build: add ESLint to script/lint and containerize linting (closes #152)

script/lint ran `prettier --check .`, byte for byte what script/fmt-check
runs, so make check checked formatting twice and did no static analysis on
a cryptocurrency wallet. Two used-but-not-imported crashes shipped past it.

ESLint is pinned in package.json with @eslint/js recommended as the base and
a flat config in eslint.config.js. no-undef and no-unused-vars are restated
error-level so a future recommended-set change cannot downgrade them.
Globals are declared per tree rather than globally, because a too-wide set
hides the next unimported identifier: browser for the popup and content
scripts, service worker for src/background/ and src/shared/, browser for the
one documented POPUP ONLY module in src/shared/, jest for tests/, node for
build.js, and both for the e2e harnesses, which carry the callbacks they
ship into the page inline.

Two rules new to the recommended set are narrowed, and both would have cost
something to satisfy. no-useless-assignment is off for approval.js and
confirmTx.js only: it flags the `password = null` and `decryptedSecret =
null` wipes at 9 sites there, which are dead by construction — that is what
a best-effort wipe of decrypted key material is — and the rule's fix is to
delete the wipe. It stays on for the rest of the tree, so an ordinary dead
store elsewhere is still an error. preserve-caught-error is off tree-wide:
it would change what the wallet's error paths throw at 3 sites
(src/shared/balances.js 207 and 215, tests/e2e/firefox/run.js 131), and
adopting `{ cause }` is a decision of its own rather than a side effect of
turning a linter on, so new code is not held to it either pending that
decision.

Every remaining violation is fixed: 41 unused bindings and 53 undefined
identifiers. Unused catch bindings became `catch {`, which the repo already
used; the shared init(ctx) view signature keeps its parameter as _ctx in the
three views that do not read it. src/shared/uniswap.js keeps its unused
V2_SWAP_EXACT_OUT decoder behind a scoped disable, because deleting it would
widen the gap it represents rather than close it (#283). driver.js's waitFor
had a plain dead store in its `last` initializer, which the newly scoped
no-useless-assignment catches; the initializer is dropped.

Linting is containerized. script/lint builds the Dockerfile's new lint stage
so the ESLint deciding whether this repo is green is the pinned one and not
whatever the host has; AUTISTMASK_LINT_NATIVE, set only in that image, is
what makes make check inside the CI build lint in place instead of recursing
into docker, and a value set to anything else is now an error rather than a
silent fall-through to the docker path. The check stage takes a COPY --from=
lint dependency so a lint failure fails the whole build early rather than
racing it.

The lint stage roughly doubles the image build, which exposed script/test's
30s cap as marginal rather than a bound: on the first CI run to rebuild the
base stage cold it killed a healthy suite at 30.6s with nothing asserting
false. The cap is a guard against a hung suite, not a wall-clock budget, and
one a healthy suite can trip teaches "just run it again". It stays at 30s on
a host, where the suite runs in about 8s and REPO_POLICIES' figure holds,
and the Dockerfile raises it to 180s through AUTISTMASK_TEST_TIMEOUT for the
in-image run, which also pays a cold jest cache and shares the runner with
the rest of the build. script/test now names a timeout kill as one instead
of reporting it as a test failure, and skips the verbose rerun in that case,
which would only spend the same wall clock to be killed again.

No --fix anywhere in the lint path: make check remains non-mutating.

The README claim that a used-but-not-imported identifier is invisible to
make check, and the same claim in script/test-e2e, are no longer true and
are corrected.

