refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)

Every call site that touched `browser.*` or `chrome.*` now goes through
`src/shared/browserApi.js`, the only file in the tree that names either.
It exposes lazily-resolved namespace handles for events and synchronous
methods, and promise-returning wrappers for everything that is
callback-shaped on Chrome. Callers await; `runtime.lastError` is gone,
folded into the rejection the wrapper produces on the Chrome path.

`storageGet()` and `storageSet()` reject where `storage.local` is
absent. They carry the wallet: resolving `{}` would make an existing
wallet read back as no wallet, and a no-op write would discard the
user's state with nothing logged. The one caller that genuinely
degrades, `src/shared/phishingDomains.js`, takes `storageLocal()`
directly and keeps its own null check.

The Firefox suite gains the four dApp round trips the issue's definition
of done asks for — `eth_requestAccounts`, `personal_sign`,
`eth_sendTransaction`, and a closed approval window rejecting with
EIP-1193 4001 — driven through the real content script, background page
and approval windows. `--network none` was thought to rule that out
because it leaves no `http://` origin to inject into; loopback survives
it, so the page and a JSON-RPC node are served from 127.0.0.1 inside the
container and the run still reaches nothing but itself.

That harness refutes the premise it was built to verify. On Firefox
153.0.3, `browser.*` honours a trailing Chrome-style callback and does
populate `runtime.lastError`, both measured directly, and all four flows
pass against the unconverted code. So this is a uniformity and coverage
change, not a repair of a broken target; the PR records the measurement
in full, and the comments in `browserApi.js` and the Firefox suite say
that rather than the refuted claim.

An unhandled promise rejection fails a run on both harnesses, measured
by throwing past the first await of the unawaited `approval.show()`:
Firefox reports it from the console-service drain and Chrome as a
`pageerror`. README.md records the demonstration.

One real defect is fixed on the way past: the window id written back
into a pending approval after `windows.create()` was unguarded, so an
approval settled during the open — an address switch will do it —
dereferenced a deleted entry.

README.md

@@ -240,10 +240,18 @@ and this suite exists because exactly that class of bug shipped twice.
 
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
 real Firefox**, installed as an unpacked MV2 temporary add-on via geckodriver.
-It covers popup load, wallet creation through the UI, and the Add Token screen.
-The suite lives in `tests/e2e/firefox/` and has **no npm dependencies at all**:
-it is a small WebDriver client built on global `fetch` and `child_process`
-against geckodriver's HTTP API.
+It covers popup load, wallet creation through the UI, the Add Token screen, and
+the four dApp round trips — `eth_requestAccounts`, `personal_sign`,
+`eth_sendTransaction`, and a closed approval window rejecting with EIP-1193 4001
+— driven through the real content script, background page and approval windows.
+
+The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
+**no npm dependencies at all**: it is built on global `fetch` and
+`child_process` against geckodriver's HTTP API. The dApp fixture (`dapp.js`) and
+the assertions do use `ethers`, and have to — a signature is recovered in the
+runner rather than believed from the extension, and the stub node has to answer
+`eth_sendRawTransaction` with the hash `ethers` computes for the artifact it
+sent, or `provider.broadcastTransaction()` refuses the answer.
 
 Unlike the Chrome suite it builds its own container image rather than pulling a
 published one, because no published image carries both a pinned Firefox and a
@@ -265,20 +273,39 @@ because BiDi's `browsingContext.navigate` refuses `moz-extension://` outright.
 **Any uncaught error from a `moz-extension://` source fails the run**, including
 errors from the background page, which the suite never navigates to: a `throw`
 at the top of `src/background/index.js` kills the background page and fails
-step 1. Content-script errors should arrive by the same route, but this suite
-does not exercise it and does not claim it — with `--network none` there is no
-`http://` page for a content script to be injected into. Errors from add-on
-install and background startup are folded into step 1 rather than discarded.
-Errors are read from the privileged `nsIConsoleService` in Marionette's chrome
-context and filtered to non-warning entries whose `sourceName` is the extension
-origin. That mechanism is not a stylistic choice. WebDriver BiDi's
-`log.entryAdded` delivers **nothing** for extension pages: on a plain `http://`
-page it reports uncaught errors with stack traces, and on the `moz-extension://`
-popup it reports zero events, because Firefox's remote agent excludes extension
-browsing contexts from BiDi observation. Any harness built on Playwright-BiDi or
-Puppeteer-BiDi would therefore see nothing and report success, which is exactly
-the vacuous check this repo has already shipped twice. Do not migrate this suite
-to BiDi.
+step 1. Content scripts **are** exercised now — the dApp steps drive a page
+served from loopback, which survives `--network none` — but the _capture_ of a
+content-script error by this route is still unproven: no probe has forced a
+throw inside one and watched it fail the run, so it remains an expectation
+rather than a demonstrated fact. Errors from add-on install and background
+startup are folded into step 1 rather than discarded.
+
+An **unhandled promise rejection counts as an uncaught error** on both suites,
+which matters because a good deal of popup code is now `async` and called
+without an `await`. Demonstrated, not assumed: a `throw` placed past the first
+`await` of `approval.show()` — which nothing awaits — turns the
+`eth_requestAccounts` step red on Firefox
+(`uncaught extension errors during this step`, from the console-service drain)
+and on Chrome (`pageerror`), with the rest of the run unaffected because the
+approval view had already rendered.
+
+One error is tolerated rather than fatal, listed in `ALLOWED_ERRORS` in
+`tests/e2e/firefox/run.js` with the issue that will delete it, and printed on
+every occurrence so the concession stays visible in the run output. It is
+Firefox reporting the site-approval popup's unawaited `sendMessage` settling
+after `window.close()` unloaded the context — the same teardown ordering as
+[#275](https://git.eeqj.de/sneak/AutistMask/issues/275), and unsuppressable from
+the calling code, because `BaseContext.wrapPromise` reports it whether or not a
+handler is attached. Errors are read from the privileged `nsIConsoleService` in
+Marionette's chrome context and filtered to non-warning entries whose
+`sourceName` is the extension origin. That mechanism is not a stylistic choice.
+WebDriver BiDi's `log.entryAdded` delivers **nothing** for extension pages: on a
+plain `http://` page it reports uncaught errors with stack traces, and on the
+`moz-extension://` popup it reports zero events, because Firefox's remote agent
+excludes extension browsing contexts from BiDi observation. Any harness built on
+Playwright-BiDi or Puppeteer-BiDi would therefore see nothing and report
+success, which is exactly the vacuous check this repo has already shipped twice.
+Do not migrate this suite to BiDi.
 
 Two limits are worth knowing, both real differences from the Chrome suite:
 
@@ -302,17 +329,19 @@ Two limits are worth knowing, both real differences from the Chrome suite:
   but a step that logs heavily could evict unread errors. What poll-based costs
   is location, not coverage: an error cannot be placed within a step the way the
   Chrome suite's `pageerror` events place it.
-- **Nothing is stubbed, which inverts the coverage of network-dependent code.**
-  There is no fixture layer; the container runs with `--network none` instead,
-  so the run is offline and deterministic and no request can escape. The
-  extension swallows its own fetch failures, so the flows are unaffected — but
-  every network call fails, so only the _failure_ branches of code that depends
-  on one are ever executed. A `ReferenceError` in the success path of
-  `renderTransactions`, or of price or balance rendering, passes this suite
-  green. The offline run is also weaker than the Chrome suite's interception: it
-  proves nothing got out, but it cannot report which requests were attempted.
-  Closing that gap needs a fixture layer, deliberately out of scope for this
-  harness.
+- **Almost nothing is stubbed, which inverts the coverage of network-dependent
+  code.** The container still runs with `--network none`, so the run is offline
+  and no request can escape. The one thing it can reach is the loopback fixture
+  in `tests/e2e/firefox/dapp.js`, which serves the dApp page and a JSON-RPC node
+  and which the extension's `rpcUrl` is pointed at for the dApp steps; a
+  JSON-RPC method that fixture does not model fails the run rather than
+  answering `null`. Everything else — Blockscout, the price feed, the phishing
+  blocklist — has no fixture and simply fails, and the extension swallows its
+  own fetch failures, so only the _failure_ branches of that code are ever
+  executed. A `ReferenceError` in the success path of `renderTransactions`, or
+  of price rendering, passes this suite green. The offline run is also weaker
+  than the Chrome suite's interception for those calls: it proves nothing got
+  out, but it cannot report which requests were attempted.
 
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
@@ -538,6 +567,27 @@ Both are click-copyable. Truncating to 4 decimals in summary views is acceptable
 for scannability, but the detail view must never discard precision — it is the
 one place the user can always use to verify exact details.
 
+#### Partial USD totals
+
+Prices are fetched for the top 25 tokens only, so an address can hold assets the
+extension has no price for. Worth zero and worth an unknown amount are different
+facts and are never collapsed into one number. `getAddressValue()` in
+`src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
+holdings, and whether an unpriced holding was left out of it — and every screen
+renders it through `formatAddressTotal()`, so the wording cannot drift:
+
+- Nothing knowable (testnet, or before the first price fetch): no total line.
+- Everything priced: `Total: $5,500.00`.
+- Part priced: `Total: $3,000.00 plus unpriced tokens` — the figure is real as
+  far as it goes and is kept, named as a floor rather than the total.
+- Nothing priced but something held: `Total: unpriced tokens only`. No figure,
+  because the only figure available would be the `$0.00` sum of an empty set,
+  and on the address-removal confirmation that sits directly under "This address
+  holds a balance."
+
+The per-token balance lines are unaffected: each shows its quantity, and a USD
+column that is blank for a token with no price.
+
 #### Language & Labeling
 
 All user-facing text avoids unnecessary jargon wherever possible:
@@ -673,7 +723,9 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
 - **When**: At least one wallet exists. This is the root screen.
 - **Elements**:
     - Active address ETH balance (large) + USD value in parentheses
-    - "Total:" USD value across ETH and every token shown for the active address
+    - "Total:" USD value across ETH and every token shown for the active
+      address, written by `formatAddressTotal()` — see
+      [Partial USD totals](#partial-usd-totals)
     - Active address (color dot, full address, etherscan link, tap to copy)
     - Send / Receive quick-action buttons, both acting on the active address
     - ETH/USD price display
@@ -735,7 +787,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
     - Title: "Wallet Name — Address N"
     - ENS name (if resolved, bold above the address)
     - Full address (color dot, etherscan link, tap to copy)
-    - USD total for address
+    - USD total for address (see [Partial USD totals](#partial-usd-totals))
     - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
       places, USD inline). Each balance row is clickable → **AddressToken**
     - Send / Receive / + Token buttons and a "···" menu button
@@ -1101,11 +1153,13 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
       xprv wallet has no recovery phrase to re-import.
     - A warning when the address holds anything, ETH or any tracked ERC-20,
       followed by the holdings themselves via `balanceLinesForAddress()` and the
-      USD total via `getAddressValueUsd()`. The sentence names no figure of its
-      own: the lines round to four decimals, so a sentence built from a rounded
-      number would report `0.0000 ETH` for an address holding real money. The
-      predicate is `addressHoldsFunds()` in `src/popup/views/helpers.js`,
-      unrounded and token-aware. A balance is a warning, never a refusal.
+      USD total via `formatAddressTotal()` (see
+      [Partial USD totals](#partial-usd-totals)). The sentence names no figure
+      of its own: the lines round to four decimals, so a sentence built from a
+      rounded number would report `0.0000 ETH` for an address holding real
+      money. The predicate is `addressHoldsFunds()` in
+      `src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
+      warning, never a refusal.
     - The rule that a wallet always keeps at least one address, and that
       removing the last one means deleting the wallet from Settings
     - Error line
@@ -1175,7 +1229,11 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
   opening the window, so the screen shows a complete transaction and the signed
   artifact can be compared with it field for field. A request that cannot be
   populated — unreachable node, reverting gas estimate — opens no window and is
-  failed back to the site.
+  failed back to the site. Only one transaction approval exists at a time:
+  populating fixes the nonce, so a second `eth_sendTransaction` arriving while
+  one is unanswered is refused with EIP-1193 code `-32002` rather than being
+  populated at the same nonce. It opens no window and takes no nonce, and the
+  site can send it again once the pending one is answered.
 - **Elements**:
     - "Transaction Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing

TODO.md

@@ -45,6 +45,40 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-17: One shared extension-API module,
+  [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
+  the tree that names `browser` or `chrome`. Every call site returns a promise;
+  `runtime.lastError` is gone. The same commit gives the Firefox suite the four
+  dApp round trips — `eth_requestAccounts`, `personal_sign`,
+  `eth_sendTransaction` and a closed approval window rejecting with EIP-1193
+  4001 — against a page and a JSON-RPC node served from loopback, which survives
+  `--network none`. **The premise of
+  [#153](https://git.eeqj.de/sneak/AutistMask/issues/153) does not survive that
+  harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
+  populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
+  all four flows pass against the unconverted code. What landed is a uniformity
+  and coverage change, not a repair of a broken target. `storageGet()` and
+  `storageSet()` **reject** where `storage.local` is absent rather than
+  resolving `{}` and a no-op write — they carry the wallet, and defaulting would
+  read an existing wallet back as none. The one caller that genuinely degrades,
+  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), takes
+  `storageLocal()` directly and keeps its own null check.
+- 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
+  price. Prices exist for the top 25 tokens only, so the priced-only sum was
+  printed as the total and an address holding nothing but unpriced ERC-20s was
+  shown as worth nothing — directly under "This address holds a balance." on the
+  address-removal confirmation. `getAddressValue()` in `src/shared/prices.js`
+  now returns `{ usd, partial }`, keeping worth-zero and worth-an-unknown-amount
+  apart the way an absent `holders_count` is kept apart from a count of zero,
+  and every screen renders it through the one `formatAddressTotal()`: the figure
+  when it covers everything, the figure marked `plus unpriced tokens` when it
+  covers part, and `Total: unpriced tokens only` when it would cover nothing.
+  Home, AddressDetail and the removal confirmation all read it, and
+  `getWalletValue()`/`getTotalValue()` carry `partial` up. Covered by
+  `tests/addressValue.test.js` — the only-unpriced, genuinely-zero and
+  fully-priced cases at the helper and at both call sites that return their
+  markup — demonstrated failing first
+  ([#261](https://git.eeqj.de/sneak/AutistMask/issues/261)).
 - 2026-08-17: `README.md` no longer advertises a defect the wallet does not
   have. The End-to-End Tests section listed the EIP-1193 code being dropped in
   the last hop into the page as a standing limit of the dApp coverage; that
@@ -54,6 +88,31 @@ undefined identifiers, which is how
   stubbed RPC and the unobservable toolbar popup — were checked against the
   current `src/content/inpage.js` and `tests/e2e/` and left as they are
   ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
+- 2026-08-17: One transaction approval at a time. Populating in the background
+  before the window opens is what makes the displayed object the verified
+  object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
+  concurrently took the same nonce from a node that had seen neither broadcast,
+  and the second could then never be sent, because the only way to give it a
+  fresh nonce is to populate it again after the user has read the old one off
+  the screen. A second request is now refused with EIP-1193 `-32002` while one
+  is unanswered — the slot is taken immediately before population, after the
+  authorization checks, so no second nonce is allocated, no second window opens,
+  and a page the wallet refuses anyway cannot hold the slot against the
+  connected site. The slot is freed at `settleApproval()`, the single point an
+  approval is retired, so every path that ends an approval ends the hold with
+  it; an approval whose window is gone and whose attempt has failed is settled
+  there rather than left waiting on a window that no longer exists, and an
+  approval window that could not be opened at all is answered with `-32603`
+  instead of holding the page's promise open. Signature approvals are not gated,
+  consuming no nonce. A collision that does happen is also reported accurately
+  now: a broadcast the node refused for the nonce, and an approval carrying a
+  nonce this worker has already broadcast for that address on that chain (caught
+  before the node is asked at all), both say the transaction did not reach the
+  network and to send it again, instead of warning that it may have sent. The
+  record is keyed by chain as well as address, because nonce spaces are per
+  chain and low nonces overlap across them. `already known` deliberately keeps
+  the ambiguous wording, because a node that says it has the transaction has it
+  ([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
 - 2026-08-14: The parts of the
   [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
   [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the

src/background/index.js

@@ -24,6 +24,7 @@ const {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
+    TX_STAGE_NONCE,
 } = require("../shared/approvalVerify");
 const { prepareApprovalTx } = require("../shared/approvalTx");
 const {
@@ -39,17 +40,21 @@ const {
     registerAlarmHandlers,
 } = require("../shared/alarms");
 
-const storageApi =
-    typeof browser !== "undefined"
-        ? browser.storage.local
-        : chrome.storage.local;
-const runtime =
-    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
-const windowsApi =
-    typeof browser !== "undefined" ? browser.windows : chrome.windows;
-const tabsApi = typeof browser !== "undefined" ? browser.tabs : chrome.tabs;
-const actionApi =
-    typeof browser !== "undefined" ? browser.browserAction : chrome.action;
+const {
+    actionApi,
+    runtimeApi,
+    storageGet,
+    tabsQuery,
+    tabsSendMessage,
+    windowsApi,
+    windowsCreate,
+    windowsGetLastFocused,
+    windowsRemove,
+} = require("../shared/browserApi");
+
+const runtime = runtimeApi();
+const windowsNs = windowsApi();
+const actionNs = actionApi();
 
