test: containerized Chrome end-to-end harness that drives the real popup (closes #181)

`make check` was green while the AddToken screen crashed on every open.
`script/lint` is only `prettier --check`, so a used-but-not-imported
identifier is invisible until a browser evaluates it. This adds a suite
that runs the real popup in a real Chrome and treats any uncaught page
error or console.error as a failure.

- `script/test-e2e` (with `make test-e2e` as a thin shim) builds
  `dist/chrome/` and runs `tests/e2e/run.js` inside the Playwright image,
  pinned by digest. `playwright-core` is pinned to the matching 1.56.0
  through `yarn.lock`; the two must be bumped together because the
  browsers ship inside the image.
- Deliberately outside `script/test` and `script/check`: REPO_POLICIES
  caps `make test` at 20 seconds. Nothing under `tests/e2e/` is named
  `*.test.js`, so jest cannot pick it up either.
- Launches with `channel: "chromium"`; the default headless shell
  silently refuses to load extensions with no error at all. The extension
  id is read from the service worker URL, never hardcoded.
- All http(s) traffic is intercepted at the browser level and served from
  fixtures, so the run is deterministic and offline. Unrecognised
  outbound requests are reported as failures rather than allowed.
- A missing build or an unavailable container fails loudly; a skip that
  looks like a pass is the failure mode this is meant to prevent.
- One allowlisted page error, for the libsodium WASM CSP fallback tracked
  as #182, which is otherwise untouched here.

The suite was demonstrated failing against the unfixed tree with
`pageerror: showView is not defined` and `pageerror: addressDotHtml is
not defined`, so it carries the two one-line import fixes it caught:

closes #150 — `showView` restored to the destructure in
`src/popup/views/addToken.js`, dropped by a22f33d, which made the
AddToken screen unreachable and corrupted the navigation stack.

closes #151 — `addressDotHtml` restored in
`src/popup/views/transactionDetail.js`, dropped by df031fd, which threw
before `showView("transaction")` for every ERC-20 transfer. The shared
`renderAddressHtml` helper is not used here on purpose: it hardcodes the
`/address/` explorer URL, and this row needs the token-specific `/token/`
link.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug clean dev
+.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -42,13 +42,6 @@ build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
 
-# Development-only build: enables the red DEBUG / INSECURE banner and makes
-# the hardcoded test recovery phrase the output of wallet creation. Never
-# distribute the artifacts this produces.
-build-debug:
-	@echo "Building extension (DEBUG)..."
-	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
-
 clean:
 	@rm -rf dist/
 

README.md

@@ -42,23 +42,6 @@ Load the extension:
 - **Firefox**: Navigate to `about:debugging#/runtime/this-firefox`, click "Load
   Temporary Add-on", and select `dist/firefox/manifest.json`.
 
-### Debug Builds
-
-`make build` always produces a release build: the build-time `DEBUG` constant is
-`false`, so wallet creation uses real entropy and the red banner is off. To
-produce a debug build instead, set `AUTISTMASK_DEBUG=1` in the environment:
-
-```bash
-make build-debug          # or: AUTISTMASK_DEBUG=1 make build
-```
-
-Only the exact value `1` enables it; any other value (including unset, empty, or
-`true`) yields a release build, so a typo cannot accidentally ship the debug
-behavior. The build prints which mode it used. See the
-[DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
-distribute a debug build** — every wallet it creates gets the same publicly
-known test recovery phrase.
-
 ## Entrypoints
 
 This repository adheres to the
@@ -716,19 +699,6 @@ flows, or alter program behavior beyond the banner and the hardcoded mnemonic.
 Adding new DEBUG-conditional branches requires explicit approval from the
 project owner.
 
-`DEBUG` is a build-time constant, not a runtime setting. `build.js` injects it
-into the bundle as the `__BUILD_DEBUG__` define — `false` unless the build was
-run with `AUTISTMASK_DEBUG=1` (see [Debug Builds](#debug-builds)) — and
-`src/shared/constants.js` reads it. It cannot be changed after the bundle is
-produced.
-
-The debug-mode toggle in settings is a separate, runtime-only flag. It raises
-the log level and turns the banner on, and that is all it may ever do: it feeds
-`isDebug()` in `src/shared/log.js`, which is deliberately not what
-`generateMnemonic()` consults. Mnemonic generation reads the build-time `DEBUG`
-constant directly, so no runtime toggle in a release build can reach the
-hardcoded test phrase.
-
 ### Key Decisions
 
 - **No framework**: The popup UI is vanilla JS and HTML. The extension is small

TODO.md

@@ -10,37 +10,30 @@
 
 # Status
 
-pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. No
-other branch is in flight: the settings About well landed as #145 on 2026-07-26
-and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
-question is resolved. Full policy file set present. `make check` verified
-passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
-#149-#168. A real-browser end-to-end suite (`make test-e2e`) now sits alongside
-`make check`, which cannot see a runtime `ReferenceError` in a popup view.
+pre-1.0. Tagged v0.1.0 on 2026-02-27. Working toward the 1.0.0 milestone. Full
+policy file set present. `make check` is green on this branch; a real browser
+end-to-end suite (`make test-e2e`) now exists alongside it, because `make check`
+cannot see a runtime `ReferenceError` in a popup view.
 