.gitea/workflows/e2e.yml

@@ -0,0 +1,49 @@
+name: e2e
+on: [push]
+
+# The browser end-to-end suites, one job per browser, deliberately kept out
+# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
+# script/cibuild is a plain `docker build .` whose Dockerfile runs
+# make check, so folding a browser suite into either would blow that cap
+# and slow the local fast path. Before this workflow every browser-level
+# guarantee in this repo held only when a human remembered to run it.
+#
+# One job per browser rather than two steps in one job, so a Chrome failure
+# does not hide the Firefox result.
+#
+# Each job is one script and nothing else. Both scripts need docker and
+# nothing else — they deliver the repo to the daemon as a build context and
+# build the extension inside the pinned image — which is what makes them
+# runnable here at all: the runner executes the job in a container against
+# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
+# by the host daemon and mounts an empty directory, and the runner image's
+# node is too old to install this repo's dependencies.
+#
+# These jobs REPORT, they do not gate. Whether a check blocks a merge is
+# Gitea branch protection, which this repo does not configure, so a failure
+# here is a red mark a reviewer has to account for rather than a hard
+# block. Making e2e-chrome a required check is blocked on the measured
+# flake in the dApp signing wait -- two of six runs of unmutated code on a
+# loaded machine -- tracked as
+# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
+# random teaches people to merge past red.
+#
+# Nothing here may pass vacuously. There is no continue-on-error and no
+# `|| true`. Both scripts exit non-zero when docker is missing, when the
+# image build fails, and when the browser fails to start; the Chrome
+# harness aborts the suite outright if its network interception is not in
+# effect.
+jobs:
+    e2e-chrome:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-22
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: script/test-e2e
+
+    e2e-firefox:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-22
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: script/test-e2e-firefox

Dockerfile

@@ -1,8 +1,21 @@
 # node:22-slim (22.x LTS), 2026-02-24
-FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
 
 WORKDIR /app
 
+# Marks "already inside the lint container" for script/lint, which otherwise
+# shells out to docker to build the lint stage below. Nothing outside this
+# image sets it.
+ENV AUTISTMASK_LINT_NATIVE=1
+
+# script/test's default 30s bound is the host figure, against a suite that
+# runs in about 8s there. In here the same suite starts on a cold jest cache
+# and shares the runner with the rest of the build, so 30s is marginal rather
+# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
+# still catches a hang in three minutes and cannot be tripped by a suite that
+# is merely running on contended hardware.
+ENV AUTISTMASK_TEST_TIMEOUT=180
+
 # script/bootstrap installs all prerequisites (make via apt here; node
 # is already in the base image, yarn comes via corepack) and runs
 # yarn install --frozen-lockfile. Dependency manifests are copied first
@@ -13,5 +26,17 @@ RUN script/bootstrap
 
 COPY . .
 
+# Lint stage — fail fast on static analysis and formatting, before the tests
+# and the build. This is also the stage script/lint builds from a host, which
+# is how linting stays on the pinned ESLint rather than the host's.
+FROM base AS lint
+RUN make lint
+
+# Full check and build. The COPY --from is a no-op file copy whose only job is
+# to make BuildKit finish the lint stage before this one starts; without it the
+# stages run in parallel and a lint failure would not fail the build early.
+FROM base AS check
+COPY --from=lint /app/package.json /dev/null
+
 RUN make check
 RUN make build

README.md

@@ -83,12 +83,19 @@ provide:
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
-- `script/test-e2e` — run the Chrome browser end-to-end suite (docker required;
-  see [End-to-End Tests](#end-to-end-tests))
-- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (docker
-  required; builds its own pinned image, see
+- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
+  only prerequisite: it builds a pinned image that carries the repo and a fresh
+  extension build, see [End-to-End Tests](#end-to-end-tests))
+- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
+  against an image with a pinned Firefox and geckodriver, see
   [End-to-End Tests](#end-to-end-tests))
-- `script/lint` — run the linter
+- `script/lint` — run ESLint (`eslint.config.js`) and then `prettier --check`,
+  failing on either. It never writes: `--fix` is not in this path, so
+  `make check` stays non-mutating. Linting runs in the container — the script
+  builds the Dockerfile's `lint` stage — because an ESLint result that depends
+  on whichever ESLint the host happens to have is not a result. Docker is
+  therefore required to lint; inside that image `AUTISTMASK_LINT_NATIVE=1` makes
+  the same script lint in place instead of recursing.
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, test-verify-build, lint, and fmt-check
@@ -136,11 +143,12 @@ are outside `make check`.
 
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
-`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
-docker is required and the suite fails loudly rather than skipping if it is
-unavailable). The suite lives in `tests/e2e/` and is driven by
-`playwright-core`, whose version must stay matched to the container's Playwright
-version — the browsers ship inside the image.
+`mcr.microsoft.com/playwright` container (pinned by digest in
+`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
+required and the suite fails loudly rather than skipping if it is unavailable).
+The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
+version must stay matched to the container's Playwright version — the browsers
+ship inside the image.
 
