fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

TODO.md

@@ -54,8 +54,7 @@ then continue tagging as milestones land.
   or closing the prompt answers 4001. One such prompt per site at a time. The
   approval window no longer shows the connection prompt while it waits for the
   background to describe the approval, because that prompt's "Allow" answers on
-  the same port as the new one; `tests/approvalWindow.test.js` checks that it
+  the same port as the new one. `tests/chainSwitchGate.test.js` and both browser
-  shows no screen until then. `tests/chainSwitchGate.test.js` and both browser
   suites drive the prompt.
 
 - 2026-10-07: Two contradictions between the documents and the code are resolved

src/popup/views/approval.js

@@ -329,9 +329,9 @@ function showTxApproval(details) {
     const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
     const usdStr = formatUsd(ethUsd);
     // In the native currency of the network the transaction is for, which the
-    // Network line names, not the active network's: the active network can
+    // Network line names, not the active network's: a site can switch the
-    // change, in Settings or when the user approves a site's request, after
+    // active network after this transaction is prepared and back before it is
-    // this transaction is prepared and change back before it is signed.
+    // signed.
     $("approve-tx-value").textContent =
         ethValueFormatted +
         " " +

src/popup/views/transactionDetail.js

@@ -84,9 +84,8 @@ function show(tx) {
             contractAddress: tx.contractAddress || null,
             // The network the history entry was read from. The type line and
             // the fee are in its native currency, not the active network's:
-            // the active network can change, in Settings or when the user
+            // a site can switch the active network before a later popup
-            // approves a site's request, before a later popup shows this
+            // shows this screen again.
-            // screen again.
             chainId: tx.chainId,
         },
     };

src/popup/views/txStatus.js

@@ -89,9 +89,8 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
 
     // A native amount, here and on the success and error screens, is in the
     // native currency of txInfo.chainId, the network the transaction was sent
-    // on, not the active network's: the active network can change, in
+    // on, not the active network's: a site can switch the active network
-    // Settings or when the user approves a site's request, while this screen
+    // while this screen is open or before a later popup resumes it.
-    // is open or before a later popup resumes it.
     const symbol =
         txInfo.token === "ETH"
             ? nativeCurrencyByChainId(txInfo.chainId)

tests/approvalWindow.test.js

@@ -1,47 +0,0 @@
-// The approval window shows no screen until the background has described the
-// approval it answers (https://git.eeqj.de/sneak/AutistMask/issues/408). The
-// connection prompt's "Allow" and the network switch prompt's "Switch" answer
-// on the same port, so a window that showed the connection prompt while it
-// waited could approve a network switch.
-//
-// Booted through the real popup entry point, which is where the connection
-// prompt used to be put up before the background had answered.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    settle,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-afterEach(cleanupPopup);
-
-test("the approval window shows no screen until the background describes the approval", async () => {
-    // The background's answer, held until the test gives it.
-    let answer = null;
-    const env = await bootPopup(unversionedValidProfile(), {
-        search: "?approval=approval-1",
-        runtime: {
-            connect: () => ({ postMessage: () => {} }),
-            sendMessage: (msg, reply) => {
-                if (msg.type === "AUTISTMASK_GET_APPROVAL") answer = reply;
-            },
-        },
-    });
-
-    expect(answer).not.toBeNull();
-    // No screen at all, the connection prompt included.
-    expect(env.visibleViews()).toEqual([]);
-
-    answer({
-        type: "network",
-        origin: "https://dapp.example",
-        currentNetworkId: "mainnet",
-        requestedNetworkId: "sepolia",
-        isPhishingDomain: false,
-    });
-    await settle();
-
-    expect(env.visibleViews()).toEqual(["approve-network"]);
-    expect(env.pageErrors).toEqual([]);
-});

tests/nativeCurrency.test.js

@@ -345,10 +345,10 @@ describe.each([
 });
 
 // A transaction's value and fee are in the native currency of the network the
-// transaction is on, which need not be the active one. The active network can
+// transaction is on, which need not be the active one. A site can switch the
-// change, in Settings or when the user approves a site's request, after a
+// active network after its transaction is prepared and back before it is
-// transaction is prepared and change back before it is signed, and a popup
+// signed, and a popup opened after a switch shows a sent or listed transaction
-// opened after a switch shows a sent or listed transaction again. The wallet's balances follow the active network; these do not.
+// again. The wallet's balances follow the active network; these do not.
 describe.each([
     ["mainnet", "sepolia", "ETH"],
     ["sepolia", "mainnet", "SepoliaETH"],

tests/support/popupBoot.js

@@ -238,10 +238,6 @@ async function settle() {
  * @param {object} [options]
  * @param {object} [options.storage] a storage stub from makeStorageStub(), for
  *     a test that needs to make writes fail or to watch the round trips.
- * @param {string} [options.search] the page URL's query string, such as
- *     "?approval=" and an id for the popup opened as an approval window.
- * @param {object} [options.runtime] members of chrome.runtime that replace the
- *     stub's own, for a test that has to answer the background's messages.
  * @returns {Promise<object>} handles onto the booted page.
  */
 async function bootPopup(stored, options) {
@@ -285,13 +281,12 @@ async function bootPopup(stored, options) {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,
             onMessage: { addListener: () => {} },
-            ...(options && options.runtime),
         },
     };
     globalThis.document = document;
     globalThis.window = {
         location: {
-            search: (options && options.search) || "",
+            search: "",
             href: "chrome-extension://autistmask/src/popup/index.html",
             reload: () => reloads.push(Date.now()),
         },