 # Next Step
 
-Land #149: make `DEBUG` a build-time constant that defaults to off, injected as
-the `__BUILD_DEBUG__` esbuild define from `AUTISTMASK_DEBUG=1`, so a plain
-`make build` stops handing every newly created wallet the publicly committed
-test recovery phrase. Branch `fix/issue-149-debug-build-flag`; PR open, awaiting
-review.
+Verify `main` passes `make check` after this branch merges and fix anything red;
+`main` must always be green.
 
 # Completed Steps
 
-- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
+- 2026-08-09 Containerized Chrome end-to-end harness (`make test-e2e` /
   `script/test-e2e`) driving the real popup with all network intercepted, plus
   the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
   and TransactionDetail broken for every ERC-20 transfer (#151). Harness
   demonstrated failing before the fixes and passing after (#181).
-- 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
-  (#149-#168).
-- 2026-07-26: About well in settings with build info, repo link and the version
-  click easter egg (#145); proper view navigation stack (#146).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-  shims, README Entrypoints section (#148)
-- 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
-  in approve-tx view (#141).
+  shims, README Entrypoints section
+- 2026-08-09 Landed the settings About well (build info, app name and repo link,
+  release date, version click easter egg) as `23aeae4` (#145).
+- 2026-03-01: About well in settings with build info and easter egg (in flight
+  on feature branch); USD display suppressed on testnets (#142); estimated USD
+  for ETH in approve-tx view (#141).
 - Sepolia testnet support (#137); etherscan links go to token-specific URLs
   (#136).
 - Transaction detail improvements: Type field and on-chain details (#130),
@@ -58,36 +51,15 @@ review.
 
 # Future Steps
 
-- Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
-  and cannot catch undefined identifiers, which is how #150 and #151 shipped.
 - Decide the libsodium backend that actually ships (#182) and delete the single
   allowlist entry it owns in `tests/e2e/harness.js`.
 - Extend the end-to-end suite to the dApp approval signing path (EIP-1193
   through the real content script, background worker and approval popup), and
   decide separately whether docker-in-docker makes `make test-e2e` runnable in
   the Gitea workflow.
-- Make the Firefox target functional: Chrome callback APIs are used against the
-  promise-only `browser` namespace (#153).
-- Send and transaction-flow correctness: gas fee excluded from the
-  insufficient-balance check (#154), WaitTx 60s timeout overwriting a rendered
-  success screen (#155), last-wallet deletion leaving inconsistent state (#156).
-- Security: plaintext password crossing the extension messaging boundary during
-  dApp approvals (#157); MV3 service worker termination killing the background
-  refresh and the 24h phishing list update (#158).
-- Test the crypto core — `wallet.js` derivation and `vault.js` encryption (#159)
-  — and the address-poisoning defense in `transactions.js` (#160).
-- Wallet features for 1.0: show a wallet's recovery phrase behind the password
-  (#161), delete an address from an HD wallet (#162).
-- Docs: `docs/README.md` contradicts the code on external services and names
-  competitors (#163); README Screen Map omits three shipped screens (#164).
-- Owner decisions: Sepolia support versus "Non-Goals for 1.0", and `isMetaMask`
-  naming a competitor in shipped code (#165).
-- Repo policy compliance sweep: test rerun pattern, `yarn`/`npx`, frozen
-  lockfile, undocumented Makefile targets (#166).
-- Prune the 24 stale remote feature branches (#167).
-- Remove dead exports and de-duplicate copy-pasted view helpers (#168).
+- Prune stale branches: dozens of merged local and remote feature branches
+  remain (fix/_, feature/_, tx-\*); delete merged ones locally and on origin.
+- Continue the issue backlog toward a feature-complete wallet, then cut further
+  tags as milestones land.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag; #149 and #157 are parts of it, but the
-  review is broader than either.
-- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
-  land.
+  input validation) before any 1.0rc tag.

build.js

@@ -11,14 +11,6 @@ function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
 }
 
-// DEBUG is a build-time flag, off unless explicitly requested. It is the only
-// thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
-// exact: anything other than the literal "1" (unset, empty, "true", a typo)
-// produces a release build. Failing towards the safe mode is deliberate.
-function isDebugBuild() {
-    return process.env.AUTISTMASK_DEBUG === "1";
-}
-
 function getBuildInfo() {
     const pkg = JSON.parse(
         fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
@@ -55,15 +47,7 @@ async function build() {
     const buildInfo = getBuildInfo();
     console.log("Build info:", buildInfo);
 
