fix: correct verify-build diagnostics and close two robustness gaps (closes #180)

The both-markers diagnostic claimed the debug branch was still live. It is
not: with the __BUILD_DEBUG__ define removed, the emitted bundle carries
`typeof __BUILD_DEBUG__<"u"?__BUILD_DEBUG__:!1`, and in extension context the
identifier is undeclared, so DEBUG evaluates to false at runtime. The message
now states what the check does prove -- DEBUG was not resolved at build time,
so the release/debug distinction is no longer enforced and which way the
unresolved fallback evaluates is an accident a refactor can flip -- and it
remains a hard failure. The other seven failure messages were reviewed and
none needed rewording.

has_marker no longer swallows grep's exit 2 with 2>/dev/null. Match and
no-match are answers about the emitted output; an unreadable file is not, and
is now reported as a permissions or I/O fault instead of as "the emitted
output changed shape". Both paths still fail hard.

The unlisted-bundle scan no longer filters by extension, so the endsWith(".js")
test in build.js is the only place that assumption lives. A bundle emitted
under another extension previously escaped the manifest and the cross-check at
once; it now fails as unlisted. Both sites carry a comment naming the other.

Also: the manifest must be readable and a listed bundle must be non-empty,
so a vacuous input fails loudly rather than reaching a marker check that
cannot prove anything.

TODO.md

@@ -49,6 +49,9 @@ undefined identifiers, which is how
   diagnosed as an I/O fault rather than as changed output, and the `*.js`
   assumption lives only in `build.js`
   ([#180](https://git.eeqj.de/sneak/AutistMask/issues/180)).
+- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
+  all five network destinations documented, password/Settings/Add Wallet
+  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
 - 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
   remaining wallets, the selection only moves when it was deleted, and the
   active-address change is broadcast to connected sites

docs/README.md

@@ -6,10 +6,10 @@ and ERC-20 tokens, and connects to web3 sites. Nothing else.
 
 ## Why AutistMask Exists
 
-MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
+The most popular browser-based EVM wallet has become bloated with swap UIs,
-tracking, and advertisements. It is no longer a simple wallet. Most alternatives
+portfolio dashboards, analytics, tracking, and advertisements. It is no longer a
-(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
+simple wallet. The common alternatives only support Chromium browsers, leaving
-without a usable option.
+Firefox users without a usable option.
 
 AutistMask exists because a wallet should be a wallet. You should be able to see
 your balances, send tokens, receive tokens, and connect to sites. That is all a
@@ -27,9 +27,10 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **Encrypt your recovery phrase and private keys at rest.** Your secrets are
   encrypted on disk using Argon2id key derivation and XSalsa20-Poly1305
-  authenticated encryption (via libsodium). Your password is required only when
+  authenticated encryption (via libsodium). Your password is required whenever a
-  signing a transaction. Viewing balances and addresses never requires a
+  secret has to be decrypted: signing a transaction, signing a message or typed
-  password.
+  data, exporting a private key, and deleting a wallet. Viewing balances and
+  addresses never requires a password.
 
 - **Let you choose your own RPC endpoint.** The default is a public Ethereum
   RPC, but you can point it at your own node or any provider you trust. No
@@ -56,23 +57,25 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No token auto-discovery.** AutistMask does not scan the blockchain for
+- **No third-party token list APIs.** Token balances come from the same block
-  tokens you might hold. You add tokens manually by contract address. This
+  explorer you configure for transaction history, and the extension ships its
-  prevents scam tokens from appearing in your wallet uninvited.
+  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
+  detection. Any token you want tracked across all your addresses, you add
+  yourself by contract address.
 
-- **No phishing blocklists from third parties.** AutistMask does not phone home
+- **No backend servers operated by the developer.** Nothing is sent to any
-  to check URLs against a remote blocklist. It does maintain a local list of
+  server run by AutistMask. Every network destination is listed below.
-  known scam addresses, but this is shipped with the extension, not fetched from
-  a server.
 
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with three external services:
+not have a backend server. It communicates with five external destinations:
+three you configure yourself, and two fixed ones used for scam detection.
 