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
@@ -232,9 +240,12 @@ being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
 printed, tagged `[sw]` or `[page]`.
 
 **Any uncaught page error or `console.error` fails the run.** That is the point:
-a `ReferenceError` from a used-but-not-imported identifier is invisible to
-`make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
-and this suite exists because exactly that class of bug shipped twice.
+this suite exists because a `ReferenceError` from a used-but-not-imported
+identifier shipped twice, fatal in a browser and invisible to a `make check`
+that was `prettier --check` only. ESLint's `no-undef` now catches that exact
+class before a browser is involved, so this suite is no longer the only thing
+standing between it and a release — but a static rule only sees identifiers, and
+the runtime errors this suite catches are broader than one rule.
 
 ### Firefox (`make test-e2e-firefox`)
 
@@ -245,11 +256,13 @@ The suite lives in `tests/e2e/firefox/` and has **no npm dependencies at all**:
 it is a small WebDriver client built on global `fetch` and `child_process`
 against geckodriver's HTTP API.
 
-Unlike the Chrome suite it builds its own container image rather than pulling a
-published one, because no published image carries both a pinned Firefox and a
-matching geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external
-artifacts by digest — the `node` base image, the Firefox 153.0.3 tarball, and
-geckodriver 0.36.0 — and the Firefox version in particular must not float:
+Both suites build their own image, each with the repo and a fresh extension
+build baked in; what differs is the base. The Chrome image layers those on top
+of a published Playwright image, whereas this one is assembled from a `node`
+base, because no published image carries both a pinned Firefox and a matching
+geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external artifacts by
+digest — the `node` base image, the Firefox 153.0.3 tarball, and geckodriver
+0.36.0 — and the Firefox version in particular must not float:
 `-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
 Without that flag, both navigating to `moz-extension://` and running
 chrome-context script fail with `unsupported operation`. The flag grants the
@@ -317,9 +330,46 @@ Two limits are worth knowing, both real differences from the Chrome suite:
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
-pick it up either. Neither is wired into the Gitea workflow yet —
-docker-in-docker in CI is a separate question. Run them locally before changing
-anything under `src/popup/views/`.
+pick it up either. Run them locally before changing anything under
+`src/popup/views/`.
+
+### In CI
+
+`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
+`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
+20-second `make test` cap and the local fast path are untouched. Each job is a
+checkout and the matching `script/` entrypoint, nothing else.
+
+Docker is the only thing either job needs from the runner, and that is not an
+accident. The runner executes a job inside a container against the **host's**
+docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
+host and mounts an empty directory, and the runner image's node is too old to
+install this repo's dependencies. Both suites therefore ship the repo to the
+daemon as a build context and build the extension inside the image, which works
+identically on a laptop.
+
+The jobs **report, they do not gate.** A failure is a red mark against the
+commit that a reviewer has to account for, not a hard block: whether a check
+blocks a merge is Gitea branch protection, which this repo does not configure.
+
+That is not only a statement about configuration. The Chrome suite is
+**measurably flaky under load** — two of six runs of unmutated code on a busy
+machine lost the approval popup out from under the dApp signing wait, always in
+the `#183` section, tracked as
+[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
+has to be read before it is believed, and that flake is the blocker to ever
+making this a required check. Do not answer it with a retry wrapper: a suite
+that reruns until it is green stops being evidence.
+
+Nothing in either job can pass vacuously. There is no `continue-on-error` and no
+`|| true`; both scripts exit non-zero when docker is missing, when the image
+build fails, and when the browser fails to start; the Chrome harness aborts the
+suite outright if its network interception is not in effect.
+
+Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
+the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
+once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
+Firefox and geckodriver downloads the same way.
 
 ## Rationale
 
@@ -538,6 +588,27 @@ Both are click-copyable. Truncating to 4 decimals in summary views is acceptable
 for scannability, but the detail view must never discard precision — it is the
 one place the user can always use to verify exact details.
 