-    const debugBuild = isDebugBuild();
-    console.log(
-        debugBuild
-            ? "Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)"
-            : "Build mode: release (DEBUG off)",
-    );
-
     const define = {
-        __BUILD_DEBUG__: JSON.stringify(debugBuild),
         __BUILD_VERSION__: JSON.stringify(buildInfo.version),
         __BUILD_LICENSE__: JSON.stringify(buildInfo.license),
         __BUILD_AUTHOR__: JSON.stringify(buildInfo.author),

src/shared/constants.js

@@ -1,12 +1,4 @@
-// DEBUG is a build-time constant injected by esbuild's define in build.js
-// (see src/shared/buildInfo.js for the same pattern). It is false unless the
-// bundle was produced with AUTISTMASK_DEBUG=1, and it is false whenever the
-// module is loaded outside a bundle (tests, plain require). It must never be
-// derived from anything the user can change at runtime: it is what gates the
-// hardcoded test mnemonic below.
-/* global __BUILD_DEBUG__ */
-const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
-
+const DEBUG = true;
 const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 

src/shared/wallet.js

@@ -5,10 +5,6 @@ const { Mnemonic, HDNodeWallet, Wallet } = require("ethers");
 const { DEBUG, DEBUG_MNEMONIC, BIP44_ETH_PATH } = require("./constants");
 
 function generateMnemonic() {
-    // This must stay the compile-time DEBUG constant. Do NOT switch it to
-    // isDebug() from log.js: that also ORs in the runtime debugMode flag the
-    // settings toggle drives, which would let a user of a release build turn
-    // the hardcoded, publicly known test phrase back on for real wallets.
     if (DEBUG) return DEBUG_MNEMONIC;
     const m = Mnemonic.fromEntropy(
         globalThis.crypto.getRandomValues(new Uint8Array(16)),

tests/wallet.test.js

@@ -1,94 +0,0 @@
-// Tests for the DEBUG build flag as it gates mnemonic generation.
-//
-// The modules read the __BUILD_DEBUG__ global that esbuild replaces at bundle
-// time. Under jest the global is absent, which is exactly the release-build
-// case; the debug-build case is exercised by defining the global and
-// re-requiring the modules with a fresh registry.
-
-const WORDS_IN_12_WORD_PHRASE = 12;
-
-function loadWallet() {
-    const constants = require("../src/shared/constants");
-    const wallet = require("../src/shared/wallet");
-    const log = require("../src/shared/log");
-    return { constants, wallet, log };
-}
-
-describe("generateMnemonic in a release build", () => {
-    beforeEach(() => {
-        jest.resetModules();
-        delete globalThis.__BUILD_DEBUG__;
-    });
-
-    test("DEBUG defaults to false when the build define is absent", () => {
-        const { constants } = loadWallet();
-        expect(constants.DEBUG).toBe(false);
-    });
-
-    test("returns fresh, valid 12-word phrases that are not the test phrase", () => {
-        const { constants, wallet } = loadWallet();
-
-        const first = wallet.generateMnemonic();
-        const second = wallet.generateMnemonic();
-
-        expect(first).not.toBe(second);
-        for (const phrase of [first, second]) {
-            expect(wallet.isValidMnemonic(phrase)).toBe(true);
-            expect(phrase.split(" ")).toHaveLength(WORDS_IN_12_WORD_PHRASE);
-            expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
-        }
-    });
-
-    test("derives a usable HD wallet from the generated phrase", () => {
-        const { wallet } = loadWallet();
-
-        const { xpub, firstAddress } = wallet.hdWalletFromMnemonic(
-            wallet.generateMnemonic(),
-        );
-
-        expect(xpub.startsWith("xpub")).toBe(true);
-        expect(firstAddress).toMatch(/^0x[0-9a-fA-F]{40}$/);
-    });
-
-    test("the runtime debug toggle cannot re-enable the test phrase", () => {
-        const { constants, wallet, log } = loadWallet();
-
-        // What the settings easter-egg toggle does at runtime.
-        log.setRuntimeDebug(true);
-        expect(log.isDebug()).toBe(true);
-
-        const phrase = wallet.generateMnemonic();
-        expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
-        expect(wallet.isValidMnemonic(phrase)).toBe(true);
-        expect(phrase).not.toBe(wallet.generateMnemonic());
-
-        log.setRuntimeDebug(false);
-    });
-});
-
-describe("generateMnemonic in a debug build", () => {
-    beforeEach(() => {
-        jest.resetModules();
-        globalThis.__BUILD_DEBUG__ = true;
-    });
-
-    afterEach(() => {
-        delete globalThis.__BUILD_DEBUG__;
-    });
-
-    test("DEBUG is true and the test phrase is returned", () => {
-        const { constants, wallet } = loadWallet();
-
-        expect(constants.DEBUG).toBe(true);
-        expect(wallet.generateMnemonic()).toBe(constants.DEBUG_MNEMONIC);
-    });
-
-    test("the test phrase is itself a valid 12-word BIP-39 phrase", () => {
-        const { constants, wallet } = loadWallet();
-
-        expect(wallet.isValidMnemonic(constants.DEBUG_MNEMONIC)).toBe(true);
-        expect(constants.DEBUG_MNEMONIC.split(" ")).toHaveLength(
-            WORDS_IN_12_WORD_PHRASE,
-        );
-    });
-});