 ### External Services
 
-**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`)
+**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`;
+`ethereum-sepolia-rpc.publicnode.com` on Sepolia)
 
 This is how AutistMask talks to the Ethereum network. Every wallet needs an
 Ethereum node to check balances, estimate gas, broadcast transactions, and
@@ -80,27 +83,73 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-What gets sent: standard Ethereum JSON-RPC requests (balance queries,
+When it is contacted: on every balance refresh (every 10 seconds while the popup
-transaction broadcasts, gas estimates, ENS lookups). Your addresses are
+is open, every 60 seconds in the background), when you type an ENS name into the
-necessarily visible to the RPC provider when querying balances.
+Send screen, when a send is prepared and broadcast, while a pending transaction
+is polled for its receipt, and for the reverse ENS lookups used to label
+addresses (cached for 12 hours).
 
-**Blockscout API** (default: `eth.blockscout.com/api/v2`)
+What gets sent: standard Ethereum JSON-RPC requests (balance queries,
+transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
+addresses are necessarily visible to the RPC provider when querying balances.
+
+**Blockscout API** (default: `eth.blockscout.com/api/v2`;
+`eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
 Used to fetch token balances and transaction history. Blockscout is an
 open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances and recent transactions. You can change this in Settings to a
+balances (including the holder counts used for spam filtering) and your recent
+transactions and token transfers. You can change this in Settings to a
 self-hosted Blockscout instance.
 
+When it is contacted: on every balance refresh, and whenever a screen showing
+transaction history is opened.
+
 What gets sent: your Ethereum addresses (to look up balances and transactions).
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
-Used to fetch current USD prices for ETH and ERC-20 tokens. Prices are cached
+Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
-for 5 minutes. No API key is required. No user data is sent -- only a list of
+cached for 5 minutes. No API key is required. This endpoint is not
-token symbols (e.g. "ETH", "USDC") to get their prices.
+user-configurable, and it is not contacted at all while you are on a testnet,
+where no USD values are shown.
 
-What gets sent: token symbol names. No addresses, no balances, no identifying
+When it is contacted: while the popup is open, at most once every 5 minutes.
-information.
+
+What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
+balances, no identifying information. As with any request, CoinDesk sees your IP
+address.
+
+**Phishing domain blocklist** (`raw.githubusercontent.com`)
+
+A community-maintained list of phishing domains, used to warn you when a site
+that asks to connect, or to have a transaction or signature approved, is a known
+scam. A copy is bundled into the extension at build time, so the protection
+works before any network request happens. At runtime the extension fetches the
+live list to pick up newly added domains, keeping only the entries not already
+in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
+user-configurable.
+
+When it is contacted: once when the background script starts, and every 24 hours
+after that. It is a plain download of a public file — nothing about you is sent,
+but the host sees your IP address. If the fetch fails, the bundled copy is still
+used.
+
+**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
+
+When you review a send, AutistMask fetches the recipient's public Etherscan
+address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
+warning, and shows a red warning if it finds one. This is a plain page fetch
+with no API key, made by your browser. It is best-effort: if it fails, it is
+silently ignored. This endpoint is not user-configurable.
+
+When it is contacted: each time you reach the send confirmation screen.
+
+What gets sent: the recipient address you are about to send to, and your IP
+address. Your own addresses are not sent.
+
+Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
+contracts) are ordinary links. They contact nothing until you click them.
 
 ### What Stays Local
 
@@ -123,8 +172,11 @@ word recovery phrase can restore your wallet on any device without your
 password. The password only protects the copy stored in this browser. If you
 lose your recovery phrase, your password cannot help you recover it.
 
-Your password is only requested when you send a transaction. Viewing balances,
+Your password is requested whenever an encrypted secret must be decrypted: when
-receiving funds, and browsing transaction history never require your password.
+you send a transaction, when a site asks you to sign a message or typed data,
+when you export an address's private key, and when you delete a wallet. Viewing
+balances, receiving funds, and browsing transaction history never require your
+password.
 
 ## Installation
 
@@ -147,34 +199,46 @@ receiving funds, and browsing transaction history never require your password.
 ### Creating a New Wallet
 
 1. Click the AutistMask icon in your browser toolbar.
-2. Click "Add wallet".
+2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
-3. Click the die button to generate a random 12-word recovery phrase.
+3. On the "From Phrase" tab, click the die button to generate a random 12-word
+   recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
    words can take your funds. If you lose them, your wallet is gone. AutistMask
    cannot recover them for you.
-5. Choose a password. This encrypts your recovery phrase on this device.
+5. Choose a password and confirm it. This encrypts your recovery phrase on this
-6. Click "Add".
+   device.
+6. Click "Import".
 