 // Connected sites (in-memory, non-persisted): { "origin:address": true }
 const connectedSites = {};
@@ -57,8 +62,116 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
+// One transaction approval at a time, wallet-wide.
+//
+// The transaction a site asks for is populated before its approval window
+// opens, so that the object the user is shown is the object the signed
+// artifact is verified against. Populating fixes the nonce. Two requests
+// populated concurrently therefore take the SAME nonce — the node reports the
+// same pending count to both, neither having been broadcast — and whichever is
+// broadcast second is refused by the network for a nonce it can never be
+// re-signed at, because re-signing it would mean signing something other than
+// what was displayed.
+//
+// So the second request is refused while the first is unanswered. It is
+// refused before anything is populated, so no second nonce is allocated at
+// all, and while the page is still waiting with nothing on screen. The
+// alternatives were considered and rejected in
+// https://git.eeqj.de/sneak/AutistMask/issues/271: populating again at Confirm
+// puts a nonce on screen that is not the nonce that gets signed, and
+// allocating around in-flight approvals makes the wallet's own bookkeeping the
+// authority on a nonce the network has not accepted, which an abandoned
+// approval then leaves a hole in.
+//
+// Sign approvals are not gated: a signature consumes no nonce.
+//
+// The slot is null when free, and otherwise the handle of the request holding
+// it. Once that request has raised its approval the handle carries the
+// approval's id, so that retiring the approval frees the slot: every exit from
+// pendingApprovals goes through settleApproval(), which makes that one hook
+// complete. The holder's own finally is the backstop for the interval before
+// the approval exists.
+let txApprovalSlot = null;
+
+// EIP-1474 "resource unavailable": the standard code for a request that is
+// refused because another one is already pending.
+const TX_APPROVAL_PENDING_CODE = -32002;
+
+// True at every moment this can be sent: the slot is taken immediately before
+// the transaction is populated, so the other request is either being prepared
+// or on screen. It does not claim the other one is displayed yet, because for
+// the length of one network round trip it is not.
+const TX_APPROVAL_PENDING_MESSAGE =
+    "AutistMask handles one transaction at a time, and another one is" +
+    " already in progress, so this one was not sent. Please finish that" +
+    " transaction, then send this one again.";
+
+// Take the slot, or refuse. Nothing awaits between the test and the set, so
+// two requests that reach this in the same tick cannot both pass it — the
+// position of the call in the handler is irrelevant to that, which is why it
+// sits after the authorization checks. A page the wallet is going to refuse
+// anyway must not be able to take the slot away from the connected site.
+function reserveTxApprovalSlot() {
+    if (txApprovalSlot) return null;
+    txApprovalSlot = { approvalId: null };
+    return txApprovalSlot;
+}
+
+// Free the slot, if this handle is still the one holding it.
+function releaseTxApprovalSlot(handle) {
+    if (handle && txApprovalSlot !== handle) return;
+    txApprovalSlot = null;
+}
+
+// Free the slot held on behalf of a retired approval. Called from
+// settleApproval() for every approval, and a no-op for the ones the slot was
+// not taken for.
+function releaseTxApprovalSlotFor(approvalId) {
+    if (txApprovalSlot && txApprovalSlot.approvalId === approvalId) {
+        txApprovalSlot = null;
+    }
+}
+
+// Nonces this worker has already handed to the node, per chain and address.
+// This is the wallet's own knowledge that a nonce is spent, and it is checked
+// before a broadcast rather than after: a node's pending count can lag a
+// transaction it has itself just accepted, and a request populated inside that
+// window would otherwise be signed and sent at a nonce this wallet has already
+// used.
+//
+// The chain is part of the key because nonce spaces are per chain and the
+// wallet switches networks. Without it a nonce spent on one chain would refuse
+// that nonce on every other chain — and low nonces overlap across chains as a
+// matter of course, so the refusal would be both routine and false.
+//
+// The record dies with the worker, which is correct rather than merely
+// convenient: after a restart the node's count is the only answer available,
+// and a transaction of this wallet's that the node has forgotten is one the
+// user does want to be able to send again.
+const broadcastNonces = {};
+
+function broadcastNoncesFor(chainId, address) {
+    const key =
+        String(chainId).toLowerCase() +
+        ":" +
+        String(address || "").toLowerCase();
+    if (!broadcastNonces[key]) broadcastNonces[key] = new Set();
+    return broadcastNonces[key];
+}
+
+// An approved transaction's nonce as a decimal string, or null if it cannot be
+// read as a number. Verification refuses an unreadable nonce before this is
+// ever reached; null here only keeps the record from holding junk.
+function approvedNonce(approvedTx) {
+    try {
+        return BigInt(approvedTx.nonce).toString();
+    } catch {
+        return null;
+    }
+}
+
 async function getState() {
-    const result = await storageApi.get("autistmask");
+    const result = await storageGet("autistmask");
     return (
         result.autistmask || {
             wallets: [],
@@ -122,8 +235,8 @@ async function proxyRpc(method, params) {
 }
 
 function resetPopupUrl() {
-    if (actionApi && typeof actionApi.setPopup === "function") {
-        actionApi.setPopup({ popup: "src/popup/index.html" });
+    if (actionNs && typeof actionNs.setPopup === "function") {
+        actionNs.setPopup({ popup: "src/popup/index.html" });
     }
 }
 
@@ -148,11 +261,41 @@ function settleApproval(id, result, options) {
     const holdsClaim = !!(options && options.holdsClaim);
     if (approval.attemptInFlight && !holdsClaim) return false;
     delete pendingApprovals[id];
+    // The transaction-approval slot is held for exactly as long as the
+    // approval it was taken for is alive, and this is the one place an
+    // approval stops being alive.
+    releaseTxApprovalSlotFor(id);
     approval.resolve(result);
     resetPopupUrl();
     return true;
 }
 
+// What a pending approval resolves to when it is given up on rather than
+// answered: the window was closed, or could not be opened at all. A tx or sign
+// approval answers the requesting page in EIP-1193 shape; a site-connection
+// approval answers the connection handler in its own.
+function abandonedResult(approval, code, message) {
+    if (approval.type === "tx" || approval.type === "sign") {
+        return { error: { code, message } };
+    }
+    return { approved: false, remember: false };
+}
+
+// A window the user closed without answering is a refusal by the user, which
+// is 4001 and the wording every other rejection path already uses.
+const APPROVAL_REJECTED_CODE = 4001;
+const APPROVAL_REJECTED_MESSAGE = "User rejected the request.";
+
+// The window could not be opened, so the user was never asked. This is the
+// wallet failing, not the user refusing, so it does not claim to be a
+// rejection: -32603 is the JSON-RPC code for the wallet's own internal
+// failure, and the page is told plainly that nothing was shown.
+const APPROVAL_WINDOW_FAILED_CODE = -32603;
+
+const APPROVAL_WINDOW_FAILED_MESSAGE =
+    "AutistMask could not open its approval window, so this request was not" +
+    " shown to you and nothing was sent.";
+
 // Take exclusive hold of a pending approval for one attempt, or refuse.
 //
 // An approval that failed retryably has to stay in pendingApprovals, so its
@@ -172,39 +315,96 @@ function claimApproval(approval) {
 
 // Release an approval whose attempt failed in a way the user can retry.
 // Nothing was broadcast, so the next attempt may claim it.
+//
+// Unless the window it would be retried in is already gone. The user closed it
+// while the attempt was running and settleApproval() declined then, correctly,
+// because the attempt still owned the approval; the attempt has now failed, so
+// nothing owns it and nothing can reach it. Left standing it would hold the
+// requesting page's promise open forever and, with it, the transaction
+// approval slot. It is settled here as the rejection the closed window
+// already meant.
 function releaseApproval(approval) {
     approval.attemptInFlight = false;
+    if (approval.windowClosed) {
+        settleApproval(
+            approval.id,
+            abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            ),
+        );
+    }
 }
 
 // Open approval in a separate popup window.
 // This is the primary mechanism for tx/sign approvals (triggered programmatically,
 // not from a user gesture) and the fallback for site-connection approvals.
-function openApprovalWindow(id) {
+// Never rejects. Its callers raise it from inside a Promise executor and drop
+// the result on the floor, so a rejection here would be unhandled.
+async function openApprovalWindow(id) {
     const popupUrl = runtime.getURL("src/popup/index.html?approval=" + id);
     const popupWidth = 360;
     const popupHeight = 600;
 
-    windowsApi.getLastFocused((currentWin) => {
-        const opts = {
-            url: popupUrl,
-            type: "popup",
-            width: popupWidth,
-            height: popupHeight,
-        };
-        if (currentWin) {
-            opts.left = Math.round(
-                currentWin.left + (currentWin.width - popupWidth) / 2,
-            );
-            opts.top = Math.round(
-                currentWin.top + (currentWin.height - popupHeight) / 2,
-            );
-        }
-        windowsApi.create(opts, (win) => {
-            if (win) {
-                pendingApprovals[id].windowId = win.id;
-            }
-        });
-    });
+    let currentWin = null;
+    try {
+        currentWin = await windowsGetLastFocused();
+    } catch {
+        // Nothing focused to centre on. The window still opens, at whatever
+        // position the browser picks.
+    }
+
+    const opts = {
+        url: popupUrl,
+        type: "popup",
+        width: popupWidth,
+        height: popupHeight,
+    };
+    if (currentWin) {
+        opts.left = Math.round(
+            currentWin.left + (currentWin.width - popupWidth) / 2,
+        );
+        opts.top = Math.round(
+            currentWin.top + (currentWin.height - popupHeight) / 2,
+        );
+    }
+
+    let win = null;
+    try {
+        win = await windowsCreate(opts);
+    } catch (e) {
+        // The promise namespace reports the failure by rejecting where the
+        // callback namespace reported it by handing back no window; both land
+        // on the !win branch below, which settles the approval.
+        log.errorf("could not open the approval window:", e);
+    }
+
+    const approval = pendingApprovals[id];
+    if (!approval) {
+        // Settled while the window was opening — an address switch, say.
+        // Nothing is waiting on it, and a window showing an approval that no
+        // longer exists is not left on screen. The await above makes this a
+        // real race: writing the id back would resurrect a bare entry that
+        // nothing would ever resolve.
+        if (win) windowsRemove(win.id).catch(() => {});
+        return;
+    }
+    if (!win) {
+        // No window means no way to ever answer this approval, and an
+        // approval nothing can answer holds the requesting page's promise
+        // open forever. Settle it now instead.
+        settleApproval(
+            id,
+            abandonedResult(
+                approval,
+                APPROVAL_WINDOW_FAILED_CODE,
+                APPROVAL_WINDOW_FAILED_MESSAGE,
+            ),
+        );
+        return;
+    }
+    approval.windowId = win.id;
 }
 
 // Open an approval popup and return a promise that resolves with the user decision.
@@ -212,14 +412,14 @@ function openApprovalWindow(id) {
 function requestApproval(origin, hostname) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
-        pendingApprovals[id] = { origin, hostname, resolve };
+        pendingApprovals[id] = { id, origin, hostname, resolve };
 
-        if (actionApi && typeof actionApi.openPopup === "function") {
-            actionApi.setPopup({
+        if (actionNs && typeof actionNs.openPopup === "function") {
+            actionNs.setPopup({
                 popup: "src/popup/index.html?approval=" + id,
             });
             try {
-                const result = actionApi.openPopup();
+                const result = actionNs.openPopup();
                 if (result && typeof result.catch === "function") {
                     result.catch(() => openApprovalWindow(id));
                 }
@@ -243,10 +443,13 @@ function requestApproval(origin, hostname) {
 // it is pinned here rather than read again at signing time — an address switch
 // between approval and signing must refuse, not sign from an account this
 // screen never named.
-function requestTxApproval(origin, hostname, approvedTx, approvedFrom) {
+// `slot` is the transaction-approval slot its caller holds. Handing the
+// approval's id to it is what makes retiring the approval free the slot.
+function requestTxApproval(origin, hostname, approvedTx, approvedFrom, slot) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = {
+            id,
             origin,
             hostname,
             approvedTx,
@@ -254,6 +457,7 @@ function requestTxApproval(origin, hostname, approvedTx, approvedFrom) {
             resolve,
             type: "tx",
         };
+        if (slot) slot.approvalId = id;
 
         openApprovalWindow(id);
     });
@@ -267,6 +471,7 @@ function requestSignApproval(origin, hostname, signParams, approvedFrom) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = {
+            id,
             origin,
             hostname,
             signParams,
@@ -281,7 +486,7 @@ function requestSignApproval(origin, hostname, signParams, approvedFrom) {
 
 // Detect when an approval popup (browser-action) closes without a response.
 // TX and sign approvals now use windows.create() and are handled by the
-// windowsApi.onRemoved listener below, but we still handle site-connection
+// windows.onRemoved listener below, but we still handle site-connection
 // approval disconnects here.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
@@ -585,31 +790,68 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "eth_sendTransaction") {
-        const s = await getState();
-        const activeAddress = await getActiveAddress();
-        if (!activeAddress)
-            return { error: { message: "No accounts available" } };
+        return await handleSendTransaction(params, origin);
+    }
 
-        const hostname = extractHostname(origin);
-        const allowed = s.allowedSites[activeAddress] || [];
-        if (
-            !allowed.includes(hostname) &&
-            !connectedSites[origin + ":" + activeAddress]
-        ) {
-            return { error: { code: 4100, message: "Unauthorized" } };
+    // Proxy safe read-only methods to the RPC node
+    if (PROXY_METHODS.includes(method)) {
+        try {
+            const result = await proxyRpc(method, params);
+            return { result };
+        } catch (e) {
+            return { error: { message: e.message } };
         }
+    }
 
-        const txParams = params?.[0] || {};
-        if (namesAnotherAddress(txParams.from, activeAddress)) {
-            return {
-                error: {
-                    code: 4100,
-                    message:
-                        "This site asked to send from an address that is not the active one.",
-                },
-            };
-        }
+    return { error: { message: "Unsupported method: " + method } };
+}
 
+// The body of eth_sendTransaction, from the connection check through to the
+// user's decision. It takes the single transaction-approval slot once it knows
+// it is going to populate a transaction, and holds it until the requesting
+// page has its answer.
+async function handleSendTransaction(params, origin) {
+    const s = await getState();
+    const activeAddress = await getActiveAddress();
+    if (!activeAddress) return { error: { message: "No accounts available" } };
+
+    const hostname = extractHostname(origin);
+    const allowed = s.allowedSites[activeAddress] || [];
+    if (
+        !allowed.includes(hostname) &&
+        !connectedSites[origin + ":" + activeAddress]
+    ) {
+        return { error: { code: 4100, message: "Unauthorized" } };
+    }
+
+    const txParams = params?.[0] || {};
+    if (namesAnotherAddress(txParams.from, activeAddress)) {
+        return {
+            error: {
+                code: 4100,
+                message:
+                    "This site asked to send from an address that is not the active one.",
+            },
+        };
+    }
+
+    // Everything above refuses without populating anything, so the slot is
+    // taken here rather than at the top of the handler: a page the wallet was
+    // never going to serve must not be able to hold the slot and make the
+    // connected site's own transaction fail as "already in progress". The
+    // reservation is atomic because nothing awaits between its test and its
+    // set, not because of where it sits.
+    const slot = reserveTxApprovalSlot();
+    if (!slot) {
+        return {
+            error: {
+                code: TX_APPROVAL_PENDING_CODE,
+                message: TX_APPROVAL_PENDING_MESSAGE,
+            },
+        };
+    }
+
+    try {
         // Populate here, before any window opens, so that the transaction the
         // user is shown is a complete one and is the same object the signed
         // artifact is checked against. A failure raises no approval at all and
@@ -644,43 +886,40 @@ async function handleRpc(method, params, origin) {
             hostname,
             approvedTx,
             activeAddress,
+            slot,
         );
         if (decision.error) return { error: decision.error };
         return { result: decision.txHash };
+    } finally {
+        // Retiring the approval has normally freed the slot already, through
+        // settleApproval(); this covers the paths that return before an
+        // approval exists at all, and frees nothing if another request has
+        // since taken the slot.
+        releaseTxApprovalSlot(slot);
     }
-
-    // Proxy safe read-only methods to the RPC node
-    if (PROXY_METHODS.includes(method)) {
-        try {
-            const result = await proxyRpc(method, params);
-            return { result };
-        } catch (e) {
-            return { error: { message: e.message } };
-        }
-    }
-
-    return { error: { message: "Unsupported method: " + method } };
 }
 
 // Broadcast chainChanged to all tabs when the network is switched.
-function broadcastChainChanged(chainId) {
-    tabsApi.query({}, (tabs) => {
-        for (const tab of tabs) {
-            tabsApi.sendMessage(
-                tab.id,
-                {
-                    type: "AUTISTMASK_EVENT",
-                    eventName: "chainChanged",
-                    data: chainId,
-                },
-                () => {
-                    if (runtime.lastError) {
-                        // expected for tabs without our content script
-                    }
-                },
-            );
-        }
-    });
+//
+// Never rejects: its caller is an RPC handler that must answer the page
+// whatever the browser made of the broadcast.
+async function broadcastChainChanged(chainId) {
+    let tabs;
+    try {
+        tabs = await tabsQuery({});
+    } catch {
+        return;
+    }
+    for (const tab of tabs) {
+        // A tab with no content script has no receiver, and that is the
+        // ordinary case rather than a fault. The rejection it produces is the
+        // promise-shaped form of the runtime.lastError this used to read.
+        tabsSendMessage(tab.id, {
+            type: "AUTISTMASK_EVENT",
+            eventName: "chainChanged",
+            data: chainId,
+        }).catch(() => {});
+    }
 }
 
