security: make DEBUG a build-time flag defaulting to off (closes #149) (#169)

Fixes the highest-severity item in the repo: `src/shared/constants.js` had
`const DEBUG = true;`, so `generateMnemonic()` returned the publicly committed
`DEBUG_MNEMONIC` for every wallet created from a build of `main`, and the real
entropy path was dead code in every artifact we could produce.

## What changed

**`build.js`** — `AUTISTMASK_DEBUG` is read from the environment and injected
as a `__BUILD_DEBUG__` entry in the existing esbuild `define` map, next to the
other `__BUILD_*__` defines. Only the exact value `1` enables it; unset, empty,
`true`, or a typo all yield a release build, so the insecure direction requires
a deliberate opt-in and any mistake fails safe. The build prints
`Build mode: release (DEBUG off)` or
`Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)`.

**`src/shared/constants.js`** — `DEBUG` now uses the same `typeof` guard that
`src/shared/buildInfo.js` already uses for the other build-time defines, and
defaults to `false` when the define is absent (jest, plain `require`).
`DEBUG_MNEMONIC` stays in the tree and stays exported.

**`Makefile`** — new `build-debug` target (`AUTISTMASK_DEBUG=1` + the same
build) so a debug build stays a one-liner for development.

**`README.md`** — new "Debug Builds" subsection under Getting Started, and the
DEBUG Mode Policy section now states that `DEBUG` is build-time-only and spells
out the boundary against the runtime toggle.

**`tests/wallet.test.js`** — new, covering both build modes.

**`TODO.md`** — refreshed in the same commit (details at the bottom).

No new `if (DEBUG)` branch was added and nothing about what DEBUG *does* changed:
still exactly the red banner plus the hardcoded test phrase, per the README
DEBUG Mode Policy and `RULES.md:76-80`.

## The interaction with the #145 settings toggle

This is the subtle part, so spelling out the reasoning.

There are two distinct debug flags in the tree after #145:

1. the compile-time `DEBUG` constant from `constants.js`, and
2. the runtime `debugMode` state flag, which the settings easter egg toggles
   and which `settings.js:379` pushes into `log.js` via `setRuntimeDebug()`.

`log.js` merges them: `isDebug()` is `DEBUG || _runtimeDebug`. That merged
value feeds exactly two things — the log level threshold (`log.js:24`) and the
red banner (`views/helpers.js:71`). Making the banner user-toggleable is the
intended behavior of #145, and this PR leaves it alone.

`generateMnemonic()` does **not** consult `isDebug()`. It reads the
compile-time `DEBUG` binding directly. That distinction is what makes a release
build coherent: with `__BUILD_DEBUG__` false, `DEBUG` is false in the bundle,
so no amount of clicking the version ten times and flipping the toggle can
reach `return DEBUG_MNEMONIC`. The user can turn the banner and verbose logging
on in a release build; they cannot turn the hardcoded phrase on.

The failure mode to guard against is someone later "tidying up" the two flags by
routing `wallet.js` through `isDebug()`, which would silently reintroduce this
exact vulnerability with the runtime toggle as the trigger. Three things now
guard that: a comment at the `wallet.js` call site saying it must stay the
compile-time constant and why, the same statement in the README DEBUG Mode
Policy, and a regression test that calls `setRuntimeDebug(true)`, asserts
`isDebug()` is genuinely true, and then asserts `generateMnemonic()` still
returns fresh entropy.

I considered instead making the runtime toggle unavailable in release builds,
but rejected it: that removes a feature #145 deliberately added, and it defends
the wrong boundary. The banner is not the dangerous part; the mnemonic path is,
and that one is already unreachable.

## Verification

`make check` — green, 5 suites, 55 tests, plus lint and fmt-check. It also ran
via the pre-commit hook on the commit itself.