 ### Importing an Existing Wallet
 
-**From a recovery phrase:** Follow the same steps as creating a wallet, but
+The Add Wallet screen has three tabs:
-paste your existing 12 or 24 word recovery phrase instead of generating a new
-one. AutistMask uses the same derivation path as MetaMask (`m/44'/60'/0'/0`), so
-your addresses will match.
 
-**From a private key:** On the Add Wallet screen, click "Have a private key
+**From Phrase:** Paste your existing 12 or 24 word recovery phrase instead of
-instead?" and paste your private key. This creates a single-address wallet.
+generating a new one. AutistMask uses the standard BIP-44 Ethereum derivation
+path (`m/44'/60'/0'/0`), which is what other wallets use by default, so your
+addresses will match and your phrase stays portable in both directions.
+
+**From Key:** Paste a single private key. This creates a single-address wallet.
+
+**From xprv:** Paste an extended private key. This imports the HD wallet and
+scans for used addresses.
+
+All three tabs ask for the same password fields, and the "Import" button
+finishes the job.
 
 ### Adding More Addresses
 
-HD wallets (created from a recovery phrase) can derive multiple addresses. On
+HD wallets (created from a recovery phrase or an xprv) can derive multiple
-the home screen, click the "+" button next to a wallet name to add the next
+addresses. On the home screen, click the "+" button next to a wallet name to add
-address. These are deterministic -- the same recovery phrase will always produce
+the next address. These are deterministic -- the same recovery phrase will
-the same sequence of addresses.
+always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-AutistMask does not auto-discover tokens. To track a token:
+Tokens you hold show up automatically only if they are in the extension's
+bundled list of well-known tokens or have at least 1,000 holders; everything
+else is treated as spam and hidden. To track a token explicitly (which also
+shows it at zero balance), add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -183,12 +247,13 @@ AutistMask does not auto-discover tokens. To track a token:
 4. Click "Add".
 
 The token balance will appear on the address detail screen and on the home
-screen.
+screen. Tokens can also be added from Settings, under "Tracked Tokens".
 
 ## Sending
 
 1. Click "Send" from the home screen or an address detail view.
-2. Select what to send (ETH or any tracked ERC-20 token).
+2. Select what to send (ETH, or any ERC-20 token with a balance on this address
+   that survives the spam filters).
 3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
 4. Enter the amount.
 5. Click "Review" to see the confirmation screen.
@@ -201,11 +266,14 @@ The confirmation screen shows:
 - **Amount** with USD estimate
 - **Your current balance** with USD estimate
 - **Estimated network fee** in ETH with USD estimate
+- **Warnings** if the recipient is a contract, a burn address, one of your own
+  addresses, on the bundled scam-address list, or labelled as a phisher on
+  Etherscan
 
-After reviewing, click "Send" and enter your password. The transaction will be
+After reviewing, enter your password and click "Sign & Send". The transaction
-broadcast to the network and you will see a waiting screen with a timer. Once
+will be broadcast to the network and you will see a waiting screen with a timer.
-confirmed (or after 60 seconds), you will see either a success or error screen
+Once confirmed (or after 60 seconds), you will see either a success or error
-with the transaction hash and an Etherscan link.
+screen with the transaction hash and an Etherscan link.
 
 ### Sending a Specific Token
 
@@ -219,10 +287,10 @@ cannot accidentally switch to a different one.
 1. Click "Receive" from the home screen or an address detail view.
 2. Share the QR code or copy the address using the "Copy address" button.
 
-When receiving ERC-20 tokens, make sure the sender is sending on the Ethereum
+When receiving ERC-20 tokens, make sure the sender is sending on the network you
-network. AutistMask is an Ethereum mainnet wallet. Tokens sent on other networks
+are using. AutistMask supports Ethereum mainnet and the Sepolia testnet. Tokens
-(Polygon, Arbitrum, BSC, etc.) to the same address will not appear and may be
+sent on other networks (Polygon, Arbitrum, BSC, etc.) to the same address will
-permanently lost.
+not appear and may be permanently lost.
 
 ## Connecting to Web3 Sites
 
@@ -237,7 +305,12 @@ pages. When a site requests access to your wallet:
 
 When a connected site requests a transaction, a separate approval popup appears
 showing the transaction details (from, to, value, data). You must enter your
-password and click "Confirm" to authorize it.
+password and click "Confirm" to authorize it. Message and typed-data signature
+requests work the same way, with a "Sign" button, and also require your
+password.
+
+If the requesting site's domain is on the phishing blocklist, all three approval
+screens show a red phishing warning before you decide.
 