+#### Partial USD totals
+
+Prices are fetched for the top 25 tokens only, so an address can hold assets the
+extension has no price for. Worth zero and worth an unknown amount are different
+facts and are never collapsed into one number. `getAddressValue()` in
+`src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
+holdings, and whether an unpriced holding was left out of it — and every screen
+renders it through `formatAddressTotal()`, so the wording cannot drift:
+
+- Nothing knowable (testnet, or before the first price fetch): no total line.
+- Everything priced: `Total: $5,500.00`.
+- Part priced: `Total: $3,000.00 plus unpriced tokens` — the figure is real as
+  far as it goes and is kept, named as a floor rather than the total.
+- Nothing priced but something held: `Total: unpriced tokens only`. No figure,
+  because the only figure available would be the `$0.00` sum of an empty set,
+  and on the address-removal confirmation that sits directly under "This address
+  holds a balance."
+
+The per-token balance lines are unaffected: each shows its quantity, and a USD
+column that is blank for a token with no price.
+
 #### Language & Labeling
 
 All user-facing text avoids unnecessary jargon wherever possible:
@@ -673,7 +744,9 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
 - **When**: At least one wallet exists. This is the root screen.
 - **Elements**:
     - Active address ETH balance (large) + USD value in parentheses
-    - "Total:" USD value across ETH and every token shown for the active address
+    - "Total:" USD value across ETH and every token shown for the active
+      address, written by `formatAddressTotal()` — see
+      [Partial USD totals](#partial-usd-totals)
     - Active address (color dot, full address, etherscan link, tap to copy)
     - Send / Receive quick-action buttons, both acting on the active address
     - ETH/USD price display
@@ -735,7 +808,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
     - Title: "Wallet Name — Address N"
     - ENS name (if resolved, bold above the address)
     - Full address (color dot, etherscan link, tap to copy)
-    - USD total for address
+    - USD total for address (see [Partial USD totals](#partial-usd-totals))
     - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
       places, USD inline). Each balance row is clickable → **AddressToken**
     - Send / Receive / + Token buttons and a "···" menu button
@@ -1101,11 +1174,13 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
       xprv wallet has no recovery phrase to re-import.
     - A warning when the address holds anything, ETH or any tracked ERC-20,
       followed by the holdings themselves via `balanceLinesForAddress()` and the
-      USD total via `getAddressValueUsd()`. The sentence names no figure of its
-      own: the lines round to four decimals, so a sentence built from a rounded
-      number would report `0.0000 ETH` for an address holding real money. The
-      predicate is `addressHoldsFunds()` in `src/popup/views/helpers.js`,
-      unrounded and token-aware. A balance is a warning, never a refusal.
+      USD total via `formatAddressTotal()` (see
+      [Partial USD totals](#partial-usd-totals)). The sentence names no figure
+      of its own: the lines round to four decimals, so a sentence built from a
+      rounded number would report `0.0000 ETH` for an address holding real
+      money. The predicate is `addressHoldsFunds()` in
+      `src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
+      warning, never a refusal.
     - The rule that a wallet always keeps at least one address, and that
       removing the last one means deleting the wallet from Settings
     - Error line
@@ -1175,7 +1250,11 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
   opening the window, so the screen shows a complete transaction and the signed
   artifact can be compared with it field for field. A request that cannot be
   populated — unreachable node, reverting gas estimate — opens no window and is
-  failed back to the site.
+  failed back to the site. Only one transaction approval exists at a time:
+  populating fixes the nonce, so a second `eth_sendTransaction` arriving while
+  one is unanswered is refused with EIP-1193 code `-32002` rather than being
+  populated at the same nonce. It opens no window and takes no nonce, and the
+  site can send it again once the pending one is answered.
 - **Elements**:
     - "Transaction Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing

TODO.md

@@ -32,19 +32,34 @@ The backlog lives on the
 [Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
 authoritative; this file does not duplicate it. Full policy file set present.
 Real-browser end-to-end suites (`make test-e2e` for Chrome,
-`make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
-cannot see a runtime `ReferenceError` in a popup view.
+`make test-e2e-firefox` for Firefox) sit alongside `make check`, which now does
+static analysis as well as formatting, and `.gitea/workflows/e2e.yml` runs both
+of them on every push.
 