 // Broadcast accountsChanged to all tabs, respecting per-address permissions
@@ -694,52 +933,43 @@ async function broadcastAccountsChanged() {
     // being signed and broadcast right now, and neither rejecting it to the
     // page nor closing the window it is reporting into is survivable.
     for (const [id, approval] of Object.entries(pendingApprovals)) {
-        const rejection =
-            approval.type === "tx" || approval.type === "sign"
-                ? {
-                      error: {
-                          code: 4001,
-                          message: "User rejected the request.",
-                      },
-                  }
-                : { approved: false, remember: false };
+        const rejection = abandonedResult(
+            approval,
+            APPROVAL_REJECTED_CODE,
+            APPROVAL_REJECTED_MESSAGE,
+        );
         if (!settleApproval(id, rejection)) continue;
         if (approval.windowId) {
-            windowsApi.remove(approval.windowId, () => {
-                if (runtime.lastError) {
-                    // window already closed
-                }
-            });
+            // Rejects when the window has already gone, which is a race the
+            // user wins routinely by closing it themselves.
+            windowsRemove(approval.windowId).catch(() => {});
         }
     }
     resetPopupUrl();
     const s = await getState();
     const activeAddress = await getActiveAddress();
     const allowed = activeAddress ? s.allowedSites[activeAddress] || [] : [];
-    tabsApi.query({}, (tabs) => {
-        for (const tab of tabs) {
-            const origin = tab.url ? new URL(tab.url).origin : "";
-            const hostname = extractHostname(origin);
-            const hasPermission =
-                activeAddress &&
-                (allowed.includes(hostname) ||
-                    connectedSites[origin + ":" + activeAddress]);
-            tabsApi.sendMessage(
-                tab.id,
-                {
-                    type: "AUTISTMASK_EVENT",
-                    eventName: "accountsChanged",
-                    data: hasPermission ? [activeAddress] : [],
-                },
-                () => {
-                    // Ignore errors for tabs without content script
-                    if (runtime.lastError) {
-                        // expected for tabs without our content script
-                    }
-                },
-            );
-        }
-    });
+    let tabs;
+    try {
+        tabs = await tabsQuery({});
+    } catch {
+        return;
+    }
+    for (const tab of tabs) {
+        const origin = tab.url ? new URL(tab.url).origin : "";
+        const hostname = extractHostname(origin);
+        const hasPermission =
+            activeAddress &&
+            (allowed.includes(hostname) ||
+                connectedSites[origin + ":" + activeAddress]);
+        // Same as chainChanged above: a tab without our content script
+        // rejects, and that is expected rather than a fault.
+        tabsSendMessage(tab.id, {
+            type: "AUTISTMASK_EVENT",
+            eventName: "accountsChanged",
+            data: hasPermission ? [activeAddress] : [],
+        }).catch(() => {});
+    }
 }
 
 // Background balance refresh: every 60 seconds when the popup isn't open.
@@ -831,21 +1061,19 @@ startBackgroundJobs();
 // verify and broadcast it is waiting on, so a user closing an apparently-hung
 // window is an ordinary event with an attempt already in flight behind it.
 // settleApproval() refuses those, which leaves the attempt to report its real
-// outcome to the page.
-if (windowsApi && windowsApi.onRemoved) {
-    windowsApi.onRemoved.addListener((windowId) => {
+// outcome to the page — and the window is recorded as gone, so that an attempt
+// which then fails retryably settles instead of waiting in a window that no
+// longer exists.
+if (windowsNs && windowsNs.onRemoved) {
+    windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const rejection =
-                approval.type === "tx" || approval.type === "sign"
-                    ? {
-                          error: {
-                              code: 4001,
-                              message: "User rejected the request.",
-                          },
-                      }
-                    : { approved: false, remember: false };
-            settleApproval(id, rejection);
+            const rejection = abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            );
+            if (!settleApproval(id, rejection)) approval.windowClosed = true;
         }
     });
 }
@@ -959,7 +1187,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             sendResponse({
                 error: outcome.error,
                 retryable: outcome.retryable,
-                stage: TX_STAGE_SIGN,
+                stage: outcome.stage,
             });
             return false;
         }
@@ -975,8 +1203,15 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         }
 
         (async () => {
+            // The chain this attempt is on, read once. Verification below
+            // refuses an artifact signed for any other chain, and the nonce
+            // record is both consulted and written under this one, so a
+            // network switch part-way through cannot make the check and the
+            // record disagree about which chain the nonce was spent on.
+            let chainId;
             try {
                 await loadState();
+                chainId = currentNetwork().chainId;
                 const activeAddress = await getActiveAddress();
                 // An address switch between approval and signing refuses. The
                 // approval named one account; signing from whichever account
@@ -999,7 +1234,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     msg.rawSignedTx,
                     approval.approvedTx,
                     approval.approvedFrom,
-                    currentNetwork().chainId,
+                    chainId,
                 );
             } catch (e) {
                 // A signed transaction that is not the approved one is not
@@ -1019,7 +1254,31 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: TX_STAGE_VERIFY,
+                    stage: outcome.stage,
+                });
+                return;
+            }
+
+            // A nonce this worker has already broadcast for this address on
+            // this chain. The node is not asked: it has answered once already,
+            // and the wallet holding the receipt of that answer is what makes
+            // this failure one the user can be told did not reach the network.
+            // A nonce spent on another chain is not spent here — the chains
+            // count separately, and refusing across them would block ordinary
+            // use with a message that is not true.
+            const nonce = approvedNonce(approval.approvedTx);
+            const spent = broadcastNoncesFor(chainId, approval.approvedFrom);
+            if (nonce !== null && spent.has(nonce)) {
+                const outcome = describeTxFailure(TX_STAGE_NONCE, null);
+                settleApproval(
+                    msg.id,
+                    { error: { message: outcome.error } },
+                    { holdsClaim: true },
+                );
+                sendResponse({
+                    error: outcome.error,
+                    retryable: outcome.retryable,
+                    stage: outcome.stage,
                 });
                 return;
             }
@@ -1027,6 +1286,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             try {
                 const provider = getProvider(state.rpcUrl);
                 const tx = await provider.broadcastTransaction(msg.rawSignedTx);
+                if (nonce !== null) spent.add(nonce);
                 settleApproval(
                     msg.id,
                     { txHash: tx.hash },
@@ -1039,6 +1299,11 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // tell a transaction that never left from one already in the
                 // mempool. The page has been given its outcome for this
                 // request; a second attempt would report a second one.
+                //
+                // Unless the node blamed the nonce, which is the one answer
+                // that says plainly it did not take the transaction:
+                // describeTxFailure() reclassifies that, and the stage it
+                // returns is the one reported.
                 const outcome = describeTxFailure(TX_STAGE_BROADCAST, e);
                 settleApproval(
                     msg.id,
@@ -1048,7 +1313,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: TX_STAGE_BROADCAST,
+                    stage: outcome.stage,
                 });
             }
         })();

src/content/index.js

@@ -1,12 +1,20 @@
 // AutistMask content script — bridges between inpage (window.ethereum)
 // and the background service worker via extension messaging.
 
+const {
+    hasBrowserNamespace,
+    runtimeApi,
+    sendMessage,
+    storageGet,
+    storageSet,
+} = require("../shared/browserApi");
+
 // In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
 // in the manifest, so no injection is needed here.  In Firefox (MV2), the
 // "world" key is not supported, so we inject via a <script> tag.
-if (typeof browser !== "undefined") {
+if (hasBrowserNamespace()) {
     const script = document.createElement("script");
-    script.src = browser.runtime.getURL("src/content/inpage.js");
+    script.src = runtimeApi().getURL("src/content/inpage.js");
     script.onload = function () {
         this.remove();
     };
@@ -14,23 +22,27 @@ if (typeof browser !== "undefined") {
 }
 
 // Send the persisted EIP-6963 provider UUID to the inpage script.
-// Generated once at install time and stored in chrome.storage.local.
-(function sendProviderUuid() {
-    const storage =
-        typeof browser !== "undefined"
-            ? browser.storage.local
-            : chrome.storage.local;
-    storage.get("eip6963Uuid", (items) => {
-        let uuid = items?.eip6963Uuid;
+// Generated once at install time and stored in extension storage.
+(async function sendProviderUuid() {
+    let uuid = null;
+    try {
+        const items = await storageGet("eip6963Uuid");
+        uuid = items?.eip6963Uuid;
         if (!uuid) {
             uuid = crypto.randomUUID();
-            storage.set({ eip6963Uuid: uuid });
+            await storageSet({ eip6963Uuid: uuid });
         }
-        window.postMessage(
-            { type: "AUTISTMASK_PROVIDER_UUID", uuid },
-            location.origin,
-        );
-    });
+    } catch {
+        // Storage was unavailable or refused the write. The announcement
+        // still has to go out — a provider that never announces is invisible
+        // to every EIP-6963 dApp — so it goes under a fresh uuid that this
+        // page load will not outlive.
+        if (!uuid) uuid = crypto.randomUUID();
+    }
+    window.postMessage(
+        { type: "AUTISTMASK_PROVIDER_UUID", uuid },
+        location.origin,
+    );
 })();
 
 // Relay requests from the page to the background script
@@ -39,27 +51,31 @@ window.addEventListener("message", (event) => {
     if (event.data?.type !== "AUTISTMASK_REQUEST") return;
     const { id, method, params } = event.data;
 
-    const runtime =
-        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
-
-    runtime.sendMessage(
-        { type: "AUTISTMASK_RPC", id, method, params, origin: location.origin },
-        (response) => {
+    sendMessage({
+        type: "AUTISTMASK_RPC",
+        id,
+        method,
+        params,
+        origin: location.origin,
+    })
+        .then((response) => {
             if (response) {
                 window.postMessage(
                     { type: "AUTISTMASK_RESPONSE", id, ...response },
                     "*",
                 );
             }
-        },
-    );
+        })
+        .catch(() => {
+            // No receiver: the background context is gone. The page's promise
+            // stays pending, which is what it did before this was a promise
+            // at all; turning it into a rejection here is a change to what
+            // dApps see and belongs to its own issue.
+        });
 });
 
 // Listen for events pushed from the background (e.g. accountsChanged)
-const runtime =
-    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
-
-runtime.onMessage.addListener((msg) => {
+runtimeApi().onMessage.addListener((msg) => {
     if (msg.type === "AUTISTMASK_EVENT") {
         window.postMessage(
             {

src/popup/index.js

@@ -161,6 +161,12 @@ async function init() {
     const params = new URLSearchParams(window.location.search);
     const approvalId = params.get("approval");
     if (approvalId) {
+        // Deliberately not awaited, and deliberately not .catch()ed. show()
+        // is async, so a throw past its first await surfaces as an unhandled
+        // rejection rather than an uncaught error — measured as still failing
+        // the run on both harnesses (Playwright `pageerror`, and the Firefox
+        // driver's console-service drain), so nothing is lost by leaving it
+        // on that path.
         approval.show(approvalId);
         showView("approve-site");
         return;

src/popup/views/addressDetail.js

@@ -13,7 +13,7 @@ const {
     pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
-const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
+const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,
@@ -64,7 +64,7 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
-    const usdTotal = formatUsd(getAddressValueUsd(addr));
+    const usdTotal = formatAddressTotal(getAddressValue(addr));
     $("address-usd-total").innerHTML = usdTotal || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element

src/popup/views/addressToken.js

@@ -18,11 +18,7 @@ const {
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
-const {
-    formatUsd,
-    getPrice,
-    getAddressValueUsd,
-} = require("../../shared/prices");
+const { formatUsd, getPrice } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,

src/popup/views/approval.js

@@ -27,8 +27,7 @@ const { walletDefect } = require("../../shared/walletDefects");
 const { describeSigningFailure } = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
-const runtime =
-    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
 
 const erc20Iface = new Interface(ERC20_ABI);
 
@@ -439,34 +438,41 @@ function showSignApproval(details) {
     );
 }
 
-function show(id) {
+// Awaited by nobody: the popup entry point calls this and moves on. It
+// therefore has to absorb its own failure, and a background that cannot
+// describe the approval is the same outcome as an approval that is gone.
+async function show(id) {
     approvalId = id;
-    runtime.connect({ name: "approval:" + id });
-    runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
-        if (!details) {
-            window.close();
-            return;
-        }
-        if (details.type === "tx") {
-            showTxApproval(details);
-            return;
-        }
-        if (details.type === "sign") {
-            showSignApproval(details);
-            return;
-        }
-        // Site connection approval
-        showPhishingWarning(
-            "approve-site-phishing-warning",
-            details.isPhishingDomain,
-        );
-        $("approve-hostname").textContent = details.hostname;
-        $("approve-address").innerHTML = approvalAddressHtml(
-            state.activeAddress,
-        );
-        attachCopyHandlers("view-approve-site");
-        $("approve-remember").checked = state.rememberSiteChoice;
-    });
+    runtimeApi().connect({ name: "approval:" + id });
+
+    let details = null;
+    try {
+        details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
+    } catch {
+        details = null;
+    }
+
+    if (!details) {
+        window.close();
+        return;
+    }
+    if (details.type === "tx") {
+        showTxApproval(details);
+        return;
+    }
+    if (details.type === "sign") {
+        showSignApproval(details);
+        return;
+    }
+    // Site connection approval
+    showPhishingWarning(
+        "approve-site-phishing-warning",
+        details.isPhishingDomain,
+    );
+    $("approve-hostname").textContent = details.hostname;
+    $("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
+    attachCopyHandlers("view-approve-site");
+    $("approve-remember").checked = state.rememberSiteChoice;
 }
 
 let approvalId = null;
@@ -548,7 +554,7 @@ function init(ctx) {
 
     $("btn-approve").addEventListener("click", () => {
         const remember = $("approve-remember").checked;
-        runtime.sendMessage({
+        notify({
             type: "AUTISTMASK_APPROVAL_RESPONSE",
             id: approvalId,
             approved: true,
@@ -559,7 +565,7 @@ function init(ctx) {
 
     $("btn-reject").addEventListener("click", () => {
         const remember = $("approve-remember").checked;
-        runtime.sendMessage({
+        notify({
             type: "AUTISTMASK_APPROVAL_RESPONSE",
             id: approvalId,
             approved: false,
@@ -648,29 +654,37 @@ function init(ctx) {
             decryptedSecret = null;
         }
 
-        runtime.sendMessage(payload, (response) => {
-            if (response && response.txHash) {
-                txStatus.showWait(pendingTxDetails, response.txHash);
-                return;
-            }
-            // A retryable failure leaves the approval pending in the
-            // background, so stay on this screen with a live button rather
-            // than sending the user to a dead end.
-            const outcome = describeSigningFailure(
-                response,
-                "The transaction could not be sent.",
-            );
-            if (outcome.retryable) {
-                showError("approve-tx-error", outcome.message);
-                setTxButtonBusy(false);
-            } else {
-                txStatus.showError(pendingTxDetails, null, outcome.message);
-            }
-        });
+        // A send that never reaches the background is reported to the user
+        // the same way a background that refused it is: describeSigningFailure
+        // turns a null response into the generic message below.
+        let response = null;
+        try {
+            response = await sendMessage(payload);
+        } catch {
+            response = null;
+        }
+
+        if (response && response.txHash) {
+            txStatus.showWait(pendingTxDetails, response.txHash);
+            return;
+        }
+        // A retryable failure leaves the approval pending in the
+        // background, so stay on this screen with a live button rather
+        // than sending the user to a dead end.
+        const outcome = describeSigningFailure(
+            response,
+            "The transaction could not be sent.",
+        );
+        if (outcome.retryable) {
+            showError("approve-tx-error", outcome.message);
+            setTxButtonBusy(false);
+        } else {
+            txStatus.showError(pendingTxDetails, null, outcome.message);
+        }
     });
 
     $("btn-reject-tx").addEventListener("click", () => {
-        runtime.sendMessage({
+        notify({
             type: "AUTISTMASK_TX_RESPONSE",
             id: approvalId,
             approved: false,
@@ -764,26 +778,31 @@ function init(ctx) {
             decryptedSecret = null;
         }
 
-        runtime.sendMessage(payload, (response) => {
-            if (response && response.signature) {
-                window.close();
-                return;
-            }
-            // The button comes back only when the approval is still pending in
-            // the background; otherwise it stays disabled and the message says
-            // why, because a control that cannot succeed must not look like it
-            // can.
-            const outcome = describeSigningFailure(
-                response,
-                "The message could not be signed.",
-            );
-            showError("approve-sign-error", outcome.message);
-            if (outcome.retryable) setSignButtonBusy(false);
-        });
+        let response = null;
+        try {
+            response = await sendMessage(payload);
+        } catch {
+            response = null;
+        }
+
+        if (response && response.signature) {
+            window.close();
+            return;
+        }
+        // The button comes back only when the approval is still pending in
+        // the background; otherwise it stays disabled and the message says
+        // why, because a control that cannot succeed must not look like it
+        // can.
+        const outcome = describeSigningFailure(
+            response,
+            "The message could not be signed.",
+        );
+        showError("approve-sign-error", outcome.message);
+        if (outcome.retryable) setSignButtonBusy(false);
     });
 
     $("btn-reject-sign").addEventListener("click", () => {
-        runtime.sendMessage({
+        notify({
             type: "AUTISTMASK_SIGN_RESPONSE",
             id: approvalId,
             approved: false,

src/popup/views/deleteAddress.js

@@ -17,7 +17,7 @@ const {
     addressHoldsFunds,
     balanceLinesForAddress,
 } = require("./helpers");
-const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
+const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { state, saveState } = require("../../shared/state");
 const {
@@ -84,16 +84,16 @@ function recoveryPathText(wallet) {
 // own: the rendered lines round to four decimals, so a sentence built from a
 // rounded number would report "0.0000 ETH" for an address holding real money.
 // The lines below it carry the amounts, in the same format as Home and
-// AddressDetail, followed by the USD total when prices are known (null on
-// testnet and before the first price fetch, where the line is left off rather
-// than printed as $0.00).
+// AddressDetail, followed by the USD total when there is one to give — no
+// total line at all on testnet or before the first price fetch, and no figure
+// when every holding here is one with no price, since "$0.00" directly under
+// "This address holds a balance." is a contradiction.
 function balanceWarningHtml(addr) {
     if (!addressHoldsFunds(addr)) return " ";
-    const usd = getAddressValueUsd(addr);
-    const total =
-        usd === null
-            ? ""
-            : `<div class="text-xs text-muted mt-1">Total: ${formatUsd(usd)}</div>`;
+    const line = formatAddressTotal(getAddressValue(addr));
+    const total = line
+        ? `<div class="text-xs text-muted mt-1">${line}</div>`
+        : "";
     return (
         `<p class="mb-1">This address holds a balance. Removing it does not ` +
         `move or spend anything; the balance stays at the address.</p>` +

src/popup/views/helpers.js

@@ -1,11 +1,7 @@
 // Shared DOM helpers used by all views.
 
