docs: add third-party file attribution to LICENSE and README

- Vendor community-maintained phishing domain blocklist into
  src/shared/phishingBlocklist.json (bundled at build time by esbuild)
- Refactor phishingDomains.js: build vendored Sets at module load,
  fetch live list periodically, keep only delta (new entries not in
  vendored) in memory for small runtime footprint
- Domain checker checks delta first (fresh scam sites), then vendored
- Persist delta to localStorage if under 256 KiB
- Load delta from localStorage on startup for instant coverage
- Add startPeriodicRefresh() with 24h setInterval in background script
- Remove dead code: popup's local isPhishingDomain() re-check was inert
  (popup never called updatePhishingList so its blacklistSet was always
  empty); now relies solely on background's authoritative flag
- Remove all competitor name mentions from UI warning text and comments
- Update README: document phishing domain protection architecture,
  update external services list
- Update tests: cover vendored blocklist loading, delta computation,
  localStorage persistence, delta+vendored interaction

Closes #114

.gitea/workflows/check.yml

@@ -6,4 +6,4 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .

Dockerfile

@@ -1,15 +1,13 @@
 # node:22-slim (22.x LTS), 2026-02-24
 FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 
+RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
+RUN corepack enable && corepack prepare yarn@1.22.22 --activate
+
 WORKDIR /app
 
-# script/bootstrap installs all prerequisites (make via apt here; node
-# is already in the base image, yarn comes via corepack) and runs
-# yarn install --frozen-lockfile. Dependency manifests are copied first
-# so the bootstrap layer is cached until they change.
-COPY script/ script/
 COPY package.json yarn.lock ./
-RUN script/bootstrap
+RUN yarn install --frozen-lockfile
 
 COPY . .
 

Makefile

@@ -1,38 +1,25 @@
-.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build clean dev
+.PHONY: install test lint fmt fmt-check check docker hooks build clean dev
-
-# Standard targets are thin shims; the implementations live in script/
-# per the scripts-to-rule-them-all pattern (see the Entrypoints section
-# of README.md).
-
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
 
 install:
 	@yarn install
 
 test:
-	@script/test
+	@echo "Running tests..."
+	@timeout 30 yarn run test 2>&1
 
 lint:
-	@script/lint
+	@echo "Linting..."
+	@yarn run lint 2>&1
 
 fmt:
-	@script/fmt
+	@echo "Formatting..."
+	@yarn run fmt 2>&1
 
 fmt-check:
-	@script/fmt-check
+	@echo "Checking formatting..."
+	@yarn run fmt-check 2>&1
 
-check:
+check: test lint fmt-check
-	@script/check
-
-docker:
-	@script/docker
-
-hooks:
-	@script/install-precommit
 
 build:
 	@echo "Building extension..."
@@ -44,3 +31,15 @@ clean:
 dev:
 	@echo "Building in watch mode..."
 	@yarn run build --watch 2>&1
+
+docker:
+	@docker build -t autistmask .
+
+hooks:
+	@echo "Installing pre-commit hook..."
+	@mkdir -p .git/hooks
+	@echo '#!/usr/bin/env bash' > .git/hooks/pre-commit
+	@echo 'set -euo pipefail' >> .git/hooks/pre-commit
+	@echo 'make check' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."

README.md

@@ -42,29 +42,6 @@ Load the extension:
 - **Firefox**: Navigate to `about:debugging#/runtime/this-firefox`, click "Load
   Temporary Add-on", and select `dist/firefox/manifest.json`.
 
-## Entrypoints
-
-This repository adheres to the
-[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call them. We
-provide:
-
-- `script/bootstrap` — install all dependencies (pinned node via nvm if needed,
-  yarn via corepack, `yarn install --frozen-lockfile`)
-- `script/setup` — make a fresh clone ready for development: bootstrap plus the
-  git pre-commit hook
-- `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run the test suite (jest)
-- `script/lint` — run the linter
-- `script/fmt` — format all files (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run test, lint, and fmt-check
-- `script/docker` — build the Docker image tagged via `script/projectname`
-- `script/cibuild` — CI entrypoint: plain `docker build .`
-- `script/precommit` — run by the git pre-commit hook; runs `script/check`
-- `script/install-precommit` — install the git pre-commit hook
-
 ## Rationale
 
 Common popular EVM wallets have become bloated with swap UIs, portfolio
@@ -460,29 +437,25 @@ transitions.
 #### TransactionDetail
 
 - **When**: User tapped a transaction row from AddressDetail or AddressToken.
-- **Elements** (grouped into logical blocks using light well containers; field
+- **Elements**:
-  labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
-    - Transaction hash: full hash (tap to copy) + etherscan link
     - Type: transaction classification — one of: Native ETH Transfer, ERC-20
       Token Transfer, Swap, Token Approval, Contract Call, Contract Creation
-    - Status: "Success" or "Failed"
-    - From: blockie + color dot + full address (tap to copy) + etherscan link;
-      ENS name if available
-    - To: blockie + color dot + full address (tap to copy) + etherscan link; ENS
-      name if available
-    - Time: ISO datetime + relative age in parentheses
-    - Block: block number (tap to copy) + etherscan block link
-    - Amount: value + symbol (bold)
-    - Native quantity: raw integer + unit (shown when available)
     - Token contract: shown for ERC-20 transfers — color dot + full contract
       address (tap to copy) + etherscan token link
-    - Decoded details (shown for contract calls): action name, decoded
+    - Status: "Success" or "Failed"
-      parameters, token details, swap steps
+    - Time: ISO datetime + relative age in parentheses
-    - Network details (shown when on-chain data is available): nonce, gas price,
+    - Amount: value + symbol (bold)
-      gas used, transaction fee (all tap to copy)
+    - From: blockie + color dot + full address (tap to copy) + etherscan link
-    - Raw data (shown when calldata is present): full calldata in monospace
+        - ENS name if available
-      dashed border
+    - To: blockie + color dot + full address (tap to copy) + etherscan link
+        - ENS name if available
+    - Transaction hash: full hash (tap to copy) + etherscan link
+    - Block: block number (tap to copy) + etherscan block link
+    - Nonce: transaction nonce (tap to copy)
+    - Transaction fee: ETH amount (tap to copy)
+    - Gas price: value in Gwei (tap to copy)
+    - Gas used: integer (tap to copy)
 - **Transitions**:
     - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
 
@@ -826,7 +799,8 @@ small while ensuring fresh coverage of new phishing domains.
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all
-parent domains (subdomain matching).
+parent domains (subdomain matching), with whitelist overrides for legitimate
+sites that share a parent domain with a blocklisted entry.
 
 #### Transaction Decoding
 

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-02-22
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,46 +34,10 @@ style conventions are in separate documents:
   every file before committing. There are zero exceptions to this rule.
 
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  `make hooks` (installs pre-commit hook). A model Makefile is at
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the single
@@ -93,83 +57,11 @@ style conventions are in separate documents:
   as a build step so the build fails if the branch is not green. For non-server
   repos, the Dockerfile should bring up a development environment and run
   `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
+  stage before the final image is assembled.
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
-
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
-
-    The standard pattern for a Go repo Dockerfile is:
-
-    ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make fmt-check
-    RUN make lint
-
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make test
-
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
-
-    # Runtime stage
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  Dockerfile already runs `make check`, a successful build implies all checks
+  a successful build implies all checks pass.
-  pass.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -177,11 +69,9 @@ style conventions are in separate documents:
   Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
   HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
 
-- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+- Pre-commit hook: `make check` if local testing is possible, otherwise
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  target to install the pre-commit hook.
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
 