The new tests, per the verification standard in the manager comment on the
issue (not just `a !== b`) — with the flag off: two successive
`generateMnemonic()` calls differ, both pass `isValidMnemonic`, both are 12
words, neither equals `DEBUG_MNEMONIC`, and the result derives a usable HD
wallet (`xpub` + a well-formed first address), so a broken implementation
returning a counter or a truncated phrase would fail. Same assertions again
with the runtime toggle forced on. With the flag on (`__BUILD_DEBUG__` defined
before a `jest.resetModules()` re-require): `DEBUG` is `true` and
`generateMnemonic()` returns `DEBUG_MNEMONIC`, so the debug path is proven
working rather than silently deleted.

Build artifacts — `make build` and `make build-debug` both produce `dist/chrome`
and `dist/firefox` successfully. Grepping the minified bundles for the emitted
`DEBUG` export value across all four bundles (chrome popup, chrome background,
firefox popup, firefox background):

    # after make build
    $ grep -roh 'DEBUG:![01]' dist/chrome dist/firefox | sort | uniq -c
          4 DEBUG:!1

    # after make build-debug
    $ grep -roh 'DEBUG:![01]' dist/chrome dist/firefox | sort | uniq -c
          4 DEBUG:!0

`!1` is minified `false`, `!0` is `true`. Also checked the fail-safe path:
`AUTISTMASK_DEBUG=true make build` prints `Build mode: release (DEBUG off)` and
likewise yields `4 DEBUG:!1`.

One thing a reviewer should know about the grep: the `DEBUG_MNEMONIC` string
literal is still present in the release bundle. That is not a leak of anything
(the phrase is in this public repo already) and it does not mean the branch is
live — esbuild cannot tree-shake a CommonJS `module.exports` object, so the
constant survives while `DEBUG` folds to `false`. The compiled function is
`function PL(){return ML?UL:f_.fromEntropy(globalThis.crypto.getRandomValues(new Uint8Array(16))).phrase}`
where `ML` is the `DEBUG:!1` export. So "the phrase string is absent" is *not*
the right test for a release build; "the exported `DEBUG` is `!1`" is, which is
what I checked.

## `TODO.md` refresh

Per the manager comment: Status rewritten (no branch in flight —
`feat/issue-144-settings-about` landed as #145, scripts-to-rule-them-all landed
as #148, so the `scripts/` question is resolved; `make check` recorded as
verified green on `main` at `23aeae4`); the completed "Verify main passes make
check" Future Step removed; Future Steps rewritten against the #149-#168
backlog in rough priority order, keeping branch pruning (now #167) and the
pre-1.0 security review (noting #149 and #157 are parts of it but it is
broader).

One deliberate deviation to flag rather than bury: the manager asked that Next
Step become this issue. Taken literally against the Workflow section, this
commit *completes* #149, which would normally move it into Completed Steps. I
followed the repo's existing convention for in-flight work instead — the
previous Next Step was phrased as "Land feat/issue-144-settings-about", so Next
Step is now "Land #149 ... PR open, awaiting review", which is accurate until
this merges. Whoever merges should move it to Completed Steps and promote the
first Future Step. Happy to change it if the reviewer prefers the strict
reading.

## Out of scope

`script/lint` being `prettier --check` only and unable to catch undefined
identifiers (#152) — noted in the TODO but not fixed here; I greped for `DEBUG`
consumers by hand rather than relying on lint, as advised. Nothing else in the
DEBUG consumer set (`log.js`, `helpers.js`, `state.js`, `settings.js`) changed
behavior.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #169
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
+.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build build-debug clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -37,7 +37,6 @@ hooks:
 build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
-	@script/verify-build
 
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
@@ -45,12 +44,6 @@ build:
 build-debug:
 	@echo "Building extension (DEBUG)..."
 	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
-	@AUTISTMASK_DEBUG=1 script/verify-build
-
-# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
-# the end of build and build-debug; separate target for re-running it alone.
-verify-build:
-	@script/verify-build
 
 clean:
 	@rm -rf dist/

README.md

@@ -59,13 +59,6 @@ behavior. The build prints which mode it used. See the
 distribute a debug build** — every wallet it creates gets the same publicly
 known test recovery phrase.
 