 const { isDebug } = require("../../shared/log");
-const {
-    formatUsd,
-    getPrice,
-    getAddressValueUsd,
-} = require("../../shared/prices");
+const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { markViewRendered } = require("../viewRouter");
 

src/popup/views/home.js

@@ -15,6 +15,7 @@ const {
     pushCurrentView,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
+const { notify } = require("../../shared/browserApi");
 const {
     updateSendBalance,
     renderSendTokenSelect,
@@ -28,8 +29,9 @@ const {
 } = require("../../shared/walletDefects");
 const {
     formatUsd,
+    formatAddressTotal,
     getPrice,
-    getAddressValueUsd,
+    getAddressValue,
 } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -71,9 +73,7 @@ function renderTotalValue() {
     el.textContent = ethStr + ethUsd;
 
     if (subEl) {
-        const totalUsd = getAddressValueUsd(addr);
-        subEl.innerHTML =
-            totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
+        subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
     }
 }
 
@@ -257,8 +257,8 @@ function walletListHtml() {
             html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
             html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
             html += `</div>`;
-            const addrUsd = formatUsd(getAddressValueUsd(addr));
-            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || "&nbsp;"}</div>`;
+            const addrTotal = formatAddressTotal(getAddressValue(addr));
+            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || "&nbsp;"}</div>`;
             html += balanceLinesForAddress(
                 addr,
                 state.trackedTokens,
@@ -293,11 +293,7 @@ function render(ctx) {
                 state.activeAddress = addr;
                 await saveState();
                 render(ctx);
-                const runtime =
-                    typeof browser !== "undefined"
-                        ? browser.runtime
-                        : chrome.runtime;
-                runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+                notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
             }
         });
     });

src/popup/views/settings.js

@@ -29,8 +29,7 @@ const {
     GITEA_COMMIT_URL,
 } = require("../../shared/buildInfo");
 
-const runtime =
-    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+const { notify } = require("../../shared/browserApi");
 
 let versionClickCount = 0;
 let versionClickTimer = null;
@@ -61,7 +60,7 @@ function renderSiteList(containerId, siteMap, stateKey) {
                 }
             }
             await saveState();
-            runtime.sendMessage({ type: "AUTISTMASK_REMOVE_SITE" });
+            notify({ type: "AUTISTMASK_REMOVE_SITE" });
             renderSiteList(containerId, state[key], key);
         });
     });

src/shared/alarms.js

@@ -19,6 +19,8 @@
 // be bypassed on the scheduled tick — see backgroundRefresh() in
 // src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
 
+const { alarmsApi } = require("./browserApi");
+
 const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
 const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
 
@@ -26,14 +28,10 @@ const MIN_ALARM_PERIOD_MINUTES = 1;
 const BALANCE_REFRESH_PERIOD_MINUTES = 1;
 const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
 
-// Resolved on use rather than captured at module load: the worker is torn
+// alarmsApi() resolves on use rather than at module load: the worker is torn
 // down and re-evaluated repeatedly, and tests install a stub after requiring
-// the module.
-function alarmsApi() {
-    if (typeof browser !== "undefined" && browser.alarms) return browser.alarms;
-    if (typeof chrome !== "undefined" && chrome.alarms) return chrome.alarms;
-    return null;
-}
+// this module. It returns null where the API is absent, which is why every
+// entry point below degrades instead of throwing.
 
 /**
  * Create an alarm unless one with the requested period already exists.

src/shared/approvalVerify.js

@@ -602,6 +602,12 @@ const TX_STAGE_BROADCAST = "broadcast";
 // may yet succeed, so the one thing the popup must not say is "start again
 // from the site".
 const TX_STAGE_INFLIGHT = "inflight";
+// A transaction refused for a nonce that is already spoken for, either by the
+// node's own answer or by this wallet's record of what it has broadcast. It is
+// the one broadcast-stage failure that is not ambiguous: the transaction was
+// not taken, so the user is told it did not reach the network and to send it
+// again, rather than being warned that it might already be out there.
+const TX_STAGE_NONCE = "nonce";
 
 function errorText(err) {
     if (typeof err === "string" && err !== "") return err;
@@ -611,6 +617,59 @@ function errorText(err) {
     return "The transaction could not be sent.";
 }
 
+// Every string a failure might carry its reason in. ethers reports the node's
+// own words in `shortMessage`, but a JSON-RPC error it could not classify is
+// nested under `error` or `info.error` with the node's message intact, and the
+// classification below has to see that too.
+function failureTexts(err) {
+    if (typeof err === "string") return [err];
+    if (!err || typeof err !== "object") return [];
+    const texts = [];
+    for (const text of [err.shortMessage, err.message, err.reason]) {
+        if (text) texts.push(String(text));
+    }
+    const nested = err.error || (err.info && err.info.error);
+    if (nested && nested.message) texts.push(String(nested.message));
+    return texts;
+}
+
+// What the Ethereum clients say when a transaction's nonce is already spoken
+// for: either it is below the account's next nonce, or another transaction is
+// sitting in the pool at that nonce and this one did not outbid it. Either way
+// the node answered, and its answer was that it did not take this transaction.
+//
+// "already known" is deliberately absent. A node that says it knows the
+// transaction has it, so that transaction did reach the network and the
+// ambiguous broadcast wording is the correct one for it.
+const NONCE_COLLISION_PATTERNS = [
+    /nonce too low/i,
+    /nonce has already been used/i,
+    /invalid nonce/i,
+    /oldnonce/i,
+    /replacement transaction underpriced/i,
+    /replacement fee too low/i,
+];
+
+// ethers' own classification of the same two conditions.
+const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
+
+// Whether a failed send is a nonce collision.
+function isNonceCollision(err) {
+    if (!err) return false;
+    if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
+    return failureTexts(err).some((text) =>
+        NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
+    );
+}
+
+// What both the requesting page and the popup are told about a nonce
+// collision. The node's own words ("nonce too low") are a fragment and are
+// replaced rather than passed through: they are not a sentence, and they say
+// less than the wallet knows.
+const NONCE_COLLISION_MESSAGE =
+    "The transaction was not sent, because its nonce had already been used" +
+    " by another transaction.";
+
 // What the background does with a pending transaction approval after a failed
 // attempt: what it tells the popup, and whether the approval is spent
 // (resolved to the requesting page as an error and deleted) or left standing
@@ -627,12 +686,31 @@ function errorText(err) {
 //    that never left from one that is already in the mempool. The approval is
 //    spent and the requesting page has been given its outcome; a second
 //    attempt against it would report a second outcome for one request.
+//  - nonce: terminal too, and the one case where the wallet does know the
+//    transaction never left. The approval carries a nonce that is spent, so
+//    the artifact signed against it can never be accepted and the user is told
+//    to send it again from the site.
+//
+// The stage comes back out because a broadcast failure the node blamed on the
+// nonce is reclassified here; the caller reports the stage this returns rather
+// than the one it passed in.
 function describeTxFailure(stage, err) {
+    if (
+        stage === TX_STAGE_NONCE ||
+        (stage === TX_STAGE_BROADCAST && isNonceCollision(err))
+    ) {
+        return {
+            error: NONCE_COLLISION_MESSAGE,
+            retryable: false,
+            spendApproval: true,
+            stage: TX_STAGE_NONCE,
+        };
+    }
     const error = errorText(err);
     const retryable =
         stage === TX_STAGE_SIGN ||
         (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
-    return { error, retryable, spendApproval: !retryable };
+    return { error, retryable, spendApproval: !retryable, stage };
 }
 
 // What the popup shows and does after the background reports a failed signing
@@ -642,14 +720,20 @@ function describeTxFailure(stage, err) {
 //
 // A failed broadcast gets its own wording: the transaction may already be on
 // the network, so telling the user to start again from the site is exactly the
-// wrong instruction.
+// wrong instruction. A nonce collision is the exception to that exception —
+// the transaction demonstrably did not go out, and saying it might have would
+// send the user hunting for a transaction that does not exist.
 function describeSigningFailure(response, fallbackMessage) {
     let message = (response && response.error) || fallbackMessage;
     if (!/[.!?]$/.test(message)) message += ".";
     const retryable = !!(response && response.retryable);
     const stage = response && response.stage;
     if (!retryable) {
-        if (stage === TX_STAGE_BROADCAST) {
+        if (stage === TX_STAGE_NONCE) {
+            message +=
+                " The transaction did not reach the network." +
+                " Please send it again from the site.";
+        } else if (stage === TX_STAGE_BROADCAST) {
             message +=
                 " The transaction may still have reached the network." +
                 " Check the account before sending it again.";
@@ -675,9 +759,11 @@ module.exports = {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
+    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
     ApprovalMismatchError,
+    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -686,6 +772,7 @@ module.exports = {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
+    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 };

src/shared/browserApi.js

@@ -0,0 +1,262 @@
+// The one place in this tree that names `browser` or `chrome`.
+//
+// The two targets do not agree on the namespace, and they disagree about the
+// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
+// where tabs, windows and messaging take a trailing callback and report
+// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
+// `browser.*`, where those same methods return promises — but, measured on
+// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
+// no promise when one is given, and populates `browser.runtime.lastError`.
+// The callback code that predated this module therefore ran on both, and
+// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
+// that it did not. This module exists for uniformity, not for repair: the
+// tree used to resolve the namespace with a ternary at six call sites and
+// then mix promise-form storage with callback-form messaging.
+//
+// The strategy is promises out, everywhere: one namespace, one call shape,
+// composing with the `async` handlers in the background. Callers `await`;
+// nothing outside this file has to know which browser it is running on.
+//
+// Two deliberate asymmetries, because they are what the browsers actually do
+// rather than what a uniform-looking shim would pretend:
+//
+//  - Storage is called in its PROMISE form on both namespaces.
+//    `chrome.storage.local.get()` returns a promise on MV3 and the popup
+//    already depends on that — src/shared/state.js has always awaited it.
+//    Wrapping it in a callback here would be a change, not a fix.
+//  - notify() sends without a callback. It is for a message whose answer
+//    nobody reads; appending a callback would only manufacture a
+//    lastError/rejection for a receiver that was never expected to reply.
+//
+// Everything is resolved on use rather than captured at module load. The MV3
+// service worker is torn down and re-evaluated repeatedly, and the unit
+// suite installs its stubs on `global.chrome` around a require().
+
+// The extension API namespace, preferring `browser.*` where it exists.
+//
+// Whole-namespace, never per-method: mixing `browser.tabs` with
+// `chrome.windows` would also mix promise and callback semantics inside a
+// single call path, which is the bug this module exists to remove.
+function extensionApi() {
+    if (typeof browser !== "undefined" && browser) return browser;
+    if (typeof chrome !== "undefined" && chrome) return chrome;
+    return null;
+}
+
+// True when the resolved namespace is the promise-flavoured one.
+//
+// It doubles as "this is the Gecko/MV2 build", which is a second question
+// with the same answer and one real caller: src/content/index.js has to
+// inject the inpage provider itself there, because MV2 has no
+// `"world": "MAIN"` for a manifest-declared content script.
+function hasBrowserNamespace() {
+    return typeof browser !== "undefined" && !!browser;
+}
+
+function namespaceMember(name) {
+    const api = extensionApi();
+    return (api && api[name]) || null;
+}
+
+function runtimeApi() {
+    return namespaceMember("runtime");
+}
+
+function tabsApi() {
+    return namespaceMember("tabs");
+}
+
+function windowsApi() {
+    return namespaceMember("windows");
+}
+
+function alarmsApi() {
+    return namespaceMember("alarms");
+}
+
+// The toolbar button. MV3 calls it `action`, MV2 calls it `browserAction`.
+function actionApi() {
+    const api = extensionApi();
+    if (!api) return null;
+    return api.action || api.browserAction || null;
+}
+
+// `storage.local`, or null in a context that has no storage permission.
+//
+// Null rather than a throw for the one caller that genuinely degrades:
+// src/shared/phishingDomains.js falls back to its vendored blocklist and does
+// its own null check. Everything that reads or writes the wallet goes through
+// storageGet()/storageSet(), which reject instead — see there.
+function storageLocal() {
+    const storage = namespaceMember("storage");
+    return (storage && storage.local) || null;
+}
+
+// The callback-path error channel. Read only from inside an appended
+// callback, i.e. only on the `chrome.*` path, where it is the sole way a
+// failure is reported. The background's three explicit lastError checks are
+// gone because invoke() turns it into a rejection before any caller sees it.
+function lastError() {
+    const runtime = runtimeApi();
+    return (runtime && runtime.lastError) || null;
+}
+
+// Call `owner[method](...args)` and return a promise for its result.
+//
+// On the promise namespace the method already returns one. On the callback
+// namespace the callback is appended here and lastError becomes a rejection,
+// because a caller holding a promise has nowhere to check a global flag.
+function invoke(owner, method, ...args) {
+    if (!owner || typeof owner[method] !== "function") {
+        return Promise.reject(
+            new Error(
+                "extension API " +
+                    method +
+                    "() is not available in this context",
+            ),
+        );
+    }
+    if (hasBrowserNamespace()) {
+        try {
+            return Promise.resolve(owner[method](...args));
+        } catch (e) {
+            return Promise.reject(e);
+        }
+    }
+    return new Promise((resolve, reject) => {
+        owner[method](...args, (result) => {
+            const err = lastError();
+            if (err) reject(new Error(err.message || String(err)));
+            else resolve(result);
+        });
+    });
+}
+
+/**
+ * Send a message to the extension's own contexts and resolve with the reply.
+ *
+ * Rejects when nothing is listening, on both browsers. A caller that does not
+ * care must say so — see notify().
+ *
+ * @param {Object} message
+ * @returns {Promise<*>} the receiver's response.
+ */
+function sendMessage(message) {
+    return invoke(runtimeApi(), "sendMessage", message);
+}
+
+/**
+ * Send a message nobody is expected to answer, and swallow the fact that
+ * nobody did.
+ *
+ * @param {Object} message
+ * @returns {void}
+ */
+function notify(message) {
+    const runtime = runtimeApi();
+    if (!runtime || typeof runtime.sendMessage !== "function") return;
+    const result = runtime.sendMessage(message);
+    // MV3 hands back a promise for a one-argument send, and it rejects when
+    // the background is not listening. Unhandled, that surfaces as an error
+    // the e2e suites fail the run on.
+    if (result && typeof result.catch === "function") result.catch(() => {});
+}
+
+// These two carry the wallet. A missing `storage.local` has to reject and not
+// default: resolving {} would make an existing wallet read back as no wallet,
+// and resolving a no-op write would discard the user's state with nothing
+// logged. A caller that wants to degrade takes storageLocal() directly.
+function storageUnavailable(method) {
+    return Promise.reject(
+        new Error("extension storage.local is not available: " + method),
+    );
+}
+
+/**
+ * @param {string|string[]|Object} keys
+ * @returns {Promise<Object>} the stored items.
+ * @throws rejects where `storage.local` is absent.
+ */
+function storageGet(keys) {
+    const storage = storageLocal();
+    if (!storage) return storageUnavailable("get");
+    return Promise.resolve(storage.get(keys));
+}
+
+/**
+ * @param {Object} items
+ * @returns {Promise<void>}
+ * @throws rejects where `storage.local` is absent.
+ */
+function storageSet(items) {
+    const storage = storageLocal();
+    if (!storage) return storageUnavailable("set");
+    return Promise.resolve(storage.set(items));
+}
+
+/**
+ * @param {Object} queryInfo
+ * @returns {Promise<Array>} the matching tabs.
+ */
+function tabsQuery(queryInfo) {
+    return invoke(tabsApi(), "query", queryInfo);
+}
+
+/**
+ * Send a message to one tab's content script.
+ *
+ * Rejects for a tab that has no receiver, which is most of them. That
+ * rejection is the promise-shaped replacement for the runtime.lastError
+ * checks the broadcast helpers used to make, and callers ignore it the same
+ * way.
+ *
+ * @param {number} tabId
+ * @param {Object} message
+ * @returns {Promise<*>}
+ */
+function tabsSendMessage(tabId, message) {
+    return invoke(tabsApi(), "sendMessage", tabId, message);
+}
+
+/**
+ * @param {Object} createData
+ * @returns {Promise<Object>} the created window.
+ */
+function windowsCreate(createData) {
+    return invoke(windowsApi(), "create", createData);
+}
+
+/**
+ * @returns {Promise<Object>} the last focused window.
+ */
+function windowsGetLastFocused() {
+    return invoke(windowsApi(), "getLastFocused");
+}
+
+/**
+ * @param {number} windowId
+ * @returns {Promise<void>}
+ */
+function windowsRemove(windowId) {
+    return invoke(windowsApi(), "remove", windowId);
+}
+
+module.exports = {
+    actionApi,
+    alarmsApi,
+    extensionApi,
+    hasBrowserNamespace,
+    notify,
+    runtimeApi,
+    sendMessage,
+    storageGet,
+    storageLocal,
+    storageSet,
+    tabsApi,
+    tabsQuery,
+    tabsSendMessage,
+    windowsApi,
+    windowsCreate,
+    windowsGetLastFocused,
+    windowsRemove,
+};

src/shared/phishingDomains.js

@@ -18,6 +18,7 @@
 // its own refresh — see updatePhishingList().
 
 const vendoredConfig = require("./phishingBlocklist.json");
+const { storageLocal } = require("./browserApi");
 
 const BLOCKLIST_URL =
     "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
@@ -46,18 +47,10 @@ let lastAttemptTime = 0;
 let fetchPromise = null;
 let loadPromise = null;
 
-// Resolved on use rather than captured at module load, so a test can install
-// a stub after requiring the module and so the popup — which has no reason to
-// touch the delta — does not fail to load where the API is absent.
-function storageApi() {
-    if (typeof browser !== "undefined" && browser.storage) {
-        return browser.storage.local;
-    }
-    if (typeof chrome !== "undefined" && chrome.storage) {
-        return chrome.storage.local;
-    }
-    return null;
-}
+// storageLocal() resolves on use rather than at module load, so a test can
+// install a stub after requiring this module, and it returns null where the
+// API is absent — which is why the popup, with no reason to touch the delta,
+// loads fine without it.
 