 - All repos with software must have tests that run via the platform-standard
   test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -192,42 +82,6 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
   Makefile.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -timeout 30s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
-    ```
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
-
 - Docker builds must complete in under 5 minutes.
 
 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -244,13 +98,6 @@ style conventions are in separate documents:
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
   a new repo.
 
-- **No build artifacts in version control.** Code-derived data (compiled
-  bundles, minified output, generated assets) must never be committed to the
-  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
-  should generate these at build time. Notable exception: Go protobuf generated
-  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
-  downloads code but does not execute code generation.
-
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 
 - Never force-push to `main`.
@@ -274,76 +121,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
   `PORT`.
 
-- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
 - `README.md` is the primary documentation. Required sections:
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
       git-frontend webhooks and deploys applications via Docker in realtime."
     - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
     - **Rationale**: Why does this exist?
     - **Design**: How is the program structured?
     - **TODO**: Update meticulously, even between commits. When planning, put
@@ -361,14 +144,8 @@ style conventions are in separate documents:
 - Use SemVer.
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary.
+  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
-    - `000_migration.sql` — contains ONLY the creation of the migrations
+  Post-1.0.0: add new migration files.
-      tracking table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
   settings.
@@ -398,9 +175,6 @@ style conventions are in separate documents:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
     - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`

TODO.md

@@ -1,56 +0,0 @@
-# Workflow
-
-- branch (from `main`)
-- do the work in Next Step
-- move Next Step to the top of Completed Steps
-- move the top item of Future Steps into Next Step
-- commit (`TODO.md` changes in the same commit as the work)
-- merge to `main` if the branch is not protected, otherwise open a PR
-- push
-
-# Status
-
-pre-1.0. Tagged v0.1.0 on 2026-02-27. Active development on branch
-feat/issue-144-settings-about (another agent working as of 2026-07-06). Full
-policy file set present; make check on main not verified.
-
-# Next Step
-
-Land feat/issue-144-settings-about: finish the settings About well (build info,
-app name and repo link, release date, version click easter egg, git info derived
-inside Docker), resolve the untracked scripts/ directory (commit or gitignore),
-get review, merge to main.
-
-# Completed Steps
-
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-  shims, README Entrypoints section
-- 2026-03-01: About well in settings with build info and easter egg (in flight
-  on feature branch); USD display suppressed on testnets (#142); estimated USD
-  for ETH in approve-tx view (#141).
-- Sepolia testnet support (#137); etherscan links go to token-specific URLs
-  (#136).
-- Transaction detail improvements: Type field and on-chain details (#130),
-  txid-first reordering (#133), swap display corrections (#128), expanded
-  confirm-tx warnings (#118).
-- Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
-  timestamps include timezone offset (#120); layout shift audit, reserved space
-  for error messages (#124).
-- Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
-  duplicate detection (#115).
-- 2026-02-27: v0.1.0 tagged.
-- 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
-  ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
-  reverse resolution.
-
-# Future Steps
-
-- Verify main passes make check after the feature branch merges (not verified
-  2026-07-06 because an agent was active in the tree); fix anything red. main
-  must always be green.
-- Prune stale branches: dozens of merged local and remote feature branches
-  remain (fix/_, feature/_, tx-\*); delete merged ones locally and on origin.
-- Continue the issue backlog toward a feature-complete wallet, then cut further
-  tags as milestones land.
-- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag.

script/bootstrap

@@ -1,143 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
-# used directly if installed; otherwise it is installed at a pinned
-# version via nvm (installing nvm itself first, from a hash-verified
-# release archive, never curl | sh).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-07
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
-PKGMGR=""
-SUDO=""
-APT_UPDATED=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt)
-            if [ -z "$APT_UPDATED" ]; then
-                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
-                APT_UPDATED=1
-            fi
-            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
-            ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-ensure_node() {
-    if ! missing node; then return 0; fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-}
-
-ensure_yarn() {
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    if missing make; then pkg_install gnumake make make make; fi
-    if missing git; then pkg_install git git git git; fi
-
-    ensure_node
-    ensure_yarn
-    install_js_deps
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs make check, so
-# a successful build implies all checks pass.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build .
-}
-
-main "$@"

script/docker

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Formatting..."
-    yarn run fmt 2>&1
-}
-
-main "$@"

script/fmt-check

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Checking formatting..."
-    yarn run fmt-check 2>&1
-}
-
-main "$@"

script/install-precommit

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
-    chmod +x "$hook"
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Linting..."
-    yarn run lint 2>&1
-}
-
-main "$@"

script/precommit

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "autistmask"
-}
-
-main "$@"

script/setup

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies and the git pre-commit hook.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Running tests..."
-    timeout 30 yarn run test 2>&1
-}
-
-main "$@"

scripts/apply-enrichment.mjs

@@ -1,161 +0,0 @@
-#!/usr/bin/env node
-// Apply enrichment data to tokenList.js: add name + url fields to each token.
-
-import { readFileSync, writeFileSync } from "fs";
-
-const enrichment = JSON.parse(
-    readFileSync("scripts/token-enrichment.json", "utf8"),
-);
-
-// Well-known URLs for major tokens not in ethereum-lists.
-// These are official project websites verified from public sources.
-const EXTRA_URLS = {
-    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
-    "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",
-    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": "https://www.bnbchain.org",
-    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": "https://www.circle.com/usdc",
-    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": "https://sky.money",
-    "0x2AF5D2aD76741191D15Dfe7bF6aC92d4Bd912Ca3": "https://www.bitfinex.com",
-    "0x514910771AF9Ca656af840dff83E8264EcF986CA": "https://chain.link",
-    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": "https://ethena.fi",
-    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d":
-        "https://www.worldlibertyfinancial.com",
-    "0x6B175474E89094C44Da98b954EedeAC495271d0F": "https://makerdao.com",
-    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8":
-        "https://www.paypal.com/us/digital-wallet/manage-money/crypto/pyusd",
-    "0x95aD61b0a150d79219dCF64E1E6Cc01f0B64C4cE": "https://shibatoken.com",
-    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6":
-        "https://www.worldlibertyfinancial.com",
-    "0xA0b73E1Ff0B80914AB6fe0444E65848C4C34450b": "https://crypto.com",
-    "0x582d872A1B094FC48F5DE31D3B73F2D9bE47def1": "https://ton.org",
-    "0x68749665FF8D2d112Fa859AA293F07A622782F38": "https://gold.tether.to",
-    "0x196C20DA81Fbc324EcdF55501e95Ce9f0bD84d14": "https://polkadot.network",
-    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": "https://uniswap.org",
-    "0x45804880De22913dAFE09f4980848ECE6EcbAf78":
-        "https://www.paxos.com/paxgold",
-    "0x3c3a81e81dc49A522A592e7622A7E711c06bf354": "https://www.mantle.xyz",
-    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": "https://aave.com",
-    "0x75231F58b43240C9718Dd58B4967c5114342a86c": "https://www.okx.com",
-    "0x6982508145454Ce325dDbE47a25d4ec3d2311933": "https://www.pepe.vip",
-    "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599": "https://wbtc.network",
-    "0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84": "https://lido.fi",
-    "0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32": "https://lido.fi",
-    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": "https://ens.domains",
-    "0x7D1AfA7B718fb893dB30A3aBc0Cfc608AaCfeBB0": "https://polygon.technology",
-    "0x9f8F72aA9304c8B593d555F12eF6589cC3A579A2": "https://makerdao.com",
-    "0xD533a949740bb3306d119CC777fa900bA034cd52": "https://curve.fi",
-    "0x111111111117dC0aa78b770fA6A738034120C302": "https://1inch.io",
-    "0x163f8C2467924be0ae7B5347228CABF260318753": "https://worldcoin.org",
-    "0xba100000625a3754423978a60c9317c58a424e3D": "https://balancer.fi",
-    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": "https://synthetix.io",
-    "0x1a7e4e63778B4f12a199C062f3eFdD288afCBce8": "https://www.euler.finance",
-    "0xBBbbCA6A901c926F240b89EacB641d8Aec7AEafD": "https://loopring.org",
-    "0xC669928185DbCE49d2230CC9B0979BE6DC797957": "https://bitstable.finance",
-    "0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0": "https://lido.fi",
-    "0xBe9895146f7AF43049ca1c1AE358B0541Ea49704":
-        "https://www.coinbase.com/cbeth",
-    "0xfAbA6f8e4a5E8Ab82F62fe7C39859FA577269BE3": "https://ondo.finance",
-    "0x0C10bF8FcB7Bf5412187A595ab97a3609160b5c6": "https://decentraland.org",
-    "0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24": "https://www.render.com",
-    "0x4a220E6096B25EADb88358cb44068A3248254675": "https://www.quant.network",
-    "0xba5BDe662c17e2aDFF1075610382B9B691296350": "https://superrare.com",
-    "0x15D4c048F83bd7e37d49eA4C83a07267Ec4203dA": "https://galxe.com",
-    "0xc00e94Cb662C3520282E6f5717214004A7f26888": "https://compound.finance",
-    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": "https://0x.org",
-    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": "https://yearn.fi",
-    "0x6fB3e0A217407EFFf7Ca062D46c26E5d60a14d69": "https://iotex.io",
-    "0xD31a59c85aE9D8edEFec411D448f90841571b89c": "https://solana.com",
-    "0xa1faa113cbE53436Df28FF0aEe54275c13B40975": "https://alphafinance.io",
-    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": "https://immutable.com",
-    "0x0f5D2fB29fb7d3CFeE444a200298f468908cC942": "https://decentraland.org",
-    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": "https://www.sandbox.game",
-    "0x4d224452801ACEd8B2F0aebE155379bb5D594381": "https://apecoin.com",
-    "0x6810e776880C02933D47DB1b9fc05908e5386b96": "https://gnosis.io",
-    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": "https://www.liquity.org",
-    "0xd26114cd6EE289AccF82350c8d8487fedB8A0C07": "https://omg.network",
-    "0x0D8775F648430679A709E98d2b0Cb6250d2887EF":
-        "https://basicattentiontoken.org",
-    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": "https://thegraph.com",
-    "0x1985365e9f78359a9B6AD760e32412f4a445E862": "https://augur.net",
-    "0x4E15361FD6b4BB609Fa63C81A2be19d873717870": "https://fantom.foundation",
-    "0x853d955aCEf822Db058eb8505911ED77F175b99e": "https://frax.finance",
-    "0x0000000000085d4780B73119b644AE5ecd22b376": "https://www.trueusd.com",
-    "0x0cEC1A9154Ff802e7934Fc916Ed7Ca50bDE6844e": "https://polymesh.network",
-    "0x956F47F50A910163D8BF957Cf5846D573E7f87CA": "https://fei.money",
-    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": "https://frax.finance",
-    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": "https://curve.fi",
-    "0x0100546F2cD4C9D97f798fFC9755E47865FF7Ee6": "https://alchemix.fi",
-    "0x808507121B80c02388fAd14726482e061B8da827": "https://pendle.finance",
-    "0xCa14007Eff0dB1f8135f4C25B34De49AB0d42766": "https://starknet.io",
-    "0x8457CA5040ad67fdebbCC8EdCE889A335Bc0fbFB": "https://alt.layer",
-    "0x4C19596f5aAfF459fA38B0f7eD92F11AE6543784": "https://www.truflation.com",
-    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": "https://arbitrum.io",
-    "0x912CE59144191C1204E64559FE8253a0e49E6548": "https://arbitrum.io",
-    "0x6985884C4392D348587B19cb9eAAf157F13271cd": "https://layerzero.network",
-    "0xFe0c30065B384F05761f15d0CC899D4F9F9Cc0eB": "https://ethfi.org",
-    "0x18084fbA666a33d37592fA2633fD49a74DD93a88": "https://tbtc.network",
-    "0x9D39A5DE30e57443BfF2A8307A4256c8797A3497": "https://suilend.fi",
-    "0x5283D291DBCF85356A21bA090E6db59121208b44": "https://blur.io",
-    "0x43Dfc4159D86F3A37A5A4B3D4580b888ad7d4DDd": "https://dydx.exchange",
-    "0xCf0C122c6b73ff809C693DB761e7BaeBe62b6a2E": "https://floki.com",
-    "0xe53EC727dbDEB9E2d5456c3be40cFF031AB40A55": "https://superfarm.com",
-    "0x32353A6C91143bfd6C7d363B546e62a9A2489A20": "https://www.agora.finance",
-    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": "https://www.euro-coin.com",
-    "0x1a03eF3d1a80b5f214e468ACD97F55714E049393": "https://gemspad.io",
-    "0x7122985656e38BDC0302Db86685bb972b145bD3C": "https://stone.fi",
-    "0xa35923162C49cF95e6BF26623385eb431ad920D3": "https://www.turbo-eth.com",
-    "0xdBdb4d16EdA451D0503b854CF79D55697F90c8DF": "https://alchemix.fi",
-    "0x08c32b0726C5684024ea6e141C50aDe9690bBdcc": "https://stratis.io",
-    "0x65Ef703f5594D2573eb71Aaf55BC0CB548492df4": "https://multichain.org",
-    "0x1151CB3d861920e07a38e03eEAd12C32178567F6": "https://bonk.com",