-Both builds end by running `script/verify-build`, which reads the compiled
-`DEBUG` state back out of the emitted bundles and fails the build if it is not
-the one that was asked for. The test suite cannot check this: it loads
-`src/shared/constants.js` outside a bundle, so it only ever sees the fallback
-value. The assertion is on the artifacts because that is where the property
-lives.
-
 ## Entrypoints
 
 This repository adheres to the
@@ -84,12 +77,6 @@ provide:
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
-- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
-  `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
-  off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
-  `make build` and `make build-debug`; fails loudly rather than passing if it
-  cannot determine a bundle's state. Not part of `make check`, which does not
-  depend on build artifacts existing.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`

TODO.md

@@ -27,10 +27,6 @@ review.
 
 # Completed Steps
 
-- 2026-08-09: Post-build assertion that every emitted bundle containing
-  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
-  `make build` path (#170). Branched from `fix/issue-149-debug-build-flag`;
-  merge after #169.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
   (#149-#168).
 - 2026-07-26: About well in settings with build info, repo link and the version

build.js

@@ -3,43 +3,14 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
 
-const DIST = path.join(__dirname, "dist");
+const DIST_CHROME = path.join(__dirname, "dist", "chrome");
-const DIST_CHROME = path.join(DIST, "chrome");
+const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
-const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 
-// The module whose compiled DEBUG state script/verify-build asserts, and the
-// manifest naming every emitted bundle that ends up containing it. The
-// manifest is derived from esbuild's own dependency graph rather than from a
-// hardcoded list, so it tracks the bundle layout instead of rotting with it.
-const AUDITED_MODULE = "src/shared/constants.js";
-const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
-
 function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
 }
 
-// Repo-relative, forward-slashed, so the manifest reads the same on every
-// platform and can be consumed by a POSIX shell script without further work.
-function repoRelative(p) {
-    return path.relative(__dirname, p).split(path.sep).join("/");
-}
-
-// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
-// reports every input that contributed to an output in the metafile, which is
-// the authoritative answer to "is constants.js in this bundle" — unlike
-// searching the minified text, it does not depend on what survived minification.
-function outputsContainingAuditedModule(metafile) {
-    return Object.entries(metafile.outputs)
-        .filter(([outFile, info]) => {
-            if (!outFile.endsWith(".js")) return false;
-            return Object.keys(info.inputs).some(
-                (input) => repoRelative(input) === AUDITED_MODULE,
-            );
-        })
-        .map(([outFile]) => repoRelative(outFile));
-}
-
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
@@ -101,70 +72,68 @@ async function build() {
         __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
     };
 
-    // Emitted bundles that contain constants.js, accumulated across every
-    // esbuild run below and written out for script/verify-build.
-    const auditedBundles = [];
-
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(DIST, "styles.css");
+    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
-    ensureDir(DIST);
+    ensureDir(path.join(__dirname, "dist"));
-
-    // Drop any manifest from a previous build before emitting anything, so a
-    // build that never gets around to writing one cannot be verified against
-    // a stale list.
-    fs.rmSync(BUNDLE_MANIFEST, { force: true });
     execSync(
         `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
         { stdio: "inherit" },
     );
 
-    // Every bundle goes through here, so metafile collection cannot be
-    // forgotten when a new entry point is added.
-    async function bundle(entryPoint, outfile) {
-        const result = await esbuild.build({
-            entryPoints: [entryPoint],
-            bundle: true,
-            format: "iife",
-            outfile,
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            metafile: true,
-            define,
-        });
-        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
-    }
-
     for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
         ensureDir(path.join(distDir, "src", "popup"));
         ensureDir(path.join(distDir, "src", "background"));
         ensureDir(path.join(distDir, "src", "content"));
 
         // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "popup", "index.js"),
+            entryPoints: [path.join(SRC, "popup", "index.js")],
-            path.join(distDir, "src", "popup", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
+            outfile: path.join(distDir, "src", "popup", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            define,
+        });
 
         // bundle background script
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "background", "index.js"),
+            entryPoints: [path.join(SRC, "background", "index.js")],
-            path.join(distDir, "src", "background", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
+            outfile: path.join(distDir, "src", "background", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            define,
+        });
 