 /**
  * Sanitise a timestamp read back from storage.
@@ -86,7 +79,7 @@ function sanitizeTimestamp(value) {
  * @returns {Promise<void>}
  */
 async function loadDeltaFromStorage() {
-    const storage = storageApi();
+    const storage = storageLocal();
     if (!storage) return;
     try {
         const result = await storage.get(DELTA_STORAGE_KEY);
@@ -122,7 +115,7 @@ function ensureDeltaLoaded() {
  * @returns {Promise<void>}
  */
 async function saveDeltaToStorage() {
-    const storage = storageApi();
+    const storage = storageLocal();
     if (!storage) return;
     try {
         const data = {

src/shared/prices.js

@@ -55,42 +55,77 @@ function formatUsd(amount) {
     );
 }
 
-function getAddressValueUsd(addr) {
+// What an address is worth, as { usd, partial }.
+//
+// Prices are fetched for the top 25 tokens only, so an address can hold real
+// assets this code has no price for. Adding up the priced ones and calling the
+// result the total states a number the holdings do not support: an address
+// holding nothing but unpriced tokens comes out at $0.00, which tells the user
+// their address is worth nothing when it may hold a great deal. Worth zero and
+// worth an unknown amount are separate facts and get separate fields, the same
+// way an absent holders_count is not a count of zero.
+//
+//   usd:     the value of the holdings a price is known for, or null when
+//            nothing is knowable at all — testnet, or before the first fetch.
+//   partial: the address also holds a token with no price, so usd is a floor
+//            and not the total.
+//
+// Render it through formatAddressTotal() rather than reading usd alone.
+function getAddressValue(addr) {
     const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    const ethBal = parseFloat(addr.balance || "0");
-    total += ethBal * prices.ETH;
+    if (currentNetwork().isTestnet) return { usd: null, partial: false };
+    if (!prices.ETH) return { usd: null, partial: false };
+    let usd = parseFloat(addr.balance || "0") * prices.ETH;
+    let partial = false;
     for (const token of addr.tokenBalances || []) {
         const tokenBal = parseFloat(token.balance || "0");
-        if (tokenBal > 0 && prices[token.symbol]) {
-            total += tokenBal * prices[token.symbol];
+        // A balance of zero is not a holding: it can neither add to the total
+        // nor make it incomplete.
+        if (!(tokenBal > 0)) continue;
+        if (prices[token.symbol]) {
+            usd += tokenBal * prices[token.symbol];
+        } else {
+            partial = true;
         }
     }
-    return total;
+    return { usd, partial };
 }
 
-function getWalletValueUsd(wallet) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    for (const addr of wallet.addresses) {
-        total += getAddressValueUsd(addr);
-    }
-    return total;
+// The same pair for a whole wallet, and for every wallet at once. One
+// unpriced holding anywhere makes the sum a floor, so partial carries up.
+function getWalletValue(wallet) {
+    return sumValues(wallet.addresses.map(getAddressValue));
 }
 
-function getTotalValueUsd(wallets) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    for (const wallet of wallets) {
-        total += getWalletValueUsd(wallet);
+function getTotalValue(wallets) {
+    return sumValues(wallets.map(getWalletValue));
+}
+
+function sumValues(values) {
+    let usd = null;
+    let partial = false;
+    for (const value of values) {
+        if (value.usd === null) continue;
+        usd = (usd === null ? 0 : usd) + value.usd;
+        partial = partial || value.partial;
     }
-    return total;
+    return { usd, partial };
+}
+
+// The one rendering of an address total, so no screen says it differently.
+//
+// A partial total is shown and named as partial: the figure is the ETH and
+// priced tokens the user does hold, which is worth having, and suppressing it
+// would throw away a number that is correct as far as it goes. What is never
+// shown is a figure covering no holdings at all — the $0.00 sum of an empty
+// set beside a list of tokens is the bug this replaces.
+function formatAddressTotal(value) {
+    if (!value || value.usd === null) return "";
+    if (!value.partial) return "Total: " + formatUsd(value.usd);
+    if (value.usd > 0) {
+        return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
+    }
+    return "Total: unpriced tokens only";
 }
 
 module.exports = {
@@ -99,7 +134,8 @@ module.exports = {
     clearPrices,
     getPrice,
     formatUsd,
-    getAddressValueUsd,
-    getWalletValueUsd,
-    getTotalValueUsd,
+    formatAddressTotal,
+    getAddressValue,
+    getWalletValue,
+    getTotalValue,
 };

src/shared/state.js

@@ -5,10 +5,7 @@ const { networkById } = require("./networks");
 // Dependency-free constant module; safe to pull into a background bundle.
 const { RESTORABLE_VIEWS } = require("../popup/restorableViews");
 
-const storageApi =
-    typeof browser !== "undefined"
-        ? browser.storage.local
-        : chrome.storage.local;
+const { storageGet, storageSet } = require("./browserApi");
 
 const DEFAULT_STATE = {
     hasWallet: false,
@@ -114,11 +111,11 @@ async function saveState() {
         viewData: state.viewData,
         viewStack: state.viewStack,
     };
-    await storageApi.set({ autistmask: persisted });
+    await storageSet({ autistmask: persisted });
 }
 
 async function loadState() {
-    const result = await storageApi.get("autistmask");
+    const result = await storageGet("autistmask");
     if (result.autistmask) {
         const saved = result.autistmask;
         state.wallets = saved.wallets || [];

src/shared/walletDelete.js

@@ -1,6 +1,8 @@
 // Wallet and address deletion state transitions, kept out of the views so the
 // selection and broadcast rules are testable without a DOM.
 
+const { notify } = require("./browserApi");
+
 // Two records of the same address can be stored in different cases, so
 // address equality is never a literal string comparison.
 function sameAddress(a, b) {
@@ -144,9 +146,7 @@ function removeAddressFromState(state, walletIdx, addrIdx) {
 // accountsChanged to connected sites. Same call shape as the address
 // switch in the home view.
 function broadcastActiveChanged() {
-    const runtime =
-        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
-    runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+    notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
 }
 
 module.exports = {

tests/addressValue.test.js

@@ -0,0 +1,238 @@
+// The USD total of an address that holds something this build cannot price
+// (issue #261).
+//
+// Prices exist for the top 25 tokens only, so an address can hold real assets
+// with no price attached. Summing what is priced and printing the result as
+// the total says "$0.00" for an address holding nothing but unpriced tokens —
+// worth-nothing and worth-an-unknown-amount collapsed into one number, in the
+// direction that matters. The two are separate facts here, the same way an
+// absent holders_count is not a count of zero.
+//
+// The value and its rendering are asserted directly, and then through the two
+// call sites that return their markup as a string: the wallet list on Home and
+// the balance warning on the address-removal confirmation. AddressDetail and
+// the Home summary line render into the DOM and are covered by tests/e2e.
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const {
+    prices,
+    clearPrices,
+    getAddressValue,
+    getWalletValue,
+    getTotalValue,
+    formatAddressTotal,
+} = require("../src/shared/prices");
+const { state } = require("../src/shared/state");
+const { walletListHtml } = require("../src/popup/views/home");
+const { balanceWarningHtml } = require("../src/popup/views/deleteAddress");
+
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+const NOVEL = "0x1111111111111111111111111111111111111111";
+
+// No ETH, and a token no price is known for. The case the user is told is
+// worth $0.00 today.
+const UNPRICED_ONLY = {
+    address: "0x" + "a".repeat(40),
+    balance: "0",
+    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
+};
+
+// Nothing at all: the address really is worth zero.
+const EMPTY = {
+    address: "0x" + "b".repeat(40),
+    balance: "0",
+    tokenBalances: [],
+};
+
+// Every holding priced.
+const FULLY_PRICED = {
+    address: "0x" + "c".repeat(40),
+    balance: "1.5",
+    tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
+};
+
+// Part priced, part not: 1.5 ETH plus a token with no price.
+const PARTLY_PRICED = {
+    address: "0x" + "d".repeat(40),
+    balance: "1.5",
+    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
+};
+
+beforeEach(() => {
+    clearPrices();
+    prices.ETH = 2000;
+    prices.USDC = 1;
+    state.wallets = [];
+    state.trackedTokens = [];
+    state.showZeroBalanceTokens = false;
+    state.activeAddress = null;
+});
+
+afterEach(() => {
+    clearPrices();
+});
+
+// The total line only, in each of the two markup-returning call sites. The
+// ETH balance line above it legitimately reads $0.00 for an address with no
+// ETH, so the assertions have to name the line under test.
+function walletListTotal(addr) {
+    state.wallets = [{ name: "Wallet 1", type: "hd", addresses: [addr] }];
+    const match = walletListHtml().match(/min-h-\[1rem\]">([^<]*)</);
+    return match && match[1];
+}
+
+function removalWarningTotal(addr) {
+    const match = balanceWarningHtml(addr).match(/mt-1">([^<]*)</);
+    return match && match[1];
+}
+
+describe("the value of an address, and whether it is the whole value", () => {
+    test("an address holding only unpriced tokens has an incomplete value", () => {
+        expect(getAddressValue(UNPRICED_ONLY)).toEqual({
+            usd: 0,
+            partial: true,
+        });
+    });
+
+    test("an address holding nothing is complete, and zero", () => {
+        expect(getAddressValue(EMPTY)).toEqual({ usd: 0, partial: false });
+    });
+
+    test("a fully priced address is complete, and unchanged", () => {
+        expect(getAddressValue(FULLY_PRICED)).toEqual({
+            usd: 5500,
+            partial: false,
+        });
+    });
+
+    test("a partly priced address keeps the part it can price", () => {
+        expect(getAddressValue(PARTLY_PRICED)).toEqual({
+            usd: 3000,
+            partial: true,
+        });
+    });
+
+    // A token balance of zero is not a holding, so it cannot make the total
+    // incomplete: an address with a spent-out unpriced token is worth zero.
+    test("a zero balance in an unpriced token leaves the value complete", () => {
+        const addr = {
+            address: "0x1",
+            balance: "0",
+            tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "0" }],
+        };
+        expect(getAddressValue(addr)).toEqual({ usd: 0, partial: false });
+    });
+
+    // Before the first price fetch, and on testnet, nothing is knowable: that
+    // is a third state, and it stays distinct from both of the others.
+    test("no prices at all means no value, not an incomplete one", () => {
+        clearPrices();
+        expect(getAddressValue(FULLY_PRICED)).toEqual({
+            usd: null,
+            partial: false,
+        });
+    });
+
+    test("one unpriced holding makes a wallet and the grand total partial", () => {
+        const wallet = { addresses: [FULLY_PRICED, UNPRICED_ONLY] };
+        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: true });
+        expect(getTotalValue([wallet])).toEqual({ usd: 5500, partial: true });
+    });
+
+    test("a wallet of fully priced addresses stays complete", () => {
+        const wallet = { addresses: [FULLY_PRICED, EMPTY] };
+        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: false });
+    });
+});
+
+describe("how that value is written on screen", () => {
+    test("a complete total is the figure", () => {
+        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe(
+            "Total: $5,500.00",
+        );
+    });
+
+    test("an address worth zero says so", () => {
+        expect(formatAddressTotal(getAddressValue(EMPTY))).toBe("Total: $0.00");
+    });
+
+    // The figure is still worth having — it is the ETH the user does hold —
+    // but on its own it understates the address, so it is named as partial.
+    test("a partly priced total is given, and marked as partial", () => {
+        expect(formatAddressTotal(getAddressValue(PARTLY_PRICED))).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    // Nothing priced is held, so there is no figure to give: printing the
+    // $0.00 sum of an empty set is the bug.
+    test("a total with nothing priced in it gives no figure", () => {
+        const line = formatAddressTotal(getAddressValue(UNPRICED_ONLY));
+        expect(line).toBe("Total: unpriced tokens only");
+        expect(line).not.toContain("$");
+    });
+
+    test("an unknown value is written as nothing at all", () => {
+        clearPrices();
+        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe("");
+    });
+});
+
+describe("the wallet list on Home", () => {
+    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
+        expect(walletListTotal(UNPRICED_ONLY)).toBe(
+            "Total: unpriced tokens only",
+        );
+    });
+
+    test("an address holding nothing is still totalled at $0.00", () => {
+        expect(walletListTotal(EMPTY)).toBe("Total: $0.00");
+    });
+
+    test("a fully priced address shows its total", () => {
+        expect(walletListTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
+    });
+
+    test("a partly priced address shows the priced part, marked partial", () => {
+        expect(walletListTotal(PARTLY_PRICED)).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    test("an address whose value is unknown keeps its blank line", () => {
+        clearPrices();
+        expect(walletListTotal(FULLY_PRICED)).toBe("&nbsp;");
+    });
+});
+
+describe("the balance warning on the address-removal confirmation", () => {
+    // "This address holds a balance." followed by "Total: $0.00" is a flat
+    // contradiction, on the one screen whose job is to warn.
+    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
+        expect(balanceWarningHtml(UNPRICED_ONLY)).toContain(
+            "This address holds a balance.",
+        );
+        expect(removalWarningTotal(UNPRICED_ONLY)).toBe(
+            "Total: unpriced tokens only",
+        );
+    });
+
+    test("a fully priced address still shows its total", () => {
+        expect(removalWarningTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
+    });
+
+    test("a partly priced address shows the priced part, marked partial", () => {
+        expect(removalWarningTotal(PARTLY_PRICED)).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    test("no total line is written when the value is unknown", () => {
+        clearPrices();
+        expect(removalWarningTotal(FULLY_PRICED)).toBe(null);
+    });
+});

tests/approvalVerify.test.js

@@ -14,8 +14,10 @@ const {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
+    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
+    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -23,6 +25,7 @@ const {
     TX_STAGE_SIGN,
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
+    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 } = require("../src/shared/approvalVerify");
@@ -1191,7 +1194,6 @@ describe("signing failure and retry", () => {
             "already known",
             "timeout of 30000ms exceeded",
             "could not coalesce error",
-            "replacement transaction underpriced",
         ]) {
             const outcome = describeTxFailure(
                 TX_STAGE_BROADCAST,
@@ -1199,10 +1201,76 @@ describe("signing failure and retry", () => {
             );
             expect(outcome.retryable).toBe(false);
             expect(outcome.spendApproval).toBe(true);
+            expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
             expect(outcome.error).toBe(message);
         }
     });
 
+    // The one broadcast failure that is not ambiguous. The node answered, and
+    // its answer was that the nonce was already spoken for, so this
+    // transaction is not in a mempool anywhere.
+    test("a nonce the node refused is classified however it was worded", () => {
+        for (const err of [
+            new Error("nonce too low"),
+            new Error("replacement transaction underpriced"),
+            Object.assign(new Error("could not coalesce error"), {
+                code: "NONCE_EXPIRED",
+            }),
+            Object.assign(new Error("could not coalesce error"), {
+                code: "REPLACEMENT_UNDERPRICED",
+            }),
+            // The shape ethers hands up when it could not classify the node's
+            // error itself: the node's own words are nested underneath.
+            Object.assign(new Error("could not coalesce error"), {
+                info: { error: { code: -32000, message: "OldNonce" } },
+            }),
+        ]) {
+            const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
+            expect(
+                describeSigningFailure(
+                    outcome,
+                    "The transaction could not be sent.",
+                ).message,
+            ).toMatch(/did not reach the network/);
+            expect(outcome.retryable).toBe(false);
+            expect(outcome.spendApproval).toBe(true);
+            expect(outcome.error).toBe(NONCE_COLLISION_MESSAGE);
+            expect(outcome.stage).toBe(TX_STAGE_NONCE);
+            expect(isNonceCollision(err)).toBe(true);
+        }
+    });
+
+    // A node that says it knows the transaction has it, so it did reach the
+    // network and the ambiguous wording is the correct one.
+    test("already known is not a nonce collision", () => {
+        const err = new Error("already known");
+        const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
+        expect(
+            describeSigningFailure(
+                outcome,
+                "The transaction could not be sent.",
+            ).message,
+        ).toMatch(/may still have reached the network/);
+        expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
+        expect(isNonceCollision(err)).toBe(false);
+    });
+
+    test("a nonce collision says the transaction did not reach the network", () => {
+        const outcome = describeTxFailure(
+            TX_STAGE_BROADCAST,
+            new Error("nonce too low"),
+        );
+        const copy = describeSigningFailure(
+            outcome,
+            "The transaction could not be sent.",
+        );
+        expect(copy.retryable).toBe(false);
+        expect(copy.message).toMatch(/did not reach the network/);
+        expect(copy.message).not.toMatch(/may still have reached the network/);
+        expect(copy.message).toMatch(/Please send it again from the site\.$/);
+        expect(copy.message).toMatch(/^[A-Z].*\.$/);
+    });
+
     test("a failed broadcast does not tell the user to send it again", () => {
         const outcome = describeSigningFailure(
             {

tests/backgroundApproval.test.js

@@ -30,6 +30,8 @@ const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 
 const ORIGIN = "https://dapp.example";
 const HOSTNAME = "dapp.example";
+// A page the wallet has never been connected to, whose requests are refused.
+const UNCONNECTED_ORIGIN = "https://stranger.example";
 const EXT_URL = "chrome-extension://autistmask/";
 