-    "0x090185f2135308BaD17527004364eBcC2D37e5F6": "https://spell.club",
-    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": "https://stargate.finance",
-};
-
-// Apply extra URLs where enrichment has none
-for (const [addr, url] of Object.entries(EXTRA_URLS)) {
-    const e = enrichment[addr];
-    if (e && !e.url) {
-        e.url = url;
-    }
-}
-
-// Read original tokenList.js
-const original = readFileSync("src/shared/tokenList.js", "utf8");
-
-// Replace each token block: add name and url after decimals
-let result = original;
-let replacements = 0;
-
-for (const [addr, data] of Object.entries(enrichment)) {
-    // Escape special regex characters in the address
-    const escaped = addr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
-    // Match the token block: { address: "...", symbol: "...", decimals: N, }
-    // The closing }, may have trailing whitespace
-    const blockRe = new RegExp(
-        `(\\{\\s*address:\\s*"${escaped}",\\s*symbol:\\s*"[^"]+",\\s*decimals:\\s*\\d+),?(\\s*\\})`,
-    );
-
-    const match = result.match(blockRe);
-    if (!match) {
-        console.error(`WARNING: Could not find block for ${addr}`);
-        continue;
-    }
-
-    // Build replacement: original fields + name + url
-    const nameEscaped = data.name.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-    const urlEscaped = data.url.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-    const replacement =
-        match[1] +
-        `,\n        name: "${nameEscaped}",` +
-        `\n        url: "${urlEscaped}",` +
-        match[2];
-
-    result = result.replace(blockRe, replacement);
-    replacements++;
-}
-
-console.error(`Applied ${replacements} enrichments to tokenList.js`);
-writeFileSync("src/shared/tokenList.js", result);
-console.error("Done!");

scripts/enrich-tokens.mjs

@@ -1,87 +0,0 @@
-#!/usr/bin/env node
-// Temporary script: fetch name + homepage URL for every token in tokenList.js
-// Phase 1: CoinGecko /coins/list (1 bulk call) for names — gets 100%
-// Phase 2: ethereum-lists GitHub repo for project URLs — gets ~15%
-
-import { readFileSync, writeFileSync } from "fs";
-
-const src = readFileSync("src/shared/tokenList.js", "utf8");
-
-const tokens = [];
-const re =
-    /\{\s*address:\s*"(0x[a-fA-F0-9]{40})",\s*symbol:\s*"([^"]+)",\s*decimals:\s*(\d+)/g;
-let m;
-while ((m = re.exec(src)) !== null) {
-    tokens.push({ address: m[1], symbol: m[2], decimals: parseInt(m[3]) });
-}
-console.error(`Parsed ${tokens.length} tokens`);
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-// --- Phase 1: bulk names from CoinGecko ---
-console.error("Fetching CoinGecko coins list...");
-const listResp = await fetch(
-    "https://api.coingecko.com/api/v3/coins/list?include_platform=true",
-);
-if (!listResp.ok) throw new Error(`CoinGecko list HTTP ${listResp.status}`);
-const coins = await listResp.json();
-
-const addrMap = new Map();
-for (const coin of coins) {
-    const eth = (coin.platforms?.ethereum || "").toLowerCase().trim();
-    if (eth && eth.startsWith("0x")) {
-        addrMap.set(eth, { name: coin.name, id: coin.id });
-    }
-}
-console.error(`CoinGecko map: ${addrMap.size} Ethereum tokens`);
-
-const enriched = new Map();
-for (const t of tokens) {
-    const info = addrMap.get(t.address.toLowerCase());
-    enriched.set(t.address, { name: info?.name || t.symbol, url: "" });
-}
-console.error(
-    `Matched ${[...enriched.values()].filter((e) => e.name).length}/${tokens.length} names`,
-);
-
-// --- Phase 2: ethereum-lists GitHub for URLs ---
-console.error("Fetching URLs from ethereum-lists GitHub...");
-const CONCURRENT = 10;
-let urlsFound = 0;
-
-for (let i = 0; i < tokens.length; i += CONCURRENT) {
-    const batch = tokens.slice(i, i + CONCURRENT);
-    await Promise.allSettled(
-        batch.map(async (t) => {
-            try {
-                const r = await fetch(
-                    `https://raw.githubusercontent.com/ethereum-lists/tokens/master/tokens/eth/${t.address}.json`,
-                );
-                if (!r.ok) return;
-                const data = await r.json();
-                const website = (data.website || "").trim();
-                if (website && website !== "https://") {
-                    enriched.get(t.address).url = website;
-                    urlsFound++;
-                }
-            } catch {
-                // ignore
-            }
-        }),
-    );
-    if (i % 100 === 0) {
-        console.error(
-            `  GitHub: ${Math.min(i + CONCURRENT, tokens.length)}/${tokens.length}, ${urlsFound} URLs`,
-        );
-    }
-    await sleep(200);
-}
-console.error(`Phase 2 done: ${urlsFound} URLs from ethereum-lists`);
-
-// --- Output ---
-const output = {};
-for (const [addr, e] of enriched) {
-    output[addr] = { name: e.name, url: e.url };
-}
-writeFileSync("scripts/token-enrichment.json", JSON.stringify(output, null, 2));
-console.error(`Done! ${tokens.length} names, ${urlsFound} URLs.`);

src/background/index.js

@@ -2,16 +2,12 @@
 // Handles EIP-1193 RPC requests from content scripts and proxies
 // non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
 
-const { DEFAULT_RPC_URL } = require("../shared/constants");
-const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
-const { onChainSwitch } = require("../shared/chainSwitch");
-const { getBytes } = require("ethers");
 const {
-    state,
+    ETHEREUM_MAINNET_CHAIN_ID,
-    loadState,
+    DEFAULT_RPC_URL,
-    saveState,
+} = require("../shared/constants");
-    currentNetwork,
+const { getBytes } = require("ethers");
-} = require("../shared/state");
+const { state, loadState, saveState } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
 const { debugFetch } = require("../shared/log");
 const { decryptWithPassword } = require("../shared/vault");
@@ -333,43 +329,31 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "eth_chainId") {
-        return { result: currentNetwork().chainId };
+        return { result: ETHEREUM_MAINNET_CHAIN_ID };
     }
 
     if (method === "net_version") {
-        return { result: currentNetwork().networkVersion };
+        return { result: "1" };
     }
 
     if (method === "wallet_switchEthereumChain") {
         const chainId = params?.[0]?.chainId;
-        if (chainId === currentNetwork().chainId) {
+        if (chainId === ETHEREUM_MAINNET_CHAIN_ID) {
-            return { result: null };
-        }
-        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
-            const target = networkByChainId(chainId);
-            await onChainSwitch(target.id);
-            broadcastChainChanged(target.chainId);
             return { result: null };
         }
         return {
             error: {
                 code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
-                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
             },
         };
     }
 
     if (method === "wallet_addEthereumChain") {
-        const chainId = params?.[0]?.chainId;
-        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
-            return { result: null };
-        }
         return {
             error: {
                 code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
-                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
             },
         };
     }
@@ -515,27 +499,6 @@ async function handleRpc(method, params, origin) {
     return { error: { message: "Unsupported method: " + method } };
 }
 
-// Broadcast chainChanged to all tabs when the network is switched.
-function broadcastChainChanged(chainId) {
-    tabsApi.query({}, (tabs) => {
-        for (const tab of tabs) {
-            tabsApi.sendMessage(
-                tab.id,
-                {
-                    type: "AUTISTMASK_EVENT",
-                    eventName: "chainChanged",
-                    data: chainId,
-                },
-                () => {
-                    if (runtime.lastError) {
-                        // expected for tabs without our content script
-                    }
-                },
-            );
-        }
-    });
-}
-
 // Broadcast accountsChanged to all tabs, respecting per-address permissions
 async function broadcastAccountsChanged() {
     // Clear non-remembered approvals on address switch

src/content/inpage.js

@@ -2,10 +2,7 @@
 // Creates window.ethereum (EIP-1193 provider) and announces via EIP-6963.
 
 (function () {
-    // Defaults to mainnet; updated dynamically via eth_chainId on init and
+    const CHAIN_ID = "0x1"; // Ethereum mainnet
-    // chainChanged events from the extension.
-    let currentChainId = "0x1";
-    let currentNetworkVersion = "1";
 
     const listeners = {};
     let nextId = 1;
@@ -31,12 +28,6 @@
         if (event.source !== window) return;
         if (event.data?.type !== "AUTISTMASK_EVENT") return;
         const { eventName, data } = event.data;
-        if (eventName === "chainChanged") {
-            currentChainId = data;
-            currentNetworkVersion = String(parseInt(data, 16));
-            provider.chainId = currentChainId;
-            provider.networkVersion = currentNetworkVersion;
-        }
         emit(eventName, data);
     });
 
@@ -66,8 +57,8 @@
     const provider = {
         isAutistMask: true,
         isMetaMask: true, // compatibility — many dApps check this
-        chainId: currentChainId,
+        chainId: CHAIN_ID,
-        networkVersion: currentNetworkVersion,
+        networkVersion: "1",
         selectedAddress: null,
 
         async request(args) {
@@ -84,12 +75,6 @@
                         ? result[0]
                         : null;
             }
-            if (args.method === "eth_chainId" && result) {
-                currentChainId = result;
-                currentNetworkVersion = String(parseInt(result, 16));
-                provider.chainId = currentChainId;
-                provider.networkVersion = currentNetworkVersion;
-            }
             return result;
         },
 
@@ -204,19 +189,4 @@
 
     window.addEventListener("eip6963:requestProvider", announceProvider);
     announceProvider();
-
-    // Fetch the current chain ID from the extension on load so the provider
-    // reflects the selected network immediately (covers Sepolia etc.).
-    sendRequest({ method: "eth_chainId", params: [] })
-        .then((chainId) => {
-            if (chainId) {
-                currentChainId = chainId;
-                currentNetworkVersion = String(parseInt(chainId, 16));
-                provider.chainId = currentChainId;
-                provider.networkVersion = currentNetworkVersion;
-            }
-        })
-        .catch(() => {
-            // Best-effort — keep defaults.
-        });
 })();

src/popup/index.html

@@ -882,24 +882,6 @@
                     </div>
                 </div>
 
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <h3 class="font-bold mb-1">Network</h3>
-                    <p class="text-xs text-muted mb-1">
-                        Select the Ethereum network. Switching networks will
-                        update the RPC and Blockscout endpoints to their
-                        defaults.
-                    </p>
-                    <div class="text-xs flex items-center gap-1">
-                        <select
-                            id="settings-network"
-                            class="border border-border p-1 bg-bg text-fg text-xs cursor-pointer"
-                        >
-                            <option value="mainnet">Ethereum Mainnet</option>
-                            <option value="sepolia">Sepolia Testnet</option>
-                        </select>
-                    </div>
-                </div>
-
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Ethereum RPC</h3>
                     <p class="text-xs text-muted mb-1">
@@ -1119,84 +1101,46 @@
                 <h2 id="tx-detail-heading" class="font-bold mb-2">
                     Transaction
                 </h2>
-
+                <div id="tx-detail-type-section" class="mb-4 hidden">
-                <!-- ── Identity ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
-                        <div class="text-xs text-muted mb-1">
-                            Transaction hash
-                        </div>
-                        <div
-                            id="tx-detail-hash"
-                            class="text-xs break-all"
-                        ></div>
-                    </div>
-                    <div id="tx-detail-type-section" class="mb-2 hidden">
                     <div class="text-xs text-muted mb-1">Type</div>
-                        <div
+                    <div id="tx-detail-type" class="text-xs font-bold"></div>
-                            id="tx-detail-type"
-                            class="text-xs font-bold"
-                        ></div>
                 </div>
-                    <div class="mb-2">
+                <div class="mb-4">
                     <div class="text-xs text-muted mb-1">Status</div>
                     <div id="tx-detail-status" class="text-xs"></div>
                 </div>
-                    <div class="mb-2">
+                <div class="mb-4">
-                        <div class="text-xs text-muted mb-1">From</div>
-                        <div
-                            id="tx-detail-from"
-                            class="text-xs break-all"
-                        ></div>
-                    </div>
-                    <div class="mb-2">
-                        <div class="text-xs text-muted mb-1">To</div>
-                        <div id="tx-detail-to" class="text-xs break-all"></div>
-                    </div>
-                </div>
-
-                <!-- ── Timing ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Time</div>
                     <div id="tx-detail-time" class="text-xs"></div>
                 </div>
-                    <div id="tx-detail-block-section" class="mb-2 hidden">
+                <div class="mb-4">
-                        <div class="text-xs text-muted mb-1">Block</div>
-                        <div id="tx-detail-block" class="text-xs"></div>
-                    </div>
-                </div>
-
-                <!-- ── Value ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="tx-detail-value" class="text-xs"></div>
                 </div>
-                    <div class="mb-2 hidden">
+                <div class="mb-4 hidden">