         // bundle content script
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "content", "index.js"),
+            entryPoints: [path.join(SRC, "content", "index.js")],
-            path.join(distDir, "src", "content", "index.js"),
+            bundle: true,
-        );
+            format: "iife",
+            outfile: path.join(distDir, "src", "content", "index.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            define,
+        });
 
         // bundle inpage script (injected into page context, separate file)
-        await bundle(
+        await esbuild.build({
-            path.join(SRC, "content", "inpage.js"),
+            entryPoints: [path.join(SRC, "content", "inpage.js")],
-            path.join(distDir, "src", "content", "inpage.js"),
+            bundle: true,
-        );
+            format: "iife",
+            outfile: path.join(distDir, "src", "content", "inpage.js"),
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            define,
+        });
 
         // copy popup HTML
         fs.copyFileSync(
@@ -189,16 +158,6 @@ async function build() {
         path.join(DIST_FIREFOX, "manifest.json"),
     );
 
-    // Written last so a build that died partway through leaves no manifest
-    // at all, which script/verify-build treats as a hard failure rather than
-    // as "nothing to check".
-    const manifest = [...new Set(auditedBundles)].sort();
-    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
-    console.log(
-        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
-            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
-    );
-
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
 

script/verify-build

@@ -1,136 +0,0 @@
-#!/bin/sh
-# script/verify-build: assert the compiled DEBUG state of the emitted
-# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
-# make build / make build-debug.
-#
-# Why this exists: DEBUG makes the publicly committed test recovery phrase the
-# output of wallet creation, so a release artifact built with it live hands
-# every new wallet to anyone who reads the repo. The test suite cannot see
-# this, because it loads src/shared/constants.js outside a bundle and takes
-# the fallback branch; the property only exists in the emitted output, so it
-# has to be asserted against the emitted output.
-#
-# What it reads: dist/constants-bundles.txt, written by build.js from
-# esbuild's metafile, naming every emitted bundle that contains
-# src/shared/constants.js. Each of those must carry exactly one of the two
-# BUILD_DEBUG_MARKER literals that constants.js folds down to.
-#
-# It fails rather than passes whenever it cannot determine a bundle's state.
-# Minified output is not a stable contract, so "matched neither form" is not
-# evidence of anything and must never read as green.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-MANIFEST="dist/constants-bundles.txt"
-MARKER_ON="autistmask-build-debug=on"
-MARKER_OFF="autistmask-build-debug=off"
-
-# Set by read_marker.
-MARKER=""
-
-fail() {
-    echo "verify-build: FAIL: $*" >&2
-    exit 1
-}
-
-has_marker() {
-    grep -q -F "$1" "$2" 2>/dev/null
-}
-
-# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
-# present. Both means the ternary in constants.js was never folded, which is
-# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
-# DEBUG stops being known at build time and the debug branch is live again.
-# Neither means we are reading output we do not understand. Both are hard
-# failures; neither is ever treated as absence of a problem.
-read_marker() {
-    _file="$1"
-    _on=no
-    _off=no
-    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
-    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
-
-    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
-        fail "$_file carries both debug markers, so the build-time DEBUG value
-    was never resolved and the debug branch is still live. Check that build.js
-    still defines __BUILD_DEBUG__."
-    fi
-    if [ "$_on" = no ] && [ "$_off" = no ]; then
-        fail "$_file carries no debug marker, so its DEBUG state cannot be
-    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
-    or the emitted output changed shape. Refusing to report success."
-    fi
-
-    if [ "$_on" = yes ]; then
-        MARKER="$MARKER_ON"
-    else
-        MARKER="$MARKER_OFF"
-    fi
-}
-
-# The manifest says which bundles must carry a marker. This says no other
-# emitted bundle may carry one, which catches a manifest that has gone stale
-# or short rather than trusting whatever it happens to list.
-check_unlisted_bundles() {
-    _listing="$(find dist -type f -name '*.js' | sort)"
-    while read -r _file; do
-        [ -n "$_file" ] || continue
-        if grep -q -x -F "$_file" "$MANIFEST"; then
-            continue
-        fi
-        if has_marker "$MARKER_ON" "$_file" ||
-            has_marker "$MARKER_OFF" "$_file"; then
-            fail "$_file carries a debug marker but is absent from $MANIFEST,
-    so the manifest no longer describes the emitted bundles."
-        fi
-    done <<EOF
-$_listing
-EOF
-}
-
-# The requested mode, read from our own environment using build.js's exact
-# rule: only the literal 1 opts in. Deliberately not taken from anything
-# build.js records about itself, so build.js cannot vouch for build.js.
-expected_marker() {
-    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
-        echo "$MARKER_ON"
-    else
-        echo "$MARKER_OFF"
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    expected="$(expected_marker)"
-    echo "Verifying emitted bundles (expecting $expected)..."
-
-    [ -f "$MANIFEST" ] ||
-        fail "$MANIFEST is missing. build.js writes it at the end of a
-    successful build; run make build first."
-    [ -s "$MANIFEST" ] ||
-        fail "$MANIFEST is empty, so no emitted bundle was found to contain
-    src/shared/constants.js. That is never correct, so it is a failure and not
-    a pass."
-
-    count=0
-    while read -r file; do
-        [ -n "$file" ] || continue
-        [ -f "$file" ] ||
-            fail "$MANIFEST lists $file, which does not exist."
-        read_marker "$file"
-        [ "$MARKER" = "$expected" ] ||
-            fail "$file is $MARKER but this build expects $expected."
-        echo "  ok: $file ($MARKER)"
-        count=$((count + 1))
-    done <"$MANIFEST"
-
-    [ "$count" -gt 0 ] || fail "no bundles were inspected."
-
-    check_unlisted_bundles
-
-    echo "verify-build: $count bundle(s) verified $expected"
-}
-
-main "$@"