 // What the dApp asks for: no nonce, no gas, no fees. This is the shape that
@@ -51,10 +53,16 @@ const MESSAGE = "0x48656c6c6f204175746973744d61736b";
 // The transaction the background populates and the approval screen displays.
 // The nonce is a parameter because the duplicate case turns on two artifacts
 // differing in a field the dApp fixed nothing for.
-function populated(nonce) {
+// The two chains the tests switch between, as both forms the code uses: the
+// hex chain id the wallet's network record carries, and the number the node
+// and the signed artifact carry.
+const MAINNET = { hex: "0x1", num: 1 };
+const SEPOLIA = { hex: "0xaa36a7", num: 11155111 };
+
+function populated(nonce, chainId) {
     return {
         type: 2,
-        chainId: 1,
+        chainId: chainId || MAINNET.num,
         nonce,
         gasLimit: 100000n,
         maxFeePerGas: 2000000000n,
@@ -65,17 +73,17 @@ function populated(nonce) {
     };
 }
 
-function signedAtNonce(nonce, withWallet) {
-    return (withWallet || signer).signTransaction(populated(nonce));
+function signedAtNonce(nonce, withWallet, chainId) {
+    return (withWallet || signer).signTransaction(populated(nonce, chainId));
 }
 
 // The node the background populates against. Its answers are the numbers the
 // approval screen shows, so they are also the numbers every artifact below is
 // signed at.
-function fakeProvider(broadcastTransaction, overrides) {
+function fakeProvider(broadcastTransaction, overrides, chainId) {
     return {
         broadcastTransaction,
-        getNetwork: async () => Network.from(1),
+        getNetwork: async () => Network.from(chainId || MAINNET.num),
         getTransactionCount: async () => NONCE,
         estimateGas: async () => 100000n,
         getFeeData: async () => ({
@@ -111,14 +119,20 @@ function loadBackground(options) {
     const broadcastTransaction = jest.fn();
     const loadState = jest.fn(opts.loadState || (async () => {}));
 
+    // The network the wallet is on, which the tests switch under a pending
+    // approval. The node the transaction is populated against is on the same
+    // one, as it would be: switching networks switches the RPC endpoint too.
+    let chain = MAINNET;
+
     jest.doMock("../src/shared/state", () => ({
         state: { rpcUrl: "https://rpc.invalid", wallets: [] },
         loadState,
         saveState: jest.fn(async () => {}),
-        currentNetwork: () => ({ chainId: "0x1" }),
+        currentNetwork: () => ({ chainId: chain.hex }),
     }));
     jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => fakeProvider(broadcastTransaction, opts.provider),
+        getProvider: () =>
+            fakeProvider(broadcastTransaction, opts.provider, chain.num),
         refreshBalances: jest.fn(async () => {}),
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
@@ -170,7 +184,9 @@ function loadBackground(options) {
             getLastFocused: (cb) => cb(null),
             create: (options2, cb) => {
                 created.push(options2);
-                cb({ id: created.length });
+                // A browser that answers with no window at all. The approval
+                // then has no window it can ever be answered in.
+                cb(opts.noWindow ? undefined : { id: created.length });
             },
             remove: (id, cb) => {
                 removed.push(id);
@@ -204,8 +220,12 @@ function loadBackground(options) {
 
     // Raise a pending transaction approval the way a dApp does, and dig the
     // approval id back out of the popup URL the background opened.
-    function requestTx(txParams) {
+    function requestTx(txParams, origin) {
         let rpcResult = null;
+        // The window this request opens, if it opens one. A request refused
+        // before an approval is raised opens none, and the window belonging to
+        // some other request must not be handed back as this one's.
+        const windowIndex = created.length;
         const sendResponse = jest.fn((r) => {
             rpcResult = r;
         });
@@ -215,11 +235,16 @@ function loadBackground(options) {
                 method: "eth_sendTransaction",
                 params: [txParams || TX_PARAMS],
             },
-            { origin: ORIGIN },
+            { origin: origin || ORIGIN },
             sendResponse,
         );
         return {
-            id: () => new URL(created[0].url).searchParams.get("approval"),
+            id: () =>
+                created.length > windowIndex
+                    ? new URL(created[windowIndex].url).searchParams.get(
+                          "approval",
+                      )
+                    : null,
             result: () => rpcResult,
         };
     }
@@ -269,6 +294,10 @@ function loadBackground(options) {
         setActiveAddress: (address) => {
             persisted.activeAddress = address;
         },
+        // The user switching network in the toolbar popup.
+        setNetwork: (network) => {
+            chain = network;
+        },
         fromPopup: { url: EXT_URL + "src/popup/index.html" },
     };
 }
@@ -444,6 +473,318 @@ describe("one approval, one broadcast", () => {
     });
 });
 
+// Populating the transaction before the approval window opens is what makes
+// the displayed object the verified object. It also fixes the nonce before the
+// user has answered anything: two requests populated concurrently take the
+// same nonce from a node that has seen neither of them broadcast, and the
+// second can then never be sent, because the only way to give it a fresh nonce
+// is to populate it again after the user has read the old one off the screen.
+// So the second request is refused while the first is unanswered.
+describe("one transaction approval at a time", () => {
+    test("a second eth_sendTransaction while one is pending is refused before it takes a nonce", async () => {
+        const getTransactionCount = jest.fn(async () => NONCE);
+        const bg = loadBackground({ provider: { getTransactionCount } });
+
+        const first = bg.requestTx();
+        await settle();
+        expect(first.id()).toBeTruthy();
+        expect(getTransactionCount).toHaveBeenCalledTimes(1);
+
+        const second = bg.requestTx();
+        await settle();
+
+        expect(second.result()).toEqual({
+            error: {
+                code: -32002,
+                message: expect.stringMatching(
+                    /one transaction at a time.+already in progress/,
+                ),
+            },
+        });
+        // Where the refusal happened matters as much as that it happened: no
+        // second window, and the node was never asked for a second nonce.
+        expect(bg.created).toHaveLength(1);
+        expect(getTransactionCount).toHaveBeenCalledTimes(1);
+
+        // The refusal leaves the pending approval untouched, and it still
+        // sends.
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+    });
+
+    // The slot is only defensible if the wallet was going to raise an approval
+    // anyway. Taken any earlier, a request the wallet refuses outright still
+    // holds it, and any page at all — connected or not — can deny the user's
+    // own transactions for as long as it keeps asking.
+    test("a request the wallet refuses does not take the slot from the connected site", async () => {
+        const bg = loadBackground();
+
+        // Both delivered before either reaches its first suspension point,
+        // which is the interleaving the slot exists for.
+        const stranger = bg.requestTx(TX_PARAMS, UNCONNECTED_ORIGIN);
+        const connected = bg.requestTx();
+        await settle();
+
+        expect(stranger.result()).toEqual({
+            error: { code: 4100, message: "Unauthorized" },
+        });
+        // The connected site's transaction was raised, not refused as one the
+        // user already has in progress.
+        expect(connected.result()).toBeNull();
+        expect(connected.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(1);
+    });
+
+    // The user closes an approval window that looks hung while the attempt
+    // behind it is still running, and that attempt then fails in a way that
+    // would normally leave the approval standing for a retry. There is no
+    // window left to retry in, so leaving it standing answers the requesting
+    // page never — and holds the slot for the life of the worker with it.
+    test("an approval whose window closed under a failed attempt is answered, and frees the next request", async () => {
+        const stalled = deferred();
+        const bg = loadBackground({
+            loadState: async () => {
+                await stalled.promise;
+                throw new Error("The wallet data could not be read.");
+            },
+        });
+
+        const first = bg.requestTx();
+        await settle();
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        // The attempt owns the approval, so closing the window does not settle
+        // it: the attempt may yet broadcast, and it is the one that reports.
+        bg.closeWindow(1);
+        await settle();
+        expect(first.result()).toBeNull();
+
+        stalled.resolve();
+        await settle();
+        expect(first.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+
+        const second = bg.requestTx();
+        await settle();
+        expect(second.result()).toBeNull();
+        expect(second.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    // An approval with no window is one nothing can ever answer.
+    test("a request whose approval window cannot be opened is answered rather than left waiting", async () => {
+        const bg = loadBackground({ noWindow: true });
+
+        const first = bg.requestTx();
+        await settle();
+        expect(first.result()).toEqual({
+            error: {
+                code: -32603,
+                message: expect.stringMatching(
+                    /could not open its approval window/,
+                ),
+            },
+        });
+
+        // And it did not take the slot with it.
+        const second = bg.requestTx();
+        await settle();
+        expect(second.result()).toEqual({
+            error: {
+                code: -32603,
+                message: expect.stringMatching(
+                    /could not open its approval window/,
+                ),
+            },
+        });
+    });
+
+    test("an answered approval frees the next request", async () => {
+        const bg = loadBackground();
+        const first = bg.requestTx();
+        await settle();
+
+        // The user closes the approval window, which rejects it.
+        bg.closeWindow(1);
+        await settle();
+        expect(first.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+
+        const second = bg.requestTx();
+        await settle();
+        expect(second.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    test("a signature request is not held up by a pending transaction", async () => {
+        const bg = loadBackground();
+        bg.requestTx();
+        await settle();
+
+        // A signature consumes no nonce, so it has nothing to collide with.
+        const signing = bg.requestSign();
+        await settle();
+        expect(signing.id()).toBeTruthy();
+        expect(signing.result()).toBeNull();
+        expect(bg.created).toHaveLength(2);
+    });
+});
+
+// A nonce collision found before the transaction reaches the network is the
+// one send failure the wallet can speak about with certainty. The user is told
+// it did not go out and to send it again, rather than being warned it might
+// already be on the chain — which would send them looking for a transaction
+// that does not exist, and stop them retrying the one that never went.
+describe("a nonce collision is reported as a transaction that did not go out", () => {
+    test("a broadcast the node refused for the nonce is not reported as possibly sent", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.broadcastTransaction.mockRejectedValue(
+            Object.assign(new Error("nonce too low"), {
+                code: "NONCE_EXPIRED",
+            }),
+        );
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: pending.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: expect.stringMatching(/nonce had already been used/),
+            retryable: false,
+            stage: "nonce",
+        });
+        expect(pending.result()).toEqual({
+            error: {
+                message: expect.stringMatching(
+                    /transaction was not sent, because its nonce/,
+                ),
+            },
+        });
+    });
+
+    test("a nonce this wallet already broadcast is refused without asking the node again", async () => {
+        const bg = loadBackground();
+        const first = bg.requestTx();
+        await settle();
+
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+
+        // The stubbed node still reports NONCE as the next nonce — a pending
+        // count that lags a broadcast the node has already taken — so this
+        // second approval is populated at a nonce this worker has spent.
+        const second = bg.requestTx();
+        await settle();
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: second.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: expect.stringMatching(/nonce had already been used/),
+            retryable: false,
+            stage: "nonce",
+        });
+        expect(second.result()).toEqual({
+            error: {
+                message: expect.stringMatching(/nonce had already been used/),
+            },
+        });
+    });
+
+    // Nonce spaces are per chain, and the wallet switches networks. A nonce
+    // this wallet spent on one chain says nothing about the same nonce on
+    // another — and low nonces overlap across chains as a matter of course, so
+    // a record that ignored the chain would refuse ordinary transactions,
+    // permanently and with a message that is not true of them.
+    test("a nonce spent on one chain is not refused on another", async () => {
+        const bg = loadBackground();
+
+        const first = bg.requestTx();
+        await settle();
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+
+        // The user switches network. On this chain the address has sent
+        // nothing, so the node populates the next transaction at the same
+        // nonce — correctly.
+        bg.setNetwork(SEPOLIA);
+        const second = bg.requestTx();
+        await settle();
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xbeef" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: second.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE, undefined, SEPOLIA.num),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(2);
+        expect(second.result()).toEqual({ result: "0xbeef" });
+    });
+});
+
 // The approval carries the transaction the user was shown and the address it
 // was raised for, and the artifact is checked against both. Every case here is
 // one the old comparison — against the dApp's request, for the address that is

tests/deleteAddress.test.js

@@ -150,7 +150,7 @@ describe("the balance warning on the removal confirmation", () => {
         expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
     });
 
-    // getAddressValueUsd() returns null on testnet and before the first
+    // getAddressValue() reports no value on testnet and before the first
     // price fetch. A "Total: $0.00" there would be a lie about the holdings.
     test("no USD total is shown when prices are not known", () => {
         expect(balanceWarningHtml(TOKEN_ONLY)).not.toContain("Total:");

tests/e2e/firefox/dapp.js

@@ -0,0 +1,238 @@
+// A loopback dApp origin and stub Ethereum node for the Firefox suite.
+//
+// The Firefox container runs with --network none, and the harness note in
+// driver.js records the consequence: with no http:// origin in reach, no
+// content script was ever injected, so content-script behaviour was
+// UNVERIFIED and the dApp flows could not be driven at all.
+//
+// --network none removes every interface except loopback, and loopback is
+// enough. This serves the page and the JSON-RPC endpoint from 127.0.0.1
+// inside the same container Firefox runs in, so the dApp round trips execute
+// against a real http:// origin and the run stays as offline as it was: the
+// only reachable peer is this process.
+//
+// The page itself is not written twice. DAPP_HTML comes from the Chrome
+// suite's fixture, so both harnesses drive the same __dapp API and the same
+// message log.
+//
+// Unlike driver.js this file does use ethers, and it has to: the node has to
+// answer eth_sendRawTransaction with the hash ethers computes for the
+// artifact it was handed, or provider.broadcastTransaction() refuses the
+// answer, and the suite recovers signatures itself rather than believing the
+// extension's own verdict.
+
+"use strict";
+
+const http = require("http");
+
+const { Transaction } = require("ethers");
+
+const { DAPP_HTML } = require("../network");
+
+// The same fee shape the Chrome suite uses, for the same reason: it has to
+// pass the ceilings in src/shared/approvalVerify.js and it has to leave the
+// reserve and the estimate distinguishable.
+const GAS_LIMIT = 21000n;
+const BASE_FEE_WEI = 100000000000n; // 100 gwei
+const PRIORITY_FEE_WEI = 1000000000n; // 1 gwei
+const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI;
+
+const STUB_BLOCK_NUMBER = 21000000;
+
+// A 32-byte zero word, returned for every eth_call. It is what makes ethers'
+// ENS reverse lookup resolve to "no resolver set" instead of throwing, and a
+// throw there reaches the console through src/shared/log.js, which fails the
+// run on its own.
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+// One ETH, so the popup's balance lines render something and the wallet does
+// not look empty on the approval screen.
+const STUB_BALANCE_WEI = 10n ** 18n;
+
+function hex(value) {
+    return "0x" + BigInt(value).toString(16);
+}
+
+function latestBlock() {
+    return {
+        hash: "0x" + "11".repeat(32),
+        parentHash: "0x" + "22".repeat(32),
+        number: hex(STUB_BLOCK_NUMBER),
+        timestamp: hex(1767326645),
+        nonce: "0x0000000000000000",
+        difficulty: "0x0",
+        gasLimit: "0x1c9c380",
+        gasUsed: "0xf4240",
+        miner: "0xc0ffee0000000000000000000000000000c0ffee",
+        extraData: "0x",
+        baseFeePerGas: hex(BASE_FEE_WEI),
+        transactions: [],
+    };
+}
+
+const RPC_RESULTS = {
+    eth_chainId: "0x1",
+    net_version: "1",
+    eth_blockNumber: hex(STUB_BLOCK_NUMBER),
+    eth_getBalance: hex(STUB_BALANCE_WEI),
+    eth_call: ZERO_WORD,
+    eth_getCode: "0x",
+    eth_gasPrice: hex(GAS_PRICE_WEI),
+    eth_estimateGas: hex(GAS_LIMIT),
+    eth_getTransactionCount: "0x0",
+    eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
+    // "accepted but not mined", which is what a node says about a transaction
+    // it has only just taken. The wait screen the approval hands off to polls
+    // this for the rest of the run.
+    eth_getTransactionReceipt: null,
+    web3_clientVersion: "autistmask-e2e-firefox/0",
+};
+
+// Answer one JSON-RPC call. `broadcast` collects every raw transaction that
+// reached this node, which is what the transaction assertions are made
+// against — the artifact as the node saw it, never as the extension described
+// it.
+function rpcResult(req, state) {
+    const method = req.method;
+
+    if (method === "eth_sendRawTransaction") {
+        const raw = req.params && req.params[0];
+        state.broadcast.push(raw);
+        // ethers checks the hash it is given against the hash it computes for
+        // the artifact it sent, so this cannot be a fixed string.
+        return Transaction.from(raw).hash;
+    }
+
+    if (method === "eth_getBlockByNumber" || method === "eth_getBlockByHash") {
+        return latestBlock();
+    }
+
+    if (Object.prototype.hasOwnProperty.call(RPC_RESULTS, method)) {
+        return RPC_RESULTS[method];
+    }
+
+    // Never a silent default. An unstubbed method answered with null looks
+    // like a working node returning nothing, and the assertion downstream
+    // fails somewhere unrelated.
+    state.unstubbed.push(method);
+    throw new Error("no fixture for JSON-RPC method " + method);
+}
+
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk;
+        });
+        req.on("end", () => resolve(body));
+        req.on("error", reject);
+    });
+}
+
+function handleRpcBody(body, state) {
+    const parsed = JSON.parse(body);
+    const answer = (req) => {
+        try {
+            return {
+                jsonrpc: "2.0",
+                id: req.id,
+                result: rpcResult(req, state),
+            };
+        } catch (e) {
+            return {
+                jsonrpc: "2.0",
+                id: req.id,
+                error: { code: -32601, message: e.message },
+            };
+        }
+    };
+    return Array.isArray(parsed) ? parsed.map(answer) : answer(parsed);
+}
+
+/**
+ * Serve the dApp page and the stub node on loopback.
+ *
+ * @returns {Promise<Object>} the running fixture: `url` and `origin` of the
+ * page, `rpcUrl` for the extension's rpcUrl setting, `broadcast` (the raw
+ * transactions the node received, in order), `unstubbed` (JSON-RPC methods
+ * nothing answered) and `close()`.
+ */
+async function startDappServer() {
+    const state = { broadcast: [], unstubbed: [], requests: [] };
+
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url, "http://127.0.0.1");
+        state.requests.push(req.method + " " + url.pathname);
+
+        if (url.pathname === "/rpc" && req.method === "POST") {
+            readBody(req)
+                .then((body) => {
+                    const payload = JSON.stringify(handleRpcBody(body, state));
+                    res.writeHead(200, {
+                        "Content-Type": "application/json",
+                        // The extension fetches this from its background
+                        // page, whose origin is moz-extension://. Without CORS
+                        // the fetch fails and every transaction assertion
+                        // fails for a reason that has nothing to do with the
+                        // wallet.
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.end(payload);
+                })
+                .catch((e) => {
+                    res.writeHead(500, { "Content-Type": "text/plain" });
+                    res.end(String(e && e.message));
+                });
+            return;
+        }
+
+        if (url.pathname === "/") {
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(DAPP_HTML);
+            return;
+        }
+
+        // An empty favicon rather than a 404: a 404 is a page error in
+        // Firefox's console under some settings, and the suite fails the run
+        // on those.
+        if (url.pathname === "/favicon.ico") {
+            res.writeHead(200, { "Content-Type": "image/x-icon" });
+            res.end("");
+            return;
+        }
+
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("not found");
+    });
+
+    await new Promise((resolve, reject) => {
+        server.on("error", reject);
+        // Port 0: this host runs many sessions at once, and a fixed port is a
+        // guaranteed collision rather than a possible one.
+        server.listen(0, "127.0.0.1", resolve);
+    });
+
+    const { port } = server.address();
+    const origin = "http://127.0.0.1:" + port;
+
+    return {
+        origin,
+        url: origin + "/",
+        rpcUrl: origin + "/rpc",
+        broadcast: state.broadcast,
+        unstubbed: state.unstubbed,
+        requests: state.requests,
+        close: () =>
+            new Promise((resolve) => {
+                server.closeAllConnections();
+                server.close(() => resolve());
+            }),
+    };
+}
+
+module.exports = {
+    GAS_LIMIT,
+    GAS_PRICE_WEI,
+    STUB_BALANCE_WEI,
+    startDappServer,
+};