-                        <div class="text-xs text-muted mb-1">
+                    <div class="text-xs text-muted mb-1">Native quantity</div>
-                            Native quantity
-                        </div>
                     <div id="tx-detail-native" class="text-xs"></div>
                 </div>
-                    <div
+                <div class="mb-4">
-                        id="tx-detail-token-contract-section"
+                    <div class="text-xs text-muted mb-1">From</div>
-                        class="mb-2 hidden"
+                    <div id="tx-detail-from" class="text-xs break-all"></div>
-                    >
-                        <div class="text-xs text-muted mb-1">
-                            Token contract
                 </div>
+                <div class="mb-4">
+                    <div class="text-xs text-muted mb-1">To</div>
+                    <div id="tx-detail-to" class="text-xs break-all"></div>
+                </div>
+                <div id="tx-detail-token-contract-section" class="mb-4 hidden">
+                    <div class="text-xs text-muted mb-1">Token contract</div>
                     <div
                         id="tx-detail-token-contract"
                         class="text-xs break-all"
                     ></div>
                 </div>
-                </div>
+                <div id="tx-detail-calldata-section" class="mb-4 hidden">
-
+                    <div
-                <!-- ── Decoded details ── -->
+                        id="tx-detail-calldata-well"
-                <div id="tx-detail-calldata-section" class="hidden">
+                        class="mb-3 border border-border border-dashed p-2"
-                    <div class="bg-well p-3 mx-1 mb-3">
+                    >
-                        <div id="tx-detail-calldata-well" class="mb-2">
                         <div class="text-xs text-muted mb-1">Action</div>
                         <div
                             id="tx-detail-calldata-action"
@@ -1208,39 +1152,31 @@
                         ></div>
                     </div>
                 </div>
+                <div class="mb-4">
+                    <div class="text-xs text-muted mb-1">Transaction hash</div>
+                    <div id="tx-detail-hash" class="text-xs break-all"></div>
                 </div>
-
+                <div id="tx-detail-block-section" class="mb-4 hidden">
-                <!-- ── Network details ── -->
+                    <div class="text-xs text-muted mb-1">Block</div>
-                <div id="tx-detail-network-section" class="hidden">
+                    <div id="tx-detail-block" class="text-xs"></div>
-                    <div class="bg-well p-3 mx-1 mb-3">
+                </div>
-                        <div id="tx-detail-nonce-section" class="mb-2 hidden">
+                <div id="tx-detail-nonce-section" class="mb-4 hidden">
                     <div class="text-xs text-muted mb-1">Nonce</div>
                     <div id="tx-detail-nonce" class="text-xs"></div>
                 </div>
-                        <div
+                <div id="tx-detail-fee-section" class="mb-4 hidden">
-                            id="tx-detail-gasprice-section"
+                    <div class="text-xs text-muted mb-1">Transaction fee</div>
-                            class="mb-2 hidden"
+                    <div id="tx-detail-fee" class="text-xs"></div>
-                        >
+                </div>
+                <div id="tx-detail-gasprice-section" class="mb-4 hidden">
                     <div class="text-xs text-muted mb-1">Gas price</div>
                     <div id="tx-detail-gasprice" class="text-xs"></div>
                 </div>
-                        <div id="tx-detail-gasused-section" class="mb-2 hidden">
+                <div id="tx-detail-gasused-section" class="mb-4 hidden">
                     <div class="text-xs text-muted mb-1">Gas used</div>
                     <div id="tx-detail-gasused" class="text-xs"></div>
                 </div>
-                        <div id="tx-detail-fee-section" class="mb-2 hidden">
+                <div id="tx-detail-rawdata-section" class="mb-4 hidden">
-                            <div class="text-xs text-muted mb-1">
-                                Transaction fee
-                            </div>
-                            <div id="tx-detail-fee" class="text-xs"></div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- ── Raw data ── -->
-                <div id="tx-detail-rawdata-section" class="hidden">
-                    <div class="bg-well p-3 mx-1 mb-3">
-                        <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Raw data</div>
                     <div
                         id="tx-detail-rawdata"
@@ -1248,8 +1184,6 @@
                     ></div>
                 </div>
             </div>
-                </div>
-            </div>
 
             <!-- ============ TRANSACTION APPROVAL ============ -->
             <div id="view-approve-tx" class="view hidden">

src/popup/index.js

@@ -2,22 +2,10 @@
 // Loads state, initializes views, triggers first render.
 
 const { DEBUG } = require("../shared/constants");
-const {
+const { state, saveState, loadState } = require("../shared/state");
-    state,
-    saveState,
-    loadState,
-    currentNetwork,
-} = require("../shared/state");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
-const {
+const { $, showView } = require("./views/helpers");
-    $,
-    showView,
-    setRenderMain,
-    pushCurrentView,
-    goBack,
-    clearViewStack,
-} = require("./views/helpers");
 const { applyTheme } = require("./theme");
 
 const home = require("./views/home");
@@ -65,42 +53,15 @@ async function doRefreshAndRender() {
 const ctx = {
     renderWalletList,
     doRefreshAndRender,
-    showAddWalletView: () => {
+    showAddWalletView: () => addWallet.show(),
-        pushCurrentView();
+    showAddressDetail: () => addressDetail.show(),
-        addWallet.show();
+    showAddressToken: () => addressToken.show(),
-    },
+    showAddTokenView: () => addToken.show(),
-    showAddressDetail: () => {
+    showConfirmTx: (txInfo) => confirmTx.show(txInfo),
-        pushCurrentView();
+    showReceive: () => receive.show(),
-        addressDetail.show();
+    showTransactionDetail: (tx) => transactionDetail.show(tx),
-    },
+    showSettingsView: () => settings.show(),
-    showAddressToken: () => {
+    showSettingsAddTokenView: () => settingsAddToken.show(),
-        pushCurrentView();
-        addressToken.show();
-    },
-    showAddTokenView: () => {
-        pushCurrentView();
-        addToken.show();
-    },
-    showConfirmTx: (txInfo) => {
-        pushCurrentView();
-        confirmTx.show(txInfo);
-    },
-    showReceive: () => {
-        pushCurrentView();
-        receive.show();
-    },
-    showTransactionDetail: (tx) => {
-        pushCurrentView();
-        transactionDetail.show(tx);
-    },
-    showSettingsView: () => {
-        pushCurrentView();
-        settings.show();
-    },
-    showSettingsAddTokenView: () => {
-        pushCurrentView();
-        settingsAddToken.show();
-    },
 };
 
 // Views that can be fully re-rendered from persisted state.
@@ -206,25 +167,18 @@ function fallbackView() {
 }
 
 async function init() {
-    await loadState();
+    if (DEBUG) {
-    applyTheme(state.theme);
-
-    const net = currentNetwork();
-    if (DEBUG || net.isTestnet) {
         const banner = document.createElement("div");
         banner.id = "debug-banner";
-        if (DEBUG && net.isTestnet) {
-            banner.textContent = "DEBUG / INSECURE [TESTNET]";
-        } else if (net.isTestnet) {
-            banner.textContent = "[TESTNET]";
-        } else {
         banner.textContent = "DEBUG / INSECURE";
-        }
         banner.style.cssText =
             "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
         document.body.prepend(banner);
     }
 
+    await loadState();
+    applyTheme(state.theme);
+
     // Auto-default active address
     if (
         state.activeAddress === null &&
@@ -254,15 +208,13 @@ async function init() {
                 .getElementById("view-settings")
                 .classList.contains("hidden")
         ) {
-            goBack();
+            renderWalletList();
+            showView("main");
             return;
         }
-        pushCurrentView();
         settings.show();
     });
 
-    setRenderMain(renderWalletList);
-
     welcome.init(ctx);
     addWallet.init(ctx);
     home.init(ctx);

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -59,12 +59,7 @@ function init(ctx) {
             });
             await saveState();
             ctx.doRefreshAndRender();
-            // Pop the stack (back to address detail) and re-render it
+            ctx.showAddressDetail();
-            // so the newly added token is visible immediately.
-            if (state.viewStack.length > 0) {
-                state.viewStack.pop();
-            }
-            require("./addressDetail").show();
         } catch (e) {
             const detail = e.shortMessage || e.message || String(e);
             log.errorf("Token lookup failed for", contractAddr, detail);
@@ -74,9 +69,7 @@ function init(ctx) {
         }
     });
 
-    $("btn-add-token-back").addEventListener("click", () => {
+    $("btn-add-token-back").addEventListener("click", ctx.showAddressDetail);
-        goBack();
-    });
 }
 
 module.exports = { init, show };

src/popup/views/addWallet.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const {
     generateMnemonic,
     hdWalletFromMnemonic,
@@ -143,7 +143,6 @@ async function importMnemonic(ctx) {
     state.wallets.push(wallet);
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -199,7 +198,6 @@ async function importPrivateKey(ctx) {
     });
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -251,7 +249,6 @@ async function importXprvKey(ctx) {
     state.wallets.push(wallet);
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -300,7 +297,12 @@ function init(ctx) {
 
     // Back button
     $("btn-add-wallet-back").addEventListener("click", () => {
-        goBack();
+        if (!state.hasWallet) {
+            showView("welcome");
+        } else {
+            ctx.renderWalletList();
+            showView("main");
+        }
     });
 }
 

src/popup/views/addressDetail.js

@@ -8,10 +8,6 @@ const {
     addressTitle,
     escapeHtml,
     truncateMiddle,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
-    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
@@ -32,6 +28,17 @@ const { getSignerForAddress } = require("../../shared/wallet");
 
 let ctx;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function show() {
     state.selectedToken = null;
     const wallet = state.wallets[state.selectedWallet];
@@ -49,18 +56,22 @@ function show() {
     img.style.imageRendering = "pixelated";
     img.style.borderRadius = "50%";
     blockieEl.appendChild(img);
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-etherscan-link").innerHTML =
-    $("address-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    attachCopyHandlers($("address-line"));
     const usdTotal = formatUsd(getAddressValueUsd(addr));
     $("address-usd-total").innerHTML = usdTotal || "&nbsp;";
     const ensEl = $("address-ens");
-    // ENS is now shown inside renderAddressHtml, hide the separate element
+    if (addr.ensName) {
+        ensEl.innerHTML =
+            addressDotHtml(addr.address) + escapeHtml(addr.ensName);
+        ensEl.classList.remove("hidden");
+    } else {
         ensEl.classList.add("hidden");
+    }
     $("address-balances").innerHTML = balanceLinesForAddress(
         addr,
         state.trackedTokens,
@@ -247,9 +258,18 @@ function renderTransactions(txs) {
 
 function init(_ctx) {
     ctx = _ctx;
+    $("address-full").addEventListener("click", () => {
+        const addr = $("address-full").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback($("address-full"));
+        }
+    });
 
     $("btn-address-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
+        showView("main");
     });
 
     $("btn-send").addEventListener("click", () => {
@@ -267,7 +287,6 @@ function init(_ctx) {
         $("send-token-static").classList.add("hidden");
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 
@@ -297,7 +316,6 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
-        pushCurrentView();
         const wallet = state.wallets[state.selectedWallet];
         const addr = wallet.addresses[state.selectedAddress];
         const blockieEl = $("export-privkey-jazzicon");
@@ -311,9 +329,9 @@ function init(_ctx) {
         blockieEl.appendChild(bImg);
         $("export-privkey-title").textContent =
             wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
-        const exportAddrContainer = $("export-privkey-dot").parentElement;
+        $("export-privkey-dot").innerHTML = addressDotHtml(addr.address);
-        exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
+        $("export-privkey-address").textContent = addr.address;
-        attachCopyHandlers(exportAddrContainer);
+        $("export-privkey-address").dataset.full = addr.address;
         $("export-privkey-password").value = "";
         $("export-privkey-flash").textContent = "";
         $("export-privkey-flash").style.visibility = "hidden";
@@ -367,10 +385,19 @@ function init(_ctx) {
         }
     });
 
+    $("export-privkey-address").addEventListener("click", () => {
+        const full = $("export-privkey-address").dataset.full;
+        if (full) {
+            navigator.clipboard.writeText(full);
+            showFlash("Copied!");
+            flashCopyFeedback($("export-privkey-address"));
+        }
+    });
+
     $("btn-export-privkey-back").addEventListener("click", () => {
         $("export-privkey-value").textContent = "";
         $("export-privkey-password").value = "";
-        goBack();
+        show();
     });
 }
 

src/popup/views/addressToken.js

@@ -11,10 +11,6 @@ const {
     escapeHtml,
     truncateMiddle,
     balanceLine,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
-    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
@@ -38,6 +34,17 @@ const makeBlockie = require("ethereum-blockies-base64");
 
 let ctx;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function isoDate(timestamp) {
     const d = new Date(timestamp * 1000);
     const pad = (n) => String(n).padStart(2, "0");