src/shared/constants.js

@@ -7,21 +7,6 @@
 /* global __BUILD_DEBUG__ */
 const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
 
-// Machine-readable record of the compiled DEBUG state, read out of the emitted
-// bundles by script/verify-build. It is derived from DEBUG itself so the two
-// cannot disagree, and it is a plain string literal rather than a minifier
-// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
-// staying byte-stable across versions.
-//
-// The ambiguity is the point. When DEBUG is known at build time the bundler
-// folds this to exactly one of the two literals. When it is not — which is
-// exactly what happens if the __BUILD_DEBUG__ define goes missing from
-// build.js — the ternary survives, both literals appear in the bundle, and
-// verify-build fails rather than guessing.
-const BUILD_DEBUG_MARKER = DEBUG
-    ? "autistmask-build-debug=on"
-    : "autistmask-build-debug=off";
-
 const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 
@@ -59,7 +44,6 @@ function isBurnAddress(address) {
 
 module.exports = {
     DEBUG,
-    BUILD_DEBUG_MARKER,
     DEBUG_MNEMONIC,
     ETHEREUM_MAINNET_CHAIN_ID,
     ETHEREUM_SEPOLIA_CHAIN_ID,

tests/constants.test.js

@@ -1,6 +1,4 @@
 const {
-    DEBUG,
-    BUILD_DEBUG_MARKER,
     ETHEREUM_MAINNET_CHAIN_ID,
     DEFAULT_RPC_URL,
     BIP44_ETH_PATH,
@@ -21,24 +19,6 @@ describe("constants", () => {
         expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
     });
 
-    // This does not replace script/verify-build, which is the only thing that
-    // can see the compiled DEBUG state of a real bundle. It pins the source
-    // invariant that the marker tracks DEBUG, so the two cannot be edited
-    // apart and leave verify-build asserting something that is no longer the
-    // flag the code branches on.
-    test("build debug marker is derived from DEBUG", () => {
-        expect(BUILD_DEBUG_MARKER).toBe(
-            DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
-        );
-    });
-
-    // Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
-    // must be the safe one.
-    test("DEBUG is off when loaded outside a bundle", () => {
-        expect(DEBUG).toBe(false);
-        expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
-    });
-
     test("exports ERC-20 ABI with expected functions", () => {
         expect(Array.isArray(ERC20_ABI)).toBe(true);
         expect(ERC20_ABI.length).toBeGreaterThan(0);