tests/e2e/firefox/driver.js

@@ -110,6 +110,26 @@ class Driver {
             "extensions.webextensions.uuids": JSON.stringify({
                 [EXTENSION_ID]: EXTENSION_UUID,
             }),
+            // The container has loopback and nothing else. Firefox's own
+            // link-status detection can read that as "offline" and then
+            // refuse every request, including the ones to the loopback dApp
+            // origin the suite serves; this takes the decision away from it.
+            "network.manage-offline-status": false,
+            // Force the site-connection prompt down its windows.create()
+            // fallback.
+            //
+            // src/background/index.js prefers the toolbar-anchored popup for
+            // that one approval and opens a real window only when
+            // openPopup() refuses. A panel is not a top-level browsing
+            // context, so WebDriver cannot see it, list it or click in it —
+            // the same blind spot the Chrome harness documents. Leaving this
+            // at its default would make which path runs depend on whether a
+            // headless Firefox counts as having had a user gesture, which is
+            // not a thing to leave to chance in a suite that has to be able
+            // to fail. The window path is shipped code and the same approval
+            // id, so what is driven is real; what is NOT covered either way
+            // is the panel presentation itself.
+            "extensions.openPopupWithoutUserGesture.enabled": false,
         };
 
         const value = await this.send("POST", "/session", {
@@ -179,6 +199,16 @@ class Driver {
         return this.session("POST", "/execute/sync", { script, args });
     }
 
+    // The asynchronous form: the script is handed a resolve callback as its
+    // last argument and the call settles when that is invoked. Everything
+    // interesting about an extension page is promise-shaped — storage reads,
+    // the provider's own request() — and /execute/sync cannot wait for any
+    // of it.
+    async executeAsync(script, args = []) {
+        await this.setContext("content");
+        return this.session("POST", "/execute/async", { script, args });
+    }
+
     // Runs in the privileged chrome scope, where Services and Ci exist.
     async executeChrome(script, args = []) {
         await this.setContext("chrome");
@@ -329,6 +359,63 @@ class Driver {
             [selector],
         );
     }
+
+    // ------------------------------------------------------------ windows
+    //
+    // The approval prompts this suite drives are separate top-level windows
+    // the extension opens itself, so every one of them is a window handle
+    // here and the suite has to move between them explicitly.
+
+    async windowHandles() {
+        return this.session("GET", "/window/handles");
+    }
+
+    async currentWindow() {
+        return this.session("GET", "/window");
+    }
+
+    async switchToWindow(handle) {
+        await this.setContext("content");
+        await this.session("POST", "/window", { handle });
+    }
+
+    async newWindow(type = "window") {
+        await this.setContext("content");
+        const value = await this.session("POST", "/window/new", { type });
+        return value.handle;
+    }
+
+    // Closes the current window and leaves the session on `fallback`, because
+    // a session whose current window is gone fails every subsequent command
+    // with "no such window" rather than with anything diagnosable.
+    async closeWindow(fallback) {
+        await this.setContext("content");
+        await this.session("DELETE", "/window");
+        if (fallback) await this.switchToWindow(fallback);
+    }
+
+    async url() {
+        return this.session("GET", "/url");
+    }
+
+    // The handle of the first window whose URL matches, or null. Restores the
+    // window that was current before the search either way: a probe that
+    // silently relocates the session is a trap for the step after it.
+    async findWindow(predicate) {
+        const origin = await this.currentWindow();
+        try {
+            for (const handle of await this.windowHandles()) {
+                await this.switchToWindow(handle);
+                if (predicate(await this.url())) return handle;
+            }
+            return null;
+        } finally {
+            // Tolerated: the window the search started from may have been the
+            // one that just closed, and a throw in here would replace the
+            // real result with "no such window".
+            await this.switchToWindow(origin).catch(() => {});
+        }
+    }
 }
 
 // ------------------------------------------------------- error capture
@@ -349,10 +436,15 @@ class Driver {
 // background page, which BiDi would not have covered even if it worked.
 // Background-page capture is verified by probe — a throw at the top of
 // src/background/index.js, which kills the background page outright, fails
-// the run. Content-script errors should arrive by the same route, but that
-// is UNVERIFIED here and must not be claimed: the container runs with
-// --network none, so there is no http:// page for a content script to be
-// injected into and this suite never exercises one.
+// the run.
+//
+// Content scripts ARE now exercised: tests/e2e/firefox/dapp.js serves a page
+// from loopback, which survives --network none, and the suite drives the
+// EIP-1193 round trips through the content script injected into it. What is
+// still unproven is the CAPTURE, not the execution — no probe has forced a
+// throw from inside a content script and watched it fail the run, so an
+// uncaught content-script error arriving by this route remains an
+// expectation rather than a demonstrated fact. Do not claim otherwise.
 //
 // Warnings are excluded so the semantics match Playwright's pageerror:
 // uncaught errors only.

tests/e2e/firefox/run.js

@@ -15,8 +15,15 @@
 // UI steps below are written twice on purpose. Chrome runs on Playwright,
 // which cannot see extension-page errors in Firefox at all (see the BiDi
 // note in driver.js), so the two backends have no common substrate to
-// abstract over. Three duplicated steps do not pay for a shim; revisit if
-// this suite grows to where they do.
+// abstract over. Duplicated steps do not pay for a shim; revisit if this
+// suite grows to where they do. What IS shared is the dApp page fixture
+// itself — DAPP_HTML, served here from loopback by dapp.js — so an assertion
+// about the __dapp API means the same thing on both browsers.
+//
+// The dApp steps need an http:// origin, which --network none was thought to
+// rule out. It does not: loopback survives it, so the page and the stub node
+// are served from 127.0.0.1 inside the container and the run reaches nothing
+// but this process. See tests/e2e/firefox/dapp.js.
 //
 // LIMITATION, and the difference from the Chrome suite worth knowing: error
 // capture here is POLL-BASED, not event-streamed. The console service is
@@ -40,7 +47,21 @@
 const fs = require("fs");
 const path = require("path");
 
+const {
+    Transaction,
+    formatEther,
+    getAddress,
+    getBytes,
+    hexlify,
+    parseEther,
+    toQuantity,
+    toUtf8Bytes,
+    verifyMessage,
+} = require("ethers");
+
 const { ConsoleErrors, EXTENSION_ORIGIN, start, sleep } = require("./driver");
+const { startDappServer } = require("./dapp");
+const { STUB_COUNTERPARTY } = require("../network");
 
 const REPO_ROOT = path.resolve(__dirname, "..", "..", "..");
 const POPUP_URL = EXTENSION_ORIGIN + "/src/popup/index.html";
@@ -137,8 +158,598 @@ step("add token screen opens from address detail", async (env) => {
     assert(picks > 0, "no common-token quick-pick buttons rendered");
 });
 