 You can manage site permissions in Settings. Allowed and denied sites can be
 individually removed to reset their permissions.
@@ -247,15 +320,16 @@ individually removed to reset their permissions.
 AutistMask includes several defenses against common Ethereum scams, all enabled
 by default:
 
-**Known token symbol verification.** AutistMask ships a list of ~250 legitimate
+**Known token symbol verification.** AutistMask ships a list of roughly 500
-ERC-20 tokens with their contract addresses. If a transaction claims to involve
+legitimate ERC-20 tokens with their contract addresses. If a transaction or
-a known symbol (like "ETH" or "USDT") but comes from an unrecognized contract,
+balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
-it is identified as a spoof and hidden.
+an unrecognized contract, it is identified as a spoof and hidden.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
-from transaction history and the send token list. Legitimate tokens have
+from transaction history and the send token list, and are left out of your
-substantial holder counts; scam tokens deployed for address poisoning typically
+balances unless they are on the bundled known-token list or you added them
-have zero.
+yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
+for address poisoning typically have zero.
 
 **Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
 adds the contract address to a local blocklist. Future transactions from that
@@ -266,31 +340,47 @@ ETH by default) are hidden. Scammers send dust from look-alike addresses to
 plant them in your transaction history. The threshold is configurable in
 Settings.
 
-All of these filters can be individually disabled in Settings if you prefer to
+**Scam address list.** A list of known fraud, drainer, and phishing addresses is
+shipped with the extension. Sending to one of them raises a warning on the
+confirmation screen. It contains only addresses involved in fraud -- it is not a
+sanctions list.
+
+**Phishing domain warnings.** Sites asking to connect or to have something
+approved are checked against the phishing domain blocklist described under
+External Services, and flagged with a red banner if they match.
+
+The first four filters can be individually disabled in Settings if you prefer to
 see everything unfiltered.
 
 ## Settings
 
 Click the gear icon on the home screen to access settings:
 
-- **Wallets**: Add a new wallet.
+- **Wallets**: Your wallets, and "+ Add wallet".
-- **Display**: Toggle whether tracked tokens with zero balance are shown.
+- **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
+  token".
+- **Display**: Toggle whether tracked tokens with zero balance are shown, and
+  choose the theme (System, Light, or Dark).
+- **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
+  resets the RPC and Blockscout endpoints to that network's defaults.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and
   transaction history. You can use a self-hosted instance.
-- **Token Spam Protection**: Toggle individual scam filters and set the dust
+- **Token Spam Protection**: Toggle individual scam filters, set the dust
-  transaction threshold.
+  transaction threshold, and switch timestamps to UTC.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
+- **About**: License, author, version, release date, and a link to the commit
+  this build came from.
 
 ## Frequently Asked Questions
 
-**Is AutistMask compatible with MetaMask?**
+**Can I use AutistMask alongside another wallet?**
 
-Yes. AutistMask uses the same derivation path (`m/44'/60'/0'/0`) as MetaMask. If
+Yes. AutistMask uses the standard `m/44'/60'/0'/0` derivation path, so importing
-you import the same recovery phrase, you will get the same addresses. You can
+the same recovery phrase gives you the same addresses as any other wallet using
-use both wallets side by side, though only one can be the active
+that path. Two wallet extensions can be installed side by side, though only one
-`window.ethereum` provider at a time.
+can be the active `window.ethereum` provider at a time.
 
 **Can I use AutistMask with a hardware wallet?**
 
@@ -298,8 +388,9 @@ Not yet. Hardware wallet support may be added in the future.
 
 **Does AutistMask support networks other than Ethereum mainnet?**
 
-Not currently. AutistMask is Ethereum mainnet only. Multi-chain support may be
+Ethereum mainnet and the Sepolia testnet, selectable in Settings. No other
-added in the future.
+networks are supported today. On Sepolia, USD values are not shown, because
+testnet tokens have no market value.
 
 **Where is my data stored?**
 
@@ -312,7 +403,7 @@ to any server operated by AutistMask.
 
 Your data is deleted. Make sure you have your recovery phrase backed up before
 uninstalling. With your recovery phrase, you can restore your wallet in
-AutistMask or any other compatible wallet (MetaMask, etc.) at any time.
+AutistMask or any other wallet that uses the standard derivation path.
 
 **What happens if a transaction times out?**