeEach(() => {
-        jest.resetModules();
-        globalThis.__BUILD_DEBUG__ = true;
-    });
-
-    afterEach(() => {
-        delete globalThis.__BUILD_DEBUG__;
-    });
-
-    test("DEBUG is true and the test phrase is returned", () => {
-        const { constants, wallet } = loadWallet();
-
-        expect(constants.DEBUG).toBe(true);
-        expect(wallet.generateMnemonic()).toBe(constants.DEBUG_MNEMONIC);
-    });
-
-    test("the test phrase is itself a valid 12-word BIP-39 phrase", () => {
-        const { constants, wallet } = loadWallet();
-
-        expect(wallet.isValidMnemonic(constants.DEBUG_MNEMONIC)).toBe(true);
-        expect(constants.DEBUG_MNEMONIC.split(" ")).toHaveLength(
-            WORDS_IN_12_WORD_PHRASE,
-        );
-    });
-});