@@ -141,16 +148,15 @@ function show() {
     blockieEl.appendChild(img);
 
     // Address line
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-token-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-token-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-token-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-token-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-token-etherscan-link").innerHTML =
-    $("address-token-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    attachCopyHandlers($("address-token-line"));
 
     // USD total for this token only
-    const usdVal = price ? amount * price : null;
+    const usdVal = price ? amount * price : 0;
     const usdStr = formatUsd(usdVal);
     $("address-token-usd-total").innerHTML = usdStr || "&nbsp;";
 
@@ -187,9 +193,15 @@ function show() {
                     ? knownToken.decimals
                     : null;
         const tokenHolders = tb && tb.holders != null ? tb.holders : null;
+        const dot = addressDotHtml(tokenId);
+        const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
         const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
         let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
-        infoHtml += `<div class="mb-2">${renderAddressHtml(tokenId)}</div>`;
+        infoHtml +=
+            `<div class="flex items-center mb-2">${dot}` +
+            `<span class="break-all underline decoration-dashed cursor-pointer" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
+            `<a href="${tokenLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
+            `</div>`;
         if (tokenName)
             infoHtml += `<div class="mb-1"><span class="text-muted">Name:</span> ${tokenName}</div>`;
         if (tokenSymbol)
@@ -201,7 +213,6 @@ function show() {
         if (projectUrl)
             infoHtml += `<div class="mb-1"><span class="text-muted">Website:</span> <a href="${escapeHtml(projectUrl)}" target="_blank" rel="noopener" class="underline decoration-dashed">${escapeHtml(projectUrl)}</a></div>`;
         contractInfo.innerHTML = infoHtml;
-        attachCopyHandlers(contractInfo);
         contractInfo.classList.remove("hidden");
     } else {
         contractInfo.innerHTML = "";
@@ -323,6 +334,15 @@ function renderTransactions(txs) {
 
 function init(_ctx) {
     ctx = _ctx;
+    $("address-token-full").addEventListener("click", () => {
+        const addr = $("address-token-full").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback($("address-token-full"));
+        }
+    });
+
     $("address-token-contract-info").addEventListener("click", (e) => {
         const copyEl = e.target.closest("[data-copy]");
         if (copyEl) {
@@ -333,7 +353,7 @@ function init(_ctx) {
     });
 
     $("btn-address-token-back").addEventListener("click", () => {
-        goBack();
+        ctx.showAddressDetail();
     });
 
     $("btn-address-token-send").addEventListener("click", () => {
@@ -360,14 +380,28 @@ function init(_ctx) {
         $("send-token").classList.add("hidden");
         let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
         if (tokenId !== "ETH") {
-            staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
+            const dot = addressDotHtml(tokenId);
+            const link = `https://etherscan.io/token/${tokenId}`;
+            const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+            staticHtml +=
+                `<div class="flex items-center text-xs">${dot}` +
+                `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
+                extLink +
+                `</div>`;
         }
         $("send-token-static").innerHTML = staticHtml;
         $("send-token-static").classList.remove("hidden");
-        attachCopyHandlers($("send-token-static"));
+        // Attach copy handler for the contract address
+        const copyEl = $("send-token-static").querySelector("[data-copy]");
+        if (copyEl) {
+            copyEl.addEventListener("click", () => {
+                navigator.clipboard.writeText(copyEl.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(copyEl);
+            });
+        }
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 

src/popup/views/approval.js

@@ -1,16 +1,14 @@
 const {
     $,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
     showView,
     showError,
     hideError,
-    renderAddressHtml,
-    attachCopyHandlers,
 } = require("./helpers");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
-const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const txStatus = require("./txStatus");
@@ -18,11 +16,28 @@ const uniswap = require("../../shared/uniswap");
 const runtime =
     typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 const erc20Iface = new Interface(ERC20_ABI);
 
 function approvalAddressHtml(address) {
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    let html = "";
+    if (title) {
+        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+        html += `<div class="break-all">${escapeHtml(address)}${extLink}</div>`;
+    } else {
+        html += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
+    }
+    return html;
 }
 
 function formatTxValue(val) {
@@ -37,6 +52,10 @@ function tokenLabel(address) {
     return t ? t.symbol : null;
 }
 
+function etherscanTokenLink(address) {
+    return `https://etherscan.io/token/${address}`;
+}
+
 // Try to decode calldata using known ABIs.
 // Returns { name, description, details } or null.
 function decodeCalldata(data, toAddress) {
@@ -215,19 +234,17 @@ function showTxApproval(details) {
             toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
         }
         toHtml += approvalAddressHtml(toAddr);
+        if (symbol) {
+            const link = etherscanTokenLink(toAddr);
+            toHtml = toHtml.replace("</div>", "") + ""; // approvalAddressHtml already has etherscan link
+        }
         $("approve-tx-to").innerHTML = toHtml;
     } else {
         $("approve-tx-to").innerHTML = escapeHtml("(contract creation)");
     }
 
-    const ethValueFormatted = formatTxValue(
-        formatEther(details.txParams.value || "0"),
-    );
-    const ethPrice = getPrice("ETH");
-    const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
-    const usdStr = formatUsd(ethUsd);
     $("approve-tx-value").textContent =
-        ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
+        formatTxValue(formatEther(details.txParams.value || "0")) + " ETH";
 
     // Decode calldata (reuse decoded from above)
     const decodedEl = $("approve-tx-decoded");
@@ -242,9 +259,12 @@ function showTxApproval(details) {
             detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
             if (d.address) {
                 if (d.isToken) {
+                    const tLink = etherscanTokenLink(d.address);
                     detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
-                }
                     detailsHtml += approvalAddressHtml(d.address);
+                } else {
+                    detailsHtml += approvalAddressHtml(d.address);
+                }
             } else {
                 detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
             }
@@ -268,7 +288,6 @@ function showTxApproval(details) {
     hideError("approve-tx-error");
 
     showView("approve-tx");
-    attachCopyHandlers("view-approve-tx");
 }
 
 function decodeHexMessage(hex) {
@@ -366,7 +385,6 @@ function showSignApproval(details) {
     $("btn-approve-sign").classList.remove("text-muted");
 
     showView("approve-sign");
-    attachCopyHandlers("view-approve-sign");
 }
 
 function show(id) {
@@ -394,7 +412,6 @@ function show(id) {
         $("approve-address").innerHTML = approvalAddressHtml(
             state.activeAddress,
         );
-        attachCopyHandlers("view-approve-site");
         $("approve-remember").checked = state.rememberSiteChoice;
     });
 }

src/popup/views/confirmTx.js

@@ -17,12 +17,10 @@ const {
     showFlash,
     flashCopyFeedback,
     addressTitle,
+    addressDotHtml,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -36,6 +34,13 @@ const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let pendingTx = null;
 
 function restore() {
@@ -45,6 +50,14 @@ function restore() {
     }
 }
 
+function etherscanTokenLink(address) {
+    return `https://etherscan.io/token/${address}`;
+}
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function blockieHtml(address) {
     const src = makeBlockie(address);
     return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
@@ -52,10 +65,22 @@ function blockieHtml(address) {
 
 function confirmAddressHtml(address, ensName, title) {
     const blockie = blockieHtml(address);
-    return (
+    const dot = addressDotHtml(address);
-        `<div class="mb-1">${blockie}</div>` +
+    const link = etherscanAddressLink(address);
-        renderAddressHtml(address, { title, ensName })
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    );
+    let html = `<div class="mb-1">${blockie}</div>`;
+    if (title) {
+        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+    }
+    if (ensName) {
+        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
+    }
+    html +=
+        `<div class="flex items-center">${title || ensName ? "" : dot}` +
+        `<span class="break-all">${escapeHtml(address)}</span>` +
+        extLink +
+        `</div>`;
+    return html;
 }
 
 function valueWithUsd(text, usdAmount) {
@@ -82,12 +107,23 @@ function show(txInfo) {
     // Token contract section (ERC-20 only)
     const tokenSection = $("confirm-token-section");
     if (isErc20) {
-        $("confirm-token-contract").innerHTML = renderAddressHtml(
+        const dot = addressDotHtml(txInfo.token);
-            txInfo.token,
+        const link = etherscanTokenLink(txInfo.token);
-            {},
+        $("confirm-token-contract").innerHTML =
-        );
+            `<div class="flex items-center">${dot}` +
+            `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
+            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
+            `</div>`;
         tokenSection.classList.remove("hidden");
-        attachCopyHandlers(tokenSection);
+        // Attach click-to-copy on the contract address
+        const copyEl = tokenSection.querySelector("[data-copy]");
+        if (copyEl) {
+            copyEl.onclick = () => {
+                navigator.clipboard.writeText(copyEl.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(copyEl);
+            };
+        }
     } else {
         tokenSection.classList.add("hidden");
     }
@@ -207,7 +243,6 @@ function show(txInfo) {
     $("confirm-fee-amount").textContent = "Estimating...";
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
-    attachCopyHandlers("view-confirm-tx");
 
     // Reset async warnings to hidden (space always reserved, no layout shift)
     $("confirm-recipient-warning").style.visibility = "hidden";
@@ -356,7 +391,7 @@ function init(ctx) {
     });
 
     $("btn-confirm-back").addEventListener("click", () => {
-        goBack();
+        showView("send");
     });
 }
 

src/popup/views/deleteWallet.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
 
@@ -21,7 +21,7 @@ function init(_ctx) {
 
     $("btn-delete-wallet-back").addEventListener("click", () => {
         deleteWalletIndex = null;
-        goBack();
+        ctx.showSettingsView();
     });
 
     $("btn-delete-wallet-confirm").addEventListener("click", async () => {
@@ -77,7 +77,6 @@ function init(_ctx) {
             state.selectedWallet = null;
             state.selectedAddress = null;
             state.activeAddress = null;
-            clearViewStack();
             await saveState();
             showView("welcome");
         } else {
@@ -87,14 +86,8 @@ function init(_ctx) {
             state.activeAddress =
                 state.wallets[0].addresses[0]?.address || null;
             await saveState();
-            // Reset stack to [main] so Settings back goes home.
-            // Use require() lazily to avoid circular dependency
-            // (settings.js requires deleteWallet.js).
-            clearViewStack();
-            state.viewStack.push("main");
             ctx.renderWalletList();
-            const settings = require("./settings");
+            ctx.showSettingsView();
-            settings.show();
             showFlash("Wallet deleted.");
         }
     });

src/popup/views/helpers.js

@@ -6,7 +6,7 @@ const {
     getPrice,
     getAddressValueUsd,
 } = require("../../shared/prices");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -59,57 +59,12 @@ function showView(name) {
     clearFlash();
     state.currentView = name;
     saveState();
-    const net = currentNetwork();
+    if (DEBUG) {
-    if (DEBUG || net.isTestnet) {
         const banner = document.getElementById("debug-banner");
         if (banner) {
-            if (DEBUG && net.isTestnet) {
-                banner.textContent =
-                    "DEBUG / INSECURE [TESTNET] (" + name + ")";
-            } else if (net.isTestnet) {
-                banner.textContent = "[TESTNET]";
-            } else {
             banner.textContent = "DEBUG / INSECURE (" + name + ")";
         }
     }
-    }
-}
-
-// Callback to re-render the main/home view when navigating back to it.
-// Set once by index.js via setRenderMain().
-let _renderMain = null;
-
-function setRenderMain(fn) {
-    _renderMain = fn;
-}
-
-// Push the current view onto the navigation stack so goBack() can
-// return to it.  Call this before any forward navigation.
-function pushCurrentView() {
-    if (state.currentView) {
-        state.viewStack.push(state.currentView);
-    }
-}
-
-// Pop the navigation stack and show the previous view.  If the stack
-// is empty, fall back to the main (home) view.
-function goBack() {
-    let target;
-    if (state.viewStack.length > 0) {
-        target = state.viewStack.pop();
-    } else {
-        target = "main";
-    }
-    if (target === "main" && _renderMain) {
-        _renderMain();
-    }
-    showView(target);
-}
-
-// Clear the entire navigation stack (used when resetting to root,
-// e.g. after adding or deleting a wallet).
-function clearViewStack() {
-    state.viewStack = [];
 }
 
 let flashTimer = null;
@@ -253,9 +208,21 @@ function addressTitle(address, wallets) {
 // Render an address with color dot, optional ENS name, optional title,