+// ------------------------------------------------- the dApp round trips
+//
+// Everything above drives the popup on its own. From here the page, the
+// content script, the inpage provider, the background page and the approval
+// window all have to work together — the paths
+// https://git.eeqj.de/sneak/AutistMask/issues/153 rewrote, and the ones no
+// Firefox test reached before. They are asserted here because nothing else
+// covers them on this browser, not because they were broken: these steps
+// pass against the pre-refactor callback code too, which is how the issue's
+// premise was refuted.
+//
+// The shape is the Chrome suite's (tests/e2e/run.js, the #183 section) and
+// the assertions mean the same things:
+//
+//  - the signature is recovered here, in the runner, from the artifact the
+//    extension produced, and compared against the address read out of
+//    extension storage. The background verifies too; these assertions do not
+//    lean on that, because a test that trusted the wallet's own verdict would
+//    pass against a wallet that verified nothing.
+//  - the transaction is asserted against the raw signed transaction that
+//    reached the stub node, not against anything the extension reported.
+//
+// What this does NOT cover: a real dApp with real funds against a real
+// network. The node is a fixture on loopback.
+
+const SIGN_TEXT = "AutistMask e2e round trip: personal_sign";
+const SIGN_HEX = hexlify(toUtf8Bytes(SIGN_TEXT));
+
+const TX_VALUE_ETH = "0.0123";
+const TX_VALUE_WEI = parseEther(TX_VALUE_ETH);
+// Call data that decodes as nothing, so the screen assertion compares the
+// calldata itself rather than a decoder's summary of it.
+const TX_DATA = "0xdeadbeef" + "01".repeat(28);
+
+const USER_REJECTION_MESSAGE = "User rejected the request.";
+
+// Read the extension's persisted state, point its rpcUrl at the loopback stub
+// node, and hand back the active address. Runs on the popup page, which is
+// the one moz-extension:// document the suite has open and therefore the only
+// place the storage API is reachable from.
+async function pointAtStubNode(d, rpcUrl) {
+    const outcome = await d.executeAsync(
+        `const done = arguments[arguments.length - 1];
+         const rpcUrl = arguments[0];
+         const api = typeof browser !== "undefined" ? browser : chrome;
+         Promise.resolve(api.storage.local.get("autistmask"))
+             .then((r) => {
+                 const s = r.autistmask;
+                 if (!s) throw new Error("the extension has no persisted state");
+                 s.rpcUrl = rpcUrl;
+                 const w = s.wallets && s.wallets[0];
+                 const first = w && w.addresses && w.addresses[0];
+                 const address = s.activeAddress || (first && first.address);
+                 if (!address) throw new Error("the extension holds no address");
+                 return Promise.resolve(api.storage.local.set({ autistmask: s }))
+                     .then(() => done({ address: address }));
+             })
+             .catch((e) => done({ error: String((e && e.message) || e) }));`,
+        [rpcUrl],
+    );
+    assert(
+        outcome && !outcome.error,
+        "could not point the extension at the stub node: " +
+            (outcome && outcome.error),
+    );
+    return getAddress(outcome.address);
+}
+
+// The approval window the background opened. Approvals are raised from an RPC
+// call rather than from a user gesture, so the extension opens a real window
+// for them, which is an ordinary window handle here.
+async function waitForApprovalWindow(d, timeout = 30000) {
+    const deadline = Date.now() + timeout;
+    for (;;) {
+        const handle = await d.findWindow((u) => u.includes("?approval="));
+        if (handle) return handle;
+        if (Date.now() > deadline) {
+            throw new Error(
+                "the extension opened no approval window within " +
+                    timeout +
+                    "ms",
+            );
+        }
+        await sleep(100);
+    }
+}
+
+function startRequest(d, key, method, params) {
+    return d.execute(
+        "window.__dapp.start(arguments[0], arguments[1], arguments[2]);" +
+            " return true;",
+        [key, method, params],
+    );
+}
+
+// The settled outcome of a parked request, or {settled:"pending"} if it is
+// still outstanding. A bounded wait rather than a bare await: "returns a
+// rejection rather than hanging" is one of the things under test, and an
+// await would report a hang as a step timeout with no indication of which
+// call never settled.
+function settleRequest(d, key, timeout = 45000) {
+    return d.executeAsync(
+        `const done = arguments[arguments.length - 1];
+         const key = arguments[0];
+         const timeout = arguments[1];
+         Promise.race([
+             window.__dapp.settle(key),
+             new Promise((r) => setTimeout(() => r({ settled: "pending" }), timeout)),
+         ]).then(done, (e) => done({ settled: "error", message: String(e) }));`,
+        [key, timeout],
+    );
+}
+
+// Every AUTISTMASK_* message that has crossed between the page and the
+// content script. This is the boundary half of the rejection assertion: the
+// code has to be on the wire as well as on the Error the page catches, so a
+// pass cannot come from the provider inventing one.
+function dappMessages(d, type) {
+    return d.execute(
+        // `want` is bound outside the callback deliberately: inside it,
+        // arguments[0] is the message being tested, not the script argument,
+        // and the filter silently matches nothing.
+        "var want = arguments[0];" +
+            " return window.__dapp.messages.filter(function (m) {" +
+            " return !want || m.type === want; });",
+        [type || null],
+    );
+}
+
+async function lastResponseError(d) {
+    const responses = await dappMessages(d, "AUTISTMASK_RESPONSE");
+    const last = responses[responses.length - 1];
+    assert(last, "the page received no AUTISTMASK_RESPONSE at all");
+    return last.error || null;
+}
+
+// A rejected prompt, asserted at both ends: the page's promise rejected
+// rather than hanging or resolving, and the response that crossed the
+// boundary carried EIP-1193 code 4001.
+async function assertUserRejection(d, key, label) {
+    const outcome = await settleRequest(d, key);
+    assert(
+        outcome.settled !== "pending",
+        label + " never settled: the rejected prompt left the page hanging",
+    );
+    assert(
+        outcome.settled === "rejected",
+        label + " resolved instead of rejecting: " + JSON.stringify(outcome),
+    );
+    assert(
+        outcome.message === USER_REJECTION_MESSAGE,
+        label + " rejected with the wrong message: " + outcome.message,
+    );
+    const error = await lastResponseError(d);
+    assert(
+        error && error.code === 4001,
+        label +
+            " did not carry EIP-1193 code 4001 across the boundary: " +
+            JSON.stringify(error),
+    );
+    assert(
+        outcome.hasCode,
+        label +
+            " reached the page as an error with no code property at all, so a " +
+            "dApp cannot tell the user's refusal from a failure: " +
+            JSON.stringify(outcome),
+    );
+    assert(
+        outcome.code === 4001,
+        label +
+            " reached the page with code " +
+            JSON.stringify(outcome.code) +
+            " rather than EIP-1193 4001",
+    );
+    assert(
+        outcome.name === "ProviderRpcError",
+        label +
+            " reached the page as " +
+            JSON.stringify(outcome.name) +
+            " rather than an EIP-1193 ProviderRpcError",
+    );
+    console.log(
+        "# " +
+            label +
+            ": code 4001 on the wire and on the page's " +
+            outcome.name,
+    );
+}
+
+step("the loopback dApp page gets the real inpage provider", async (env) => {
+    const d = env.driver;
+
+    // The popup is still the current window; point the extension at the stub
+    // node from there, then reload it so its in-memory copy of the state
+    // carries the new rpcUrl and cannot save the old one back over it.
+    env.address = await pointAtStubNode(d, env.server.rpcUrl);
+    await d.navigate(POPUP_URL);
+    await d.waitVisible("#view-main", STEP_TIMEOUT_MS);
+    env.popupWindow = await d.currentWindow();
+
+    env.dappWindow = await d.newWindow("tab");
+    await d.switchToWindow(env.dappWindow);
+    await d.navigate(env.server.url);
+
+    // window.ethereum is not the fixture's doing — it is the shipped content
+    // script, injected into a real http:// origin. Waiting for it is waiting
+    // for the real provider to have installed itself.
+    await d.waitFor(
+        "the injected EIP-1193 provider and the test page API",
+        "return !!window.ethereum && !!window.__dapp;",
+        [],
+        STEP_TIMEOUT_MS,
+    );
+
+    // EIP-6963, asked of the provider itself. The announcement carries the
+    // uuid src/content/index.js reads out of extension storage — call site 1
+    // in the issue — and it has to name this extension and hand back the very
+    // object on window.ethereum.
+    const announced = await d.executeAsync(
+        `const done = arguments[arguments.length - 1];
+         const onAnnounce = (e) => {
+             window.removeEventListener("eip6963:announceProvider", onAnnounce);
+             done({
+                 rdns: e.detail.info.rdns,
+                 uuid: e.detail.info.uuid,
+                 isWindowEthereum: e.detail.provider === window.ethereum,
+             });
+         };
+         window.addEventListener("eip6963:announceProvider", onAnnounce);
+         window.dispatchEvent(new Event("eip6963:requestProvider"));
+         setTimeout(() => done(null), 15000);`,
+    );
+    assert(announced, "the provider announced itself to no EIP-6963 request");
+    assert(
+        announced.rdns === "berlin.sneak.autistmask",
+        "the announced provider is not this extension: " +
+            JSON.stringify(announced),
+    );
+    assert(
+        announced.isWindowEthereum,
+        "the announced provider is not the object on window.ethereum",
+    );
+    assert(
+        typeof announced.uuid === "string" && announced.uuid.length === 36,
+        "the announcement carries no stored provider uuid: " +
+            JSON.stringify(announced.uuid),
+    );
+
+    // A full page -> content script -> background round trip that needs no
+    // approval, so the relay is proven before any prompt is driven. This is
+    // call site 2, the one that used to fail for every window.ethereum
+    // request a dApp made.
+    const chainId = await d.executeAsync(
+        `const done = arguments[arguments.length - 1];
+         window.ethereum.request({ method: "eth_chainId" }).then(
+             (r) => done({ ok: r }),
+             (e) => done({ err: String((e && e.message) || e) }),
+         );`,
+    );
+    assert(
+        chainId && chainId.ok === "0x1",
+        "eth_chainId did not round trip through the extension: " +
+            JSON.stringify(chainId),
+    );
+    console.log(
+        "# dapp origin " + env.server.origin + " active address " + env.address,
+    );
+});
+
+step(
+    "eth_requestAccounts approved returns the selected address",
+    async (env) => {
+        const d = env.driver;
+        await d.switchToWindow(env.dappWindow);
+        await startRequest(d, "accounts", "eth_requestAccounts", []);
+
+        const popup = await waitForApprovalWindow(d);
+        await d.switchToWindow(popup);
+        await d.waitVisible("#view-approve-site");
+
+        const hostname = await d.text("#approve-hostname");
+        assert(
+            hostname === "127.0.0.1",
+            "the site prompt names the wrong origin: " +
+                JSON.stringify(hostname),
+        );
+        const shown = await d.text("#approve-address");
+        assert(
+            shown.toLowerCase().includes(env.address.toLowerCase()),
+            "the site prompt shows the wrong address: " + JSON.stringify(shown),
+        );
+
+        // Remembered, so the origin stays authorized for the sign and transaction
+        // steps below.
+        const checked = await d.execute(
+            'return document.getElementById("approve-remember").checked;',
+        );
+        if (!checked) await d.click("#approve-remember");
+        await d.click("#btn-approve");
+
+        // The approve button closes its own window, so get off it before asking
+        // the page anything.
+        await d.switchToWindow(env.dappWindow);
+        const outcome = await settleRequest(d, "accounts");
+        assert(
+            outcome.settled === "resolved",
+            "eth_requestAccounts did not resolve: " + JSON.stringify(outcome),
+        );
+        assert(
+            Array.isArray(outcome.result) && outcome.result.length === 1,
+            "eth_requestAccounts returned no single account: " +
+                JSON.stringify(outcome.result),
+        );
+        assert(
+            getAddress(outcome.result[0]) === env.address,
+            "eth_requestAccounts returned " +
+                outcome.result[0] +
+                ", not the selected address " +
+                env.address,
+        );
+    },
+);
+
+step(
+    "personal_sign returns a signature that recovers to the address",
+    async (env) => {
+        const d = env.driver;
+        await d.switchToWindow(env.dappWindow);
+        await startRequest(d, "sign", "personal_sign", [SIGN_HEX, env.address]);
+
+        const popup = await waitForApprovalWindow(d);
+        await d.switchToWindow(popup);
+        await d.waitVisible("#view-approve-sign");
+
+        const screen = await d.execute(
+            `return {
+             hostname: document.getElementById("approve-sign-hostname").textContent,
+             type: document.getElementById("approve-sign-type").textContent,
+             message: document.getElementById("approve-sign-message").textContent,
+             from: document.getElementById("approve-sign-from").textContent,
+         };`,
+        );
+        assert(
+            screen.hostname === "127.0.0.1",
+            "the sign prompt names the wrong origin: " +
+                JSON.stringify(screen.hostname),
+        );
+        assert(
+            screen.type === "Personal message",
+            "the sign prompt reports the wrong type: " +
+                JSON.stringify(screen.type),
+        );
+        assert(
+            screen.message === SIGN_TEXT,
+            "the sign prompt shows the wrong message: " +
+                JSON.stringify(screen.message),
+        );
+        assert(
+            screen.from.toLowerCase().includes(env.address.toLowerCase()),
+            "the sign prompt shows the wrong signing address: " +
+                JSON.stringify(screen.from),
+        );
+
+        await d.fill("#approve-sign-password", PASSWORD);
+        await d.click("#btn-approve-sign");
+
+        await d.switchToWindow(env.dappWindow);
+        const outcome = await settleRequest(d, "sign");
+        assert(
+            outcome.settled === "resolved",
+            "personal_sign did not resolve: " + JSON.stringify(outcome),
+        );
+        const recovered = getAddress(
+            verifyMessage(getBytes(SIGN_HEX), outcome.result),
+        );
+        console.log(
+            "# personal_sign: recovered=" +
+                recovered +
+                " expected=" +
+                env.address,
+        );
+        assert(
+            recovered === env.address,
+            "the personal_sign signature recovers to " +
+                recovered +
+                ", not to the approved address " +
+                env.address,
+        );
+    },
+);
+
+step(
+    "eth_sendTransaction shows the transaction and returns its hash",
+    async (env) => {
+        const d = env.driver;
+        const before = env.server.broadcast.length;
+
+        await d.switchToWindow(env.dappWindow);
+        await startRequest(d, "tx", "eth_sendTransaction", [
+            {
+                from: env.address,
+                to: STUB_COUNTERPARTY,
+                value: toQuantity(TX_VALUE_WEI),
+                data: TX_DATA,
+            },
+        ]);
+
+        const popup = await waitForApprovalWindow(d);
+        await d.switchToWindow(popup);
+        await d.waitVisible("#view-approve-tx");
+
+        const screen = await d.execute(
+            `return {
+             hostname: document.getElementById("approve-tx-hostname").textContent,
+             from: document.getElementById("approve-tx-from").textContent,
+             to: document.getElementById("approve-tx-to").textContent,
+             value: document.getElementById("approve-tx-value").textContent,
+             data: document.getElementById("approve-tx-data").textContent,
+             dataShown: !document
+                 .getElementById("approve-tx-data-section")
+                 .classList.contains("hidden"),
+         };`,
+        );
+        assert(
+            screen.hostname === "127.0.0.1",
+            "the transaction prompt names the wrong origin: " +
+                JSON.stringify(screen.hostname),
+        );
+        assert(
+            screen.from.toLowerCase().includes(env.address.toLowerCase()),
+            "the transaction prompt shows the wrong sender: " +
+                JSON.stringify(screen.from),
+        );
+        assert(
+            screen.to.toLowerCase().includes(STUB_COUNTERPARTY.toLowerCase()),
+            "the transaction prompt shows the wrong recipient: " +
+                JSON.stringify(screen.to),
+        );
+        assert(
+            screen.value.startsWith(TX_VALUE_ETH + " ETH"),
+            "the transaction prompt shows the wrong value: " +
+                JSON.stringify(screen.value),
+        );
+        assert(
+            screen.dataShown && screen.data === TX_DATA,
+            "the transaction prompt does not show the approved call data: " +
+                JSON.stringify(screen.data),
+        );
+
+        await d.fill("#approve-tx-password", PASSWORD);
+        await d.click("#btn-approve-tx");
+
+        // The approval window hands off to the wait screen rather than closing,
+        // and the hash it shows is asserted before it is retired: left open it
+        // polls the stub node for a receipt for the rest of the run.
+        await d.waitVisible("#view-wait-tx", STEP_TIMEOUT_MS);
+        const waitHash = await d.text("#wait-tx-hash");
+
+        await d.switchToWindow(env.dappWindow);
+        const outcome = await settleRequest(d, "tx");
+        assert(
+            outcome.settled === "resolved",
+            "eth_sendTransaction did not resolve: " + JSON.stringify(outcome),
+        );
+
+        // The artifact as the node saw it, not as the extension described it.
+        assert(
+            env.server.broadcast.length === before + 1,
+            "expected exactly one raw transaction to reach the node, got " +
+                (env.server.broadcast.length - before),
+        );
+        const signed = Transaction.from(
+            env.server.broadcast[env.server.broadcast.length - 1],
+        );
+        console.log(
+            "# eth_sendTransaction: signer=" +
+                getAddress(signed.from) +
+                " to=" +
+                getAddress(signed.to) +
+                " value=" +
+                formatEther(signed.value) +
+                " chainId=" +
+                signed.chainId,
+        );
+        assert(
+            getAddress(signed.from) === env.address,
+            "the broadcast transaction was signed by " +
+                getAddress(signed.from) +
+                ", not by the approved address " +
+                env.address,
+        );
+        assert(
+            getAddress(signed.to) === getAddress(STUB_COUNTERPARTY),
+            "the broadcast transaction goes to " + signed.to,
+        );
+        assert(
+            signed.value === TX_VALUE_WEI,
+            "the broadcast transaction carries " +
+                formatEther(signed.value) +
+                " ETH, not the approved " +
+                TX_VALUE_ETH,
+        );
+        assert(
+            signed.data === TX_DATA,
+            "the broadcast transaction carries different call data: " +
+                signed.data,
+        );
+        assert(
+            signed.chainId === 1n,
+            "the broadcast transaction is for chain " + signed.chainId,
+        );
+        assert(
+            outcome.result === signed.hash,
+            "the page received " +
+                outcome.result +
+                ", not the hash of the broadcast transaction " +
+                signed.hash,
+        );
+        assert(
+            waitHash.includes(signed.hash),
+            "the wait screen shows a different hash: " +
+                JSON.stringify(waitHash),
+        );
+
+        await d.switchToWindow(popup);
+        await d.closeWindow(env.dappWindow);
+    },
+);
+
+step(
+    "closing an approval window rejects the request with 4001",
+    async (env) => {
+        const d = env.driver;
+        const before = env.server.broadcast.length;
+
+        await d.switchToWindow(env.dappWindow);
+        await startRequest(d, "sign-closed", "personal_sign", [
+            SIGN_HEX,
+            env.address,
+        ]);
+
+        const popup = await waitForApprovalWindow(d);
+        await d.switchToWindow(popup);
+        await d.waitVisible("#view-approve-sign");
+
+        // Closed, not rejected: this is the windows.onRemoved path, which can
+        // only fire if windows.create() handed back a window id for the
+        // approval to be matched against — call site 4 in the issue, and the
+        // reason suppressing that write-back turns this step red.
+        await d.closeWindow(env.dappWindow);
+
+        await assertUserRejection(d, "sign-closed", "a closed approval window");
+        assert(
+            env.server.broadcast.length === before,
+            "a closed approval window still put a transaction on the node",
+        );
+    },
+);
+
 // ------------------------------------------------------------- runner
 
+// Uncaught extension errors that are known, tracked and deliberately
+// tolerated, in the same spirit as ALLOWED_ERRORS in tests/e2e/harness.js:
+// every entry names the issue that will delete it, and every occurrence is
+// still printed, so tolerating one is visible in the log rather than silent.
+// This is the only concession in an otherwise zero-tolerance policy.
+const ALLOWED_ERRORS = [
+    {
+        // The site-connection buttons in src/popup/views/approval.js send
+        // their decision and call window.close() on the next line. Firefox's
+        // BaseContext.wrapPromise reports, through Cu.reportError, any
+        // extension-API promise that settles after its context unloaded —
+        // whether or not the caller attached a handler, so notify()'s catch
+        // cannot suppress it.
+        //
+        // Pre-existing, and not introduced by the promise shim: the send was
+        // already unawaited, and this suite is merely the first thing to
+        // drive that window on Firefox. It is the same teardown ordering as
+        // the issue below, whose fix — making the outcome independent of when
+        // the popup closes — removes this entry with it.
+        pattern: /Promise (?:resolved|rejected) after context unloaded/,
+        source: /\/src\/popup\/index\.js$/,
+        issue: "https://git.eeqj.de/sneak/AutistMask/issues/275",
+    },
+];
+
+function allowedFor(e) {
+    return ALLOWED_ERRORS.find(
+        (a) => a.pattern.test(e.msg) && a.source.test(e.src),
+    );
+}
+
 function formatError(e) {
     return (
         e.msg + " (" + e.src + ":" + e.line + (e.cat ? ", " + e.cat : "") + ")"
@@ -165,6 +776,21 @@ async function main() {
         return;
     }
 
+    // Loopback survives --network none, so this is the http:// origin the
+    // dApp steps need and the node they talk to. Started before the browser
+    // so its url is available to the first step that asks for it.
+    let server;
+    try {
+        server = await startDappServer();
+    } catch (e) {
+        console.error(
+            "e2e-firefox: cannot serve the dApp fixture: " + e.message,
+        );
+        process.exitCode = 1;
+        return;
+    }
+    console.log("# dapp fixture: " + server.url + " rpc " + server.rpcUrl);
+
     let driver;
     try {
         driver = await start();
@@ -175,12 +801,20 @@ async function main() {
         // absent suite. Never skip and report success.
         console.error("e2e-firefox: cannot run the suite: " + e.message);
         if (driver) await driver.quit().catch(() => {});
+        await server.close();
         process.exitCode = 1;
         return;
     }
 
     const errors = new ConsoleErrors(driver, EXTENSION_ORIGIN);
-    const env = { driver, phrase: null };
+    const env = {
+        driver,
+        server,
+        phrase: null,
+        address: null,
+        dappWindow: null,
+        popupWindow: null,
+    };
 
     console.log("# extension origin: " + EXTENSION_ORIGIN);
     console.log("1.." + steps.length);
@@ -232,6 +866,20 @@ async function main() {
                 installFailure = null;
             }
 
+            // Tolerated errors are set aside, never dropped: each one is
+            // printed with the issue that keeps it on the list, so the
+            // concession stays in the run output.
+            const tolerated = found.filter((e) => allowedFor(e));
+            found = found.filter((e) => !allowedFor(e));
+            for (const e of tolerated) {
+                console.log(
+                    "# tolerated (" +
+                        allowedFor(e).issue +
+                        "): " +
+                        formatError(e),
+                );
+            }
+
             // Any uncaught error from an extension source fails the step
             // that provoked it, whether or not its assertions passed.
             if (!failure && found.length > 0) {
@@ -256,7 +904,13 @@ async function main() {
         // blamed on any one step, but they are still reported and they
         // still fail the run.
         await sleep(1000);
-        const trailing = await errors.take();
+        const trailingAll = await errors.take();
+        for (const e of trailingAll.filter((x) => allowedFor(x))) {
+            console.log(
+                "# tolerated (" + allowedFor(e).issue + "): " + formatError(e),
+            );
+        }
+        const trailing = trailingAll.filter((e) => !allowedFor(e));
         console.log(
             "# " +
                 (steps.length - failed) +
@@ -273,12 +927,25 @@ async function main() {
             );
             for (const e of trailing) console.log("#   " + formatError(e));
         }
+        // A JSON-RPC method nothing answered means the extension asked the
+        // node something this fixture does not model, and whatever depended
+        // on the answer took the error branch instead. That is a hole in the
+        // fixture, not a pass.
+        if (server.unstubbed.length > 0) {
+            console.log(
+                "# FAILED: no fixture for JSON-RPC method(s) " +
+                    [...new Set(server.unstubbed)].join(", "),
+            );
+            process.exitCode = 1;
+        }
+
         if (failed > 0 || trailing.length > 0) {
             console.log("# FAILED");
             process.exitCode = 1;
         }
     } finally {
         await driver.quit().catch(() => {});
+        await server.close();
     }
 }
 

tests/e2e/network.js

@@ -93,6 +93,13 @@ function word(value) {
 // is put there by the shipped manifest's MAIN-world content script, exactly
 // as it is on any http(s) page a user visits, so what these tests speak to
 // is the real inpage provider and not a copy the harness wired up.
+//
+// DAPP_HTML below is exported and served verbatim by the Firefox suite too
+// (tests/e2e/firefox/dapp.js), from a loopback origin rather than through a
+// route handler. The two suites drive different browsers over different
+// protocols, but the page they drive — the __dapp API, the message log — is
+// one fixture, so an assertion written against it means the same thing on
+// both.
 const DAPP_ORIGIN = "https://dapp.e2e.test";
 const DAPP_URL = DAPP_ORIGIN + "/";
 
@@ -686,6 +693,7 @@ async function installNetworkStubs(ctx, opts) {
 
 module.exports = {
     installNetworkStubs,
+    DAPP_HTML,
     DAPP_ORIGIN,
     DAPP_URL,
     FEE_ESTIMATE_WEI,