 // and optional truncation. Title and ENS are shown as bold labels above
 // the full address.
-// Delegates to renderAddressHtml for consistent output.
 function formatAddressHtml(address, ensName, maxLen, title) {
-    return renderAddressHtml(address, { title, ensName, maxLen });
+    const dot = addressDotHtml(address);
+    const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
+    if (title || ensName) {
+        let html = "";
+        if (title) {
+            html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+        }
+        if (ensName) {
+            html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
+        }
+        html += `<div class="break-all">${escapeHtml(displayAddr)}</div>`;
+        return html;
+    }
+    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(displayAddr)}</span></div>`;
 }
 
 function isoDate(timestamp) {
@@ -314,91 +281,6 @@ function timeAgo(timestamp) {
     return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 
-// Shared external-link icon SVG used across all views.
-const EXT_ICON =
-    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
-    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
-    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
-    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
-    `</svg></span>`;
-
-function etherscanAddressUrl(address) {
-    return `${currentNetwork().explorerUrl}/address/${address}`;
-}
-
-function etherscanLinkHtml(url) {
-    return (
-        `<a href="${url}" target="_blank" rel="noopener" ` +
-        `class="inline-flex items-center">${EXT_ICON}</a>`
-    );
-}
-
-// Render a copyable text span with dashed underline affordance.
-// The caller must attach click handlers via attachCopyHandlers() or
-// manually wire up [data-copy] elements after inserting the HTML.
-function copyableHtml(text, extraClass) {
-    const cls =
-        "underline decoration-dashed cursor-pointer" +
-        (extraClass ? " " + extraClass : "");
-    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
-}
-
-// Attach click-to-copy handlers to all [data-copy] elements within
-// a container.  Safe to call multiple times on the same container.
-function attachCopyHandlers(container) {
-    const root =
-        typeof container === "string"
-            ? document.getElementById(container)
-            : container;
-    if (!root) return;
-    root.querySelectorAll("[data-copy]").forEach((el) => {
-        el.onclick = () => {
-            navigator.clipboard.writeText(el.dataset.copy);
-            showFlash("Copied!");
-            flashCopyFeedback(el);
-        };
-    });
-}
-
-// Unified address rendering.
-//
-// Produces consistent HTML for any Ethereum address:
-//   • Color dot
-//   • Optional title (e.g. "Wallet 1 — Address 2") shown bold above address
-//   • Optional ENS name shown bold above address
-//   • Full address (or truncated via maxLen) with dashed-underline click-to-copy
-//   • Etherscan external link icon
-//
-// Options object:
-//   title    — wallet title string (from addressTitle)
-//   ensName  — ENS name string
-//   maxLen   — if set, truncate address display (min 32 chars enforced)
-//   noLink   — if true, omit etherscan link
-//
-// After inserting the returned HTML into the DOM, call
-// attachCopyHandlers() on the parent to wire up click-to-copy.
-function renderAddressHtml(address, opts) {
-    const { title, ensName, maxLen, noLink } = opts || {};
-    const dot = addressDotHtml(address);
-    const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
-    const link = etherscanAddressUrl(address);
-    const extLink = noLink ? "" : etherscanLinkHtml(link);
-
-    let html = "";
-    if (title) {
-        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
-    }
-    if (ensName) {
-        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
-    }
-    if (title || ensName) {
-        html += `<div class="flex items-center">${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
-    } else {
-        html += `<div class="flex items-center">${dot}${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
-    }
-    return html;
-}
-
 function flashCopyFeedback(el) {
     if (!el) return;
     el.classList.remove("copy-flash-fade");
@@ -417,10 +299,6 @@ module.exports = {
     showError,
     hideError,
     showView,
-    setRenderMain,
-    pushCurrentView,
-    goBack,
-    clearViewStack,
     showFlash,
     flashCopyFeedback,
     balanceLine,
@@ -430,12 +308,6 @@ module.exports = {
     escapeHtml,
     addressTitle,
     formatAddressHtml,
-    renderAddressHtml,
-    copyableHtml,
-    attachCopyHandlers,
-    etherscanAddressUrl,
-    etherscanLinkHtml,
-    EXT_ICON,
     truncateMiddle,
     isoDate,
     timeAgo,

src/popup/views/home.js

@@ -10,9 +10,6 @@ const {
     addressTitle,
     escapeHtml,
     truncateMiddle,
-    renderAddressHtml,
-    attachCopyHandlers,
-    pushCurrentView,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
 const {
@@ -72,12 +69,28 @@ function renderTotalValue() {
     }
 }
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function renderActiveAddress() {
     const el = $("active-address-display");
     if (!el) return;
     if (state.activeAddress) {
-        el.innerHTML = renderAddressHtml(state.activeAddress);
+        const addr = state.activeAddress;
-        attachCopyHandlers(el);
+        const dot = addressDotHtml(addr);
+        const link = `https://etherscan.io/address/${addr}`;
+        el.innerHTML =
+            `<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
+            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+        $("active-addr-copy").addEventListener("click", (e) => {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback(e.currentTarget);
+        });
     } else {
         el.textContent = "";
     }
@@ -382,7 +395,6 @@ function init(ctx) {
         renderSendTokenSelect(addr);
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 

src/popup/views/receive.js

@@ -5,12 +5,17 @@ const {
     flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
-const { state, currentAddress, currentNetwork } = require("../../shared/state");
+const { state, currentAddress } = require("../../shared/state");
 const QRCode = require("qrcode");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function show() {
     const addr = currentAddress();
     const address = addr ? addr.address : "";
@@ -20,8 +25,10 @@ function show() {
         ? formatAddressHtml(address, ensName, null, title)
         : "";
     $("receive-address-block").dataset.full = address;
-    // Etherscan link is now included in formatAddressHtml via renderAddressHtml
+    const link = address ? `https://etherscan.io/address/${address}` : "";
-    $("receive-etherscan-link").innerHTML = "";
+    $("receive-etherscan-link").innerHTML = link
+        ? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
+        : "";
     if (address) {
         QRCode.toCanvas($("receive-qr"), address, {
             width: 200,
@@ -45,19 +52,25 @@ function show() {
         warningEl.textContent =
             "This is an ERC-20 token. Only send " +
             symbol +
-            " on " +
+            " on the Ethereum network to this address. Sending tokens on other networks will result in permanent loss.";
-            currentNetwork().name +
-            " to this address. Sending tokens on other networks will result in permanent loss.";
         warningEl.style.visibility = "visible";
     } else {
         warningEl.textContent = "";
         warningEl.style.visibility = "hidden";
     }
     showView("receive");
-    attachCopyHandlers("view-receive");
 }
 
 function init(ctx) {
+    $("receive-address-block").addEventListener("click", (e) => {
+        const addr = $("receive-address-block").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback(e.currentTarget);
+        }
+    });
+
     $("btn-receive-copy").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {
@@ -68,7 +81,11 @@ function init(ctx) {
     });
 
     $("btn-receive-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/send.js

@@ -3,11 +3,9 @@
 const {
     $,
     showFlash,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
@@ -115,6 +113,13 @@ function updateToValidation() {
     }
 }
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function isSpoofedToken(t) {
     const upper = (t.symbol || "").toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) return false;
@@ -143,12 +148,24 @@ function renderSendTokenSelect(addr) {
 function updateSendBalance() {
     const addr = currentAddress();
     if (!addr) return;
+    const dot = addressDotHtml(addr.address);
+    const link = `https://etherscan.io/address/${addr.address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(addr.address, state.wallets);
-    $("send-from").innerHTML = renderAddressHtml(addr.address, {
+    let fromHtml = "";
-        title,
+    if (title) {
-        ensName: addr.ensName,
+        fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
-    });
+        if (addr.ensName) {
-    attachCopyHandlers($("send-from"));
+            fromHtml += `<div>${escapeHtml(addr.ensName)}</div>`;
+        }
+        fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
+    } else if (addr.ensName) {
+        fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(addr.ensName)}</div>`;
+        fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
+    } else {
+        fromHtml += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(addr.address)}</span>${extLink}</div>`;
+    }
+    $("send-from").innerHTML = fromHtml;
     const token = state.selectedToken || $("send-token").value;
     if (token === "ETH") {
         $("send-balance").textContent =
@@ -251,7 +268,11 @@ function init(_ctx) {
     $("btn-send-back").addEventListener("click", () => {
         $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/settings.js

@@ -1,15 +1,7 @@
-const {
+const { $, showView, showFlash, escapeHtml } = require("./helpers");
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    pushCurrentView,
-} = require("./helpers");
 const { applyTheme } = require("../theme");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
-const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
+const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
-const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
 
@@ -93,7 +85,6 @@ function renderWalletListSettings() {
     container.querySelectorAll(".btn-delete-wallet").forEach((btn) => {
         btn.addEventListener("click", () => {
             const idx = parseInt(btn.dataset.idx, 10);
-            pushCurrentView();
             deleteWallet.show(idx);
         });
     });
@@ -134,10 +125,6 @@ function renderWalletListSettings() {
 function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
-    const networkSelect = $("settings-network");
-    if (networkSelect) {
-        networkSelect.value = state.networkId;
-    }
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -181,12 +168,9 @@ function init(ctx) {
                 showFlash("Endpoint returned error: " + json.error.message);
                 return;
             }
-            const net = currentNetwork();
+            if (json.result !== ETHEREUM_MAINNET_CHAIN_ID) {
-            if (json.result !== net.chainId) {
                 showFlash(
-                    "Wrong network (expected " +
+                    "Wrong network (expected mainnet, got chain " +
-                        net.name +
-                        ", got chain " +
                         json.result +
                         ").",
                 );
@@ -225,17 +209,6 @@ function init(ctx) {
         showFlash("Saved.");
     });
 
-    const networkSelect = $("settings-network");
-    if (networkSelect) {
-        networkSelect.addEventListener("change", async () => {
-            const newId = networkSelect.value;
-            const net = await onChainSwitch(newId);
-            $("settings-rpc").value = state.rpcUrl;
-            $("settings-blockscout").value = state.blockscoutUrl;
-            showFlash("Switched to " + net.name + ".");
-        });
-    }
-
     $("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
     $("settings-show-zero-balances").addEventListener("change", async () => {
         state.showZeroBalanceTokens = $("settings-show-zero-balances").checked;
@@ -290,7 +263,8 @@ function init(ctx) {
     );
 
     $("btn-settings-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
+        showView("main");
     });
 }
 

src/popup/views/settingsAddToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -84,7 +84,7 @@ function init(_ctx) {
     ctx = _ctx;
 
     $("btn-settings-addtoken-back").addEventListener("click", () => {
-        goBack();
+        ctx.showSettingsView();
     });
 
     $("btn-settings-addtoken-select").addEventListener("click", async () => {

src/popup/views/transactionDetail.js

@@ -6,22 +6,25 @@ const {
     showView,
     showFlash,
     flashCopyFeedback,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
     isoDate,
     timeAgo,
-    renderAddressHtml,
-    attachCopyHandlers,
-    copyableHtml,
-    etherscanLinkHtml,
-    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
 const { decodeCalldata } = require("./approval");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let ctx;
 
 /**
@@ -43,21 +46,56 @@ function getTransactionType(tx) {
     return "Native ETH Transfer";
 }
 
+function copyableHtml(text, extraClass) {
+    const cls =
+        "underline decoration-dashed cursor-pointer" +
+        (extraClass ? " " + extraClass : "");
+    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
+}
+
 function blockieHtml(address) {
     const src = makeBlockie(address);
     return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
-function txAddressHtml(address, ensName, title) {
+function etherscanLinkHtml(url) {
-    const blockie = blockieHtml(address);
     return (
-        `<div class="mb-1">${blockie}</div>` +
+        `<a href="${url}" target="_blank" rel="noopener" ` +
-        renderAddressHtml(address, { title, ensName })
+        `class="inline-flex items-center"` +
+        `>${EXT_ICON}</a>`
     );
 }
 
+function txAddressHtml(address, ensName, title) {
+    const blockie = blockieHtml(address);
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = etherscanLinkHtml(link);
+    let html = `<div class="mb-1">${blockie}</div>`;
+    if (title) {
+        html += `<div class="font-bold">${escapeHtml(title)}</div>`;
+    }
+    if (ensName) {
+        html +=
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(ensName, "") +
+            `</div>` +
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(address, "break-all") +
+            extLink +
+            `</div>`;
+    } else {
+        html +=
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(address, "break-all") +
+            extLink +
+            `</div>`;
+    }
+    return html;
+}
+
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -134,7 +172,7 @@ function render() {
     if (tokenContractSection && tokenContractEl) {
         if (tx.contractAddress) {
             const dot = addressDotHtml(tx.contractAddress);
-            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
+            const link = `https://etherscan.io/token/${tx.contractAddress}`;
             tokenContractEl.innerHTML =
                 `<div class="flex items-center">${dot}` +
                 copyableHtml(tx.contractAddress, "break-all") +
@@ -159,7 +197,6 @@ function render() {
         "tx-detail-fee-section",
         "tx-detail-gasprice-section",
         "tx-detail-gasused-section",
-        "tx-detail-network-section",
     ]) {
         const el = $(id);
         if (el) el.classList.add("hidden");
@@ -172,7 +209,17 @@ function render() {
         copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
     $("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
     showView("transaction");
-    attachCopyHandlers("view-transaction");
+
+    document
+        .getElementById("view-transaction")
+        .querySelectorAll("[data-copy]")
+        .forEach((el) => {
+            el.onclick = () => {
+                navigator.clipboard.writeText(el.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(el);
+            };
+        });
 }
 
 function showDetailField(sectionId, contentId, value) {
@@ -186,7 +233,7 @@ function showDetailField(sectionId, contentId, value) {
 function populateOnChainDetails(txData) {
     // Block number
     if (txData.block_number != null) {
-        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
+        const blockLink = `https://etherscan.io/block/${txData.block_number}`;
         const blockSection = $("tx-detail-block-section");
         const blockEl = $("tx-detail-block");
         if (blockSection && blockEl) {
@@ -238,21 +285,6 @@ function populateOnChainDetails(txData) {
         );
     }
 
-    // Show the network details wrapper if any child section is visible
-    const networkWrapper = $("tx-detail-network-section");
-    if (networkWrapper) {
-        const hasVisible = [
-            "tx-detail-nonce-section",
-            "tx-detail-fee-section",
-            "tx-detail-gasprice-section",
-            "tx-detail-gasused-section",
-        ].some((id) => {
-            const el = $(id);
-            return el && !el.classList.contains("hidden");
-        });
-        if (hasVisible) networkWrapper.classList.remove("hidden");
-    }
-
     // Bind copy handlers for newly added elements
     for (const id of [
         "tx-detail-block-section",
@@ -307,14 +339,19 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
                 detailsHtml += `<div class="mb-2">`;
                 detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
                 if (d.address && d.isToken) {
-                    // Token entry: show symbol on its own line, then address via shared renderer
+                    // Token entry: show symbol on its own line, then dot + address + Etherscan link
+                    const dot = addressDotHtml(d.address);
                     const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                     if (tokenSymbol) {
                         detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                     }
-                    detailsHtml += renderAddressHtml(d.address);
+                    const etherscanUrl = `https://etherscan.io/token/${d.address}`;
+                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.address, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
                 } else if (d.address) {
-                    detailsHtml += renderAddressHtml(d.address);
+                    // Protocol/contract entry: show name + Etherscan link
+                    const dot = addressDotHtml(d.address);
+                    const etherscanUrl = `https://etherscan.io/address/${d.address}`;
+                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.value, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
                 } else {
                     detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
                 }
@@ -341,7 +378,13 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
         // Bind copy handlers for new elements (including raw data now outside section)
         const copyTargets = [section, rawSection].filter(Boolean);
         for (const container of copyTargets) {
-            attachCopyHandlers(container);
+            container.querySelectorAll("[data-copy]").forEach((el) => {
+                el.onclick = () => {
+                    navigator.clipboard.writeText(el.dataset.copy);
+                    showFlash("Copied!");
+                    flashCopyFeedback(el);
+                };
+            });
         }
     } catch (e) {
         log.errorf("loadCalldata failed:", e.message);
@@ -351,7 +394,11 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
 function init(_ctx) {
     ctx = _ctx;
     $("btn-tx-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/txStatus.js

@@ -3,19 +3,24 @@
 const {
     $,
     showView,
+    showFlash,
+    flashCopyFeedback,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    copyableHtml,
-    etherscanLinkHtml,
-    clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let ctx;
 let elapsedTimer = null;
 let pollTimer = null;
@@ -32,19 +37,50 @@ function clearTimers() {
 }
 
 function toAddressHtml(address) {
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    if (title) {
+        return (
+            `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>` +
+            `<div class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</div>` +
+            extLink
+        );
+    }
+    return `<div class="flex items-center">${dot}<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</span>${extLink}</div>`;
 }
 
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
-    return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+    return (
+        `<span class="underline decoration-dashed cursor-pointer break-all" data-copy="${escapeHtml(hash)}">${escapeHtml(hash)}</span>` +
+        extLink
+    );
 }
 
 function blockNumberHtml(blockNumber) {
     const num = String(blockNumber);
-    const link = `${currentNetwork().explorerUrl}/block/${num}`;
+    const link = `https://etherscan.io/block/${num}`;
-    return copyableHtml(num) + etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+    return (
+        `<span class="underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(num)}">${escapeHtml(num)}</span>` +
+        extLink
+    );
+}
+
+function attachCopyHandlers(viewId) {
+    document
+        .getElementById(viewId)
+        .querySelectorAll("[data-copy]")
+        .forEach((el) => {
+            el.onclick = () => {
+                navigator.clipboard.writeText(el.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(el);
+            };
+        });
 }
 
 function showWait(txInfo, txHash) {
@@ -111,7 +147,7 @@ function tokenLabel(address) {
 }
 
 function etherscanTokenLink(address) {
-    return `${currentNetwork().explorerUrl}/token/${address}`;
+    return `https://etherscan.io/token/${address}`;
 }
 
 function decodedDetailsHtml(decoded) {
@@ -222,16 +258,10 @@ function navigateBack() {
         window.close();
         return;
     }
-    // After a completed transaction, reset the navigation stack
-    // and go directly to the address view (token or detail).
-    // Use require() lazily to call show() without the ctx push wrapper.
-    clearViewStack();
-    state.viewStack.push("main");
     if (state.selectedToken) {
-        state.viewStack.push("address");
+        ctx.showAddressToken();
-        require("./addressToken").show();
     } else {
-        require("./addressDetail").show();
+        ctx.showAddressDetail();
     }
 }
 

src/shared/balances.js

@@ -15,15 +15,10 @@ const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
-// Accepts an optional networkName ("mainnet" or "sepolia") for the static
+const mainnet = Network.from("mainnet");
-// network hint so ethers picks the right chain parameters.  When omitted,
+
-// reads the currently selected network from extension state.
+function getProvider(rpcUrl) {
-function getProvider(rpcUrl, networkName) {
+    return new JsonRpcProvider(rpcUrl, mainnet, { staticNetwork: mainnet });
-    // Lazy require to avoid circular dependency issues at module scope.
-    const { currentNetwork } = require("./state");
-    const name = networkName || currentNetwork().id;
-    const net = Network.from(name);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
 }
 
 function formatBalance(wei) {

src/shared/chainSwitch.js

@@ -1,57 +0,0 @@
-// Consolidated chain-switch handler.
-//
-// Every state change required when the active network changes is
-// performed here so that callers (settings UI, background
-// wallet_switchEthereumChain, future chain additions) all go
-// through a single code path.
-//
-// Adding a new chain (e.g. ETC) requires only a new entry in
-// networks.js — no per-caller wiring is needed.
-
-const { networkById } = require("./networks");
-const { clearPrices } = require("./prices");
-
-// Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain.
-async function onChainSwitch(newNetworkId) {
-    const { state, saveState } = require("./state");
-
-    const net = networkById(newNetworkId);
-
-    // --- core identity ---
-    state.networkId = net.id;
-    state.rpcUrl = net.defaultRpcUrl;
-    state.blockscoutUrl = net.defaultBlockscoutUrl;
-
-    // --- price cache ---
-    // Prices are chain-specific (testnet tokens are worthless,
-    // ETC has different pricing, etc.).
-    clearPrices();
-
-    // --- balance / refresh state ---
-    // Reset last-refresh timestamp so the next polling cycle
-    // triggers an immediate balance refresh on the new chain.
-    state.lastBalanceRefresh = 0;
-
-    // Clear per-address balances and token balances so stale data
-    // from the previous chain is never displayed while the first
-    // refresh on the new chain is in flight.
-    for (const wallet of state.wallets) {
-        for (const addr of wallet.addresses) {
-            addr.balance = "0";
-            addr.tokenBalances = [];
-        }
-    }
-
-    // --- chain-specific caches ---
-    // Token holder counts and fraud contract lists are
-    // chain-specific and must not carry over.
-    state.tokenHolderCache = {};
-    state.fraudContracts = [];
-
-    await saveState();
-
-    return net;
-}
-
-module.exports = { onChainSwitch };

src/shared/constants.js

@@ -3,7 +3,6 @@ const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 
 const ETHEREUM_MAINNET_CHAIN_ID = "0x1";
-const ETHEREUM_SEPOLIA_CHAIN_ID = "0xaa36a7";
 
 const DEFAULT_RPC_URL = "https://ethereum-rpc.publicnode.com";
 
@@ -38,7 +37,6 @@ module.exports = {
     DEBUG,
     DEBUG_MNEMONIC,
     ETHEREUM_MAINNET_CHAIN_ID,
-    ETHEREUM_SEPOLIA_CHAIN_ID,
     DEFAULT_RPC_URL,
     DEFAULT_BLOCKSCOUT_URL,
     BIP44_ETH_PATH,

src/shared/etherscanLabels.js

@@ -2,6 +2,8 @@
 // Extension users make the requests directly to Etherscan — no proxy needed.
 // This is a best-effort enrichment: network failures return null silently.
 
+const ETHERSCAN_BASE = "https://etherscan.io/address/";
+
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
 const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
@@ -72,19 +74,12 @@ function parseEtherscanPage(html) {
  * Returns a warning object if the address is flagged, or null.
  * Network failures return null silently (best-effort check).
  *
- * Uses the current network's explorer URL so the lookup works on both
- * mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
- *
  * @param {string} address - Ethereum address to check.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
 async function checkEtherscanLabel(address) {
     try {
-        // Lazy require to avoid pulling in chrome.storage at module scope
+        const resp = await fetch(ETHERSCAN_BASE + address, {
-        // (which breaks unit tests that only exercise parseEtherscanPage).
-        const { currentNetwork } = require("./state");
-        const etherscanBase = currentNetwork().explorerUrl + "/address/";
-        const resp = await fetch(etherscanBase + address, {
             headers: { Accept: "text/html" },
         });
         if (!resp.ok) return null;

src/shared/networks.js

@@ -1,57 +0,0 @@
-// Network definitions for supported Ethereum networks.
-// Each network specifies its chain ID, default RPC and Blockscout endpoints,
-// and the block explorer base URL used for address/tx/token/block links.
-
-const NETWORKS = {
-    mainnet: {
-        id: "mainnet",
-        name: "Ethereum Mainnet",
-        chainId: "0x1",
-        networkVersion: "1",
-        nativeCurrency: "ETH",
-        defaultRpcUrl: "https://ethereum-rpc.publicnode.com",
-        defaultBlockscoutUrl: "https://eth.blockscout.com/api/v2",
-        explorerUrl: "https://etherscan.io",
-        isTestnet: false,
-    },
-    sepolia: {
-        id: "sepolia",
-        name: "Sepolia Testnet",
-        chainId: "0xaa36a7",
-        networkVersion: "11155111",
-        nativeCurrency: "SepoliaETH",
-        defaultRpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
-        defaultBlockscoutUrl: "https://eth-sepolia.blockscout.com/api/v2",
-        explorerUrl: "https://sepolia.etherscan.io",
-        isTestnet: true,
-    },
-};
-
-const SUPPORTED_CHAIN_IDS = new Set(
-    Object.values(NETWORKS).map((n) => n.chainId),
-);
-
-function networkById(id) {
-    return NETWORKS[id] || NETWORKS.mainnet;
-}
-
-function networkByChainId(chainId) {
-    for (const net of Object.values(NETWORKS)) {
-        if (net.chainId === chainId) return net;
-    }
-    return null;
-}
-
-// Build a block explorer link for the given path type and value.
-// type: "address" | "tx" | "token" | "block"
-function explorerLink(network, type, value) {
-    return `${network.explorerUrl}/${type}/${value}`;
-}
-
-module.exports = {
-    NETWORKS,
-    SUPPORTED_CHAIN_IDS,
-    networkById,
-    networkByChainId,
-    explorerLink,
-};

src/shared/phishingDomains.js

@@ -21,13 +21,17 @@ const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const DELTA_STORAGE_KEY = "phishing-delta";
 const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 
-// Vendored set — built once from the bundled JSON.
+// Vendored sets — built once from the bundled JSON.
 const vendoredBlacklist = new Set(
     (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
 );
+const vendoredWhitelist = new Set(
+    (vendoredConfig.whitelist || []).map((d) => d.toLowerCase()),
+);
 
-// Delta set — only entries from live list that are NOT in vendored.
+// Delta sets — only entries from live list that are NOT in vendored.
 let deltaBlacklist = new Set();
+let deltaWhitelist = new Set();
 let lastFetchTime = 0;
 let fetchPromise = null;
 let refreshTimer = null;
@@ -46,6 +50,11 @@ function loadDeltaFromStorage() {
                 data.blacklist.map((d) => d.toLowerCase()),
             );
         }
+        if (data.whitelist && Array.isArray(data.whitelist)) {
+            deltaWhitelist = new Set(
+                data.whitelist.map((d) => d.toLowerCase()),
+            );
+        }
     } catch {
         // localStorage unavailable or corrupt — start empty
     }
@@ -58,6 +67,7 @@ function saveDeltaToStorage() {
     try {
         const data = {
             blacklist: Array.from(deltaBlacklist),
+            whitelist: Array.from(deltaWhitelist),
         };
         const json = JSON.stringify(data);
         if (json.length < MAX_DELTA_BYTES) {
@@ -75,15 +85,19 @@ function saveDeltaToStorage() {
  * Load a pre-parsed config and compute the delta against the vendored list.
  * Used for both live fetches and testing.
  *
- * @param {{ blacklist?: string[] }} config
+ * @param {{ blacklist?: string[], whitelist?: string[] }} config
  */
 function loadConfig(config) {
     const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
+    const liveWhitelist = (config.whitelist || []).map((d) => d.toLowerCase());
 
     // Delta = entries in the live list that are NOT in the vendored list
     deltaBlacklist = new Set(
         liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
     );
+    deltaWhitelist = new Set(
+        liveWhitelist.filter((d) => !vendoredWhitelist.has(d)),
+    );
 
     lastFetchTime = Date.now();
     saveDeltaToStorage();
@@ -110,6 +124,7 @@ function hostnameVariants(hostname) {
 /**
  * Check if a hostname is on the phishing blocklist.
  * Checks delta first (fresh/recent scam sites), then vendored list.
+ * Whitelisted domains (delta + vendored) are never flagged.
  *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
@@ -118,6 +133,11 @@ function isPhishingDomain(hostname) {
     if (!hostname) return false;
     const variants = hostnameVariants(hostname);
 
+    // Whitelist takes priority — check delta whitelist first, then vendored
+    for (const v of variants) {
+        if (deltaWhitelist.has(v) || vendoredWhitelist.has(v)) return false;
+    }
+
     // Check delta blacklist first (fresh/recent scam sites), then vendored
     for (const v of variants) {
         if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
@@ -189,6 +209,7 @@ function getDeltaSize() {
  */
 function _reset() {
     deltaBlacklist = new Set();
+    deltaWhitelist = new Set();
     lastFetchTime = 0;
     fetchPromise = null;
     if (refreshTimer) {
@@ -211,5 +232,7 @@ module.exports = {
     _reset,
     // Exposed for testing only
     _getVendoredBlacklistSize: () => vendoredBlacklist.size,
+    _getVendoredWhitelistSize: () => vendoredWhitelist.size,
     _getDeltaBlacklist: () => deltaBlacklist,
+    _getDeltaWhitelist: () => deltaWhitelist,
 };

src/shared/prices.js

@@ -8,13 +8,6 @@ const prices = {};
 let lastFetchedAt = 0;
 
 async function refreshPrices() {
-    // Testnet tokens have no real market value — skip price fetching
-    // and clear any stale mainnet prices so the UI shows no USD values.
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) {
-        clearPrices();
-        return;
-    }
     const now = Date.now();
     if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
     try {
@@ -26,19 +19,7 @@ async function refreshPrices() {
     }
 }
 
-// Clear all cached prices and reset the fetch timestamp so the
-// next refreshPrices() call will fetch fresh data.
-function clearPrices() {
-    for (const key of Object.keys(prices)) {
-        delete prices[key];
-    }
-    lastFetchedAt = 0;
-}
-
-// Return the USD price for a symbol, or null on testnet / unknown.
 function getPrice(symbol) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     return prices[symbol] || null;
 }
 
@@ -56,8 +37,6 @@ function formatUsd(amount) {
 }
 
 function getAddressValueUsd(addr) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     const ethBal = parseFloat(addr.balance || "0");
@@ -72,8 +51,6 @@ function getAddressValueUsd(addr) {
 }
 
 function getWalletValueUsd(wallet) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     for (const addr of wallet.addresses) {
@@ -83,8 +60,6 @@ function getWalletValueUsd(wallet) {
 }
 
 function getTotalValueUsd(wallets) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     for (const wallet of wallets) {
@@ -96,7 +71,6 @@ function getTotalValueUsd(wallets) {
 module.exports = {
     prices,
     refreshPrices,
-    clearPrices,
     getPrice,
     formatUsd,
     getAddressValueUsd,

src/shared/state.js

@@ -1,7 +1,6 @@
 // State management and extension storage persistence.
 
 const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
-const { networkById } = require("./networks");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -12,7 +11,6 @@ const DEFAULT_STATE = {
     hasWallet: false,
     wallets: [],
     trackedTokens: [],
-    networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
     lastBalanceRefresh: 0,
@@ -38,20 +36,13 @@ const state = {
     selectedAddress: null,
     selectedToken: null,
     viewData: {},
-    viewStack: [],
 };
 
-// Return the network configuration for the currently selected network.
-function currentNetwork() {
-    return networkById(state.networkId);
-}
-
 async function saveState() {
     const persisted = {
         hasWallet: state.hasWallet,
         wallets: state.wallets,
         trackedTokens: state.trackedTokens,
-        networkId: state.networkId,
         rpcUrl: state.rpcUrl,
         blockscoutUrl: state.blockscoutUrl,
         lastBalanceRefresh: state.lastBalanceRefresh,
@@ -73,7 +64,6 @@ async function saveState() {
         selectedAddress: state.selectedAddress,
         selectedToken: state.selectedToken,
         viewData: state.viewData,
-        viewStack: state.viewStack,
     };
     await storageApi.set({ autistmask: persisted });
 }
@@ -85,7 +75,6 @@ async function loadState() {
         state.hasWallet = saved.hasWallet;
         state.wallets = saved.wallets || [];
         state.trackedTokens = saved.trackedTokens || [];
-        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
         state.blockscoutUrl =
             saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
@@ -135,7 +124,6 @@ async function loadState() {
             saved.selectedAddress !== undefined ? saved.selectedAddress : null;
         state.selectedToken = saved.selectedToken || null;
         state.viewData = saved.viewData || {};
-        state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
     }
 }
 
@@ -146,10 +134,4 @@ function currentAddress() {
     return state.wallets[state.selectedWallet].addresses[state.selectedAddress];
 }
 
-module.exports = {
+module.exports = { state, saveState, loadState, currentAddress };
-    state,
-    saveState,
-    loadState,
-    currentAddress,
-    currentNetwork,
-};

tests/phishingDomains.test.js

@@ -23,7 +23,9 @@ const {
     hostnameVariants,
     _reset,
     _getVendoredBlacklistSize,
+    _getVendoredWhitelistSize,
     _getDeltaBlacklist,
+    _getDeltaWhitelist,
 } = require("../src/shared/phishingDomains");
 
 // Reset delta state before each test to avoid cross-test contamination.
@@ -43,12 +45,21 @@ describe("phishingDomains", () => {
             expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
         });
 
+        test("vendored whitelist is loaded from bundled JSON", () => {
+            expect(_getVendoredWhitelistSize()).toBeGreaterThan(0);
+        });
+
         test("detects domains from vendored blacklist", () => {
             // These are well-known phishing domains in the vendored list
             expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
             expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
         });
 
+        test("vendored whitelist overrides vendored blacklist", () => {
+            // opensea.pro is whitelisted in the vendored config
+            expect(isPhishingDomain("opensea.pro")).toBe(false);
+        });
+
         test("getBlocklistSize includes vendored entries", () => {
             expect(getBlocklistSize()).toBeGreaterThan(100000);
         });
@@ -88,6 +99,7 @@ describe("phishingDomains", () => {
                     "brand-new-scam-site-xyz123.com",
                     "hopprotocol.pro", // already in vendored
                 ],
+                whitelist: [],
             });
             // Only the new domain should be in the delta
             expect(
@@ -97,14 +109,30 @@ describe("phishingDomains", () => {
             expect(getDeltaSize()).toBe(1);
         });
 
+        test("delta whitelist entries are computed correctly", () => {
+            loadConfig({
+                blacklist: [],
+                whitelist: [
+                    "new-safe-site-xyz789.com",
+                    "opensea.pro", // already in vendored whitelist
+                ],
+            });
+            expect(_getDeltaWhitelist().has("new-safe-site-xyz789.com")).toBe(
+                true,
+            );
+            expect(_getDeltaWhitelist().has("opensea.pro")).toBe(false);
+        });
+
         test("re-loading config replaces previous delta", () => {
             loadConfig({
                 blacklist: ["first-scam-xyz.com"],
+                whitelist: [],
             });
             expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
 
             loadConfig({
                 blacklist: ["second-scam-xyz.com"],
+                whitelist: [],
             });
             expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
             expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
@@ -114,6 +142,7 @@ describe("phishingDomains", () => {
             const baseSize = getBlocklistSize();
             loadConfig({
                 blacklist: ["delta-only-scam-xyz.com"],
+                whitelist: [],
             });
             expect(getBlocklistSize()).toBe(baseSize + 1);
         });
@@ -123,6 +152,7 @@ describe("phishingDomains", () => {
         test("detects domain from delta blacklist", () => {
             loadConfig({
                 blacklist: ["fresh-scam-xyz.com"],
+                whitelist: [],
             });
             expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
         });
@@ -144,13 +174,34 @@ describe("phishingDomains", () => {
         test("detects subdomain of blacklisted domain (delta)", () => {
             loadConfig({
                 blacklist: ["delta-phish-xyz.com"],
+                whitelist: [],
             });
             expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
         });
 
+        test("delta whitelist overrides vendored blacklist", () => {
+            // hopprotocol.pro is in the vendored blacklist
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+            loadConfig({
+                blacklist: [],
+                whitelist: ["hopprotocol.pro"],
+            });
+            // Now whitelisted via delta — should not be flagged
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(false);
+        });
+
+        test("vendored whitelist overrides delta blacklist", () => {
+            loadConfig({
+                blacklist: ["opensea.pro"], // opensea.pro is vendored-whitelisted
+                whitelist: [],
+            });
+            expect(isPhishingDomain("opensea.pro")).toBe(false);
+        });
+
         test("case-insensitive matching", () => {
             loadConfig({
                 blacklist: ["Delta-Scam-XYZ.COM"],
+                whitelist: [],
             });
             expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
             expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
@@ -161,7 +212,7 @@ describe("phishingDomains", () => {
             expect(isPhishingDomain(null)).toBe(false);
         });
 
-        test("handles config with no blacklist key", () => {
+        test("handles config with no blacklist/whitelist keys", () => {
             loadConfig({});
             expect(getDeltaSize()).toBe(0);
             // Vendored list still works
@@ -173,16 +224,19 @@ describe("phishingDomains", () => {
         test("saveDeltaToStorage persists delta under 256KiB", () => {
             loadConfig({
                 blacklist: ["persisted-scam-xyz.com"],
+                whitelist: ["persisted-safe-xyz.com"],
             });
             const stored = localStorage.getItem("phishing-delta");
             expect(stored).not.toBeNull();
             const data = JSON.parse(stored);
             expect(data.blacklist).toContain("persisted-scam-xyz.com");
+            expect(data.whitelist).toContain("persisted-safe-xyz.com");
         });
 
         test("delta is cleared on _reset", () => {
             loadConfig({
                 blacklist: ["temp-scam-xyz.com"],
+                whitelist: [],
             });
             expect(getDeltaSize()).toBe(1);
             _reset();
@@ -197,7 +251,7 @@ describe("phishingDomains", () => {
             expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
         });
 
-        test("does not flag legitimate domains", () => {
+        test("does not flag legitimate whitelisted domains", () => {
             expect(isPhishingDomain("opensea.io")).toBe(false);
             expect(isPhishingDomain("etherscan.io")).toBe(false);
         });