 # Next Step
 
-Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
-`script/lint`. `make check` is `prettier --check` only today and cannot catch
-undefined identifiers, which is how
-[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
-[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
+Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
+input validation) before any 1.0rc tag. Individual filed issues are parts of it,
+but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
+  price. Prices exist for the top 25 tokens only, so the priced-only sum was
+  printed as the total and an address holding nothing but unpriced ERC-20s was
+  shown as worth nothing — directly under "This address holds a balance." on the
+  address-removal confirmation. `getAddressValue()` in `src/shared/prices.js`
+  now returns `{ usd, partial }`, keeping worth-zero and worth-an-unknown-amount
+  apart the way an absent `holders_count` is kept apart from a count of zero,
+  and every screen renders it through the one `formatAddressTotal()`: the figure
+  when it covers everything, the figure marked `plus unpriced tokens` when it
+  covers part, and `Total: unpriced tokens only` when it would cover nothing.
+  Home, AddressDetail and the removal confirmation all read it, and
+  `getWalletValue()`/`getTotalValue()` carry `partial` up. Covered by
+  `tests/addressValue.test.js` — the only-unpriced, genuinely-zero and
+  fully-priced cases at the helper and at both call sites that return their
+  markup — demonstrated failing first
+  ([#261](https://git.eeqj.de/sneak/AutistMask/issues/261)).
 - 2026-08-17: `README.md` no longer advertises a defect the wallet does not
   have. The End-to-End Tests section listed the EIP-1193 code being dropped in
   the last hop into the page as a standing limit of the dApp coverage; that
@@ -54,6 +69,31 @@ undefined identifiers, which is how
   stubbed RPC and the unobservable toolbar popup — were checked against the
   current `src/content/inpage.js` and `tests/e2e/` and left as they are
   ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
+- 2026-08-17: One transaction approval at a time. Populating in the background
+  before the window opens is what makes the displayed object the verified
+  object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
+  concurrently took the same nonce from a node that had seen neither broadcast,
+  and the second could then never be sent, because the only way to give it a
+  fresh nonce is to populate it again after the user has read the old one off
+  the screen. A second request is now refused with EIP-1193 `-32002` while one
+  is unanswered — the slot is taken immediately before population, after the
+  authorization checks, so no second nonce is allocated, no second window opens,
+  and a page the wallet refuses anyway cannot hold the slot against the
+  connected site. The slot is freed at `settleApproval()`, the single point an
+  approval is retired, so every path that ends an approval ends the hold with
+  it; an approval whose window is gone and whose attempt has failed is settled
+  there rather than left waiting on a window that no longer exists, and an
+  approval window that could not be opened at all is answered with `-32603`
+  instead of holding the page's promise open. Signature approvals are not gated,
+  consuming no nonce. A collision that does happen is also reported accurately
+  now: a broadcast the node refused for the nonce, and an approval carrying a
+  nonce this worker has already broadcast for that address on that chain (caught
+  before the node is asked at all), both say the transaction did not reach the
+  network and to send it again, instead of warning that it may have sent. The
+  record is keyed by chain as well as address, because nonce spaces are per
+  chain and low nonces overlap across them. `already known` deliberately keeps
+  the ambiguous wording, because a node that says it has the transaction has it
+  ([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
 - 2026-08-14: The parts of the
   [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
   [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
@@ -70,6 +110,41 @@ undefined identifiers, which is how
   on the real clipboard, read back after a sentinel write. Each of the four was
   demonstrated failing against a deliberately broken build
   ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
+- 2026-08-14: `make check` does static analysis. `script/lint` ran
+  `prettier --check .`, byte-identical to `script/fmt-check`, so a wallet with
+  two shipped used-but-not-imported crashes behind it was green. ESLint is now
+  pinned in `package.json` with `@eslint/js` recommended as the base, flat
+  config in `eslint.config.js`, `no-undef` and `no-unused-vars` error-level, and
+  globals declared per tree — browser for the popup and content scripts, service
+  worker for `src/background/` and `src/shared/`, jest for `tests/`, node for
+  `build.js`. It found 41 unused bindings and 53 undefined identifiers; all are
+  fixed, and dropping a call to an unimported `foo()` into any `src/` file fails
+  `make lint`. Linting is also containerized now: `script/lint` builds the
+  Dockerfile's new `lint` stage, so the ESLint that decides whether this repo is
+  green is the pinned one and not the host's. The lint stage roughly doubles the
+  image build, so `script/test`'s hard timeout is now a bound on a hung suite
+  rather than a wall-clock budget: 30s on the host, where the suite runs in
+  about 8s, and `AUTISTMASK_TEST_TIMEOUT` raises it inside the image, where a
+  cold build pays install and contention costs the policy budget never described
+  ([#152](https://git.eeqj.de/sneak/AutistMask/issues/152)).
+- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
+  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
+  push, separate from `check`, so `make check` and its 20-second `make test` cap
+  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
+  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
+  gate, the dApp approval round trips — was enforced only when a human
+  remembered to run it by hand. The suites could not run on the runner as they
+  stood: the runner executes a job in a container against the host's docker
+  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
+  and the runner image's node cannot install this repo's dependencies. Both
+  suites now ship the repo to the daemon as a build context and build the
+  extension inside the pinned image, so docker is the only prerequisite on a
+  runner or a laptop, and both run the image by ID rather than by tag so
+  concurrent clones cannot swap it. The jobs report rather than gate — this repo
+  configures no branch protection, and the Chrome suite is measurably flaky
+  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
+  rather than papered over
+  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the
@@ -390,12 +465,5 @@ undefined identifiers, which is how
 Only work that has no issue of its own belongs here; everything else is on the
 tracker.
 
-- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag. Individual filed issues are parts of
-  it, but the review is broader than any of them.
-- Decide whether docker-in-docker makes `make test-e2e` and
-  `make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
-  suite itself is tracked as
-  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.

build.js

@@ -63,7 +63,7 @@ function getBuildInfo() {
         commitHash = execSync("git rev-parse --short HEAD", {
             encoding: "utf8",
         }).trim();
-    } catch (_) {
+    } catch {
         // not a git repo or git not available
     }
     let commitHashFull = "unknown";
@@ -71,7 +71,7 @@ function getBuildInfo() {
         commitHashFull = execSync("git rev-parse HEAD", {
             encoding: "utf8",
         }).trim();
-    } catch (_) {
+    } catch {
         // not a git repo or git not available
     }
     return {

eslint.config.js

@@ -0,0 +1,152 @@
+// ESLint flat config. Static analysis for make check; formatting stays with
+// prettier (script/fmt-check), so nothing here touches style.
+//
+// The sources are CommonJS and are bundled per entrypoint by build.js, so the
+// globals differ by tree and are declared per tree below. Getting that wrong in
+// either direction defeats the point: too few globals buries a real no-undef in
+// false positives, too many hides the next unimported identifier.
+
+const js = require("@eslint/js");
+const globals = require("globals");
+
+// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
+// the code feature-detects between them.
+const extensionGlobals = {
+    chrome: "readonly",
+    browser: "readonly",
+};
+
+const commonjs = {
+    ecmaVersion: 2024,
+    sourceType: "commonjs",
+};
+
+module.exports = [
+    {
+        ignores: ["dist/", "node_modules/"],
+    },
+
+    js.configs.recommended,
+
+    {
+        rules: {
+            // The two rules this config exists for. Both are already
+            // error-level in the recommended set; restated so a future
+            // recommended-set change cannot silently downgrade them.
+            "no-undef": "error",
+            // `_`-prefixed arguments are the deliberate "present for the
+            // interface, unused here" marker: the popup views share one
+            // init(ctx) signature and three of the eight do not read ctx.
+            // An unused catch binding is written `catch {`, which the repo
+            // already does, so caught errors stay checked.
+            "no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
+
+            // Off tree-wide: it requires every rethrow to carry `{ cause }`,
+            // at 3 sites today (src/shared/balances.js 207 and 215,
+            // tests/e2e/firefox/run.js 131). That is a change to what the
+            // wallet's error paths actually throw, and it is a decision of its
+            // own rather than a side effect of turning a linter on — so it is
+            // off everywhere, including for new code, until that decision is
+            // made. Unlike no-useless-assignment below, this is not an
+            // accommodation of particular sites and must not be scoped to
+            // them.
+            "preserve-caught-error": "off",
+        },
+    },
+
+    // no-useless-assignment stays on everywhere except the two files that
+    // wipe decrypted key material: the `password = null` and
+    // `decryptedSecret = null` assignments after use are dead by construction
+    // — that is what a best-effort wipe is — and the rule's fix is to delete
+    // the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
+    // and confirmTx.js 459. Everything else in the tree is still checked, so
+    // an ordinary dead store elsewhere is still an error.
+    {
+        files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
+        rules: {
+            "no-useless-assignment": "off",
+        },
+    },
+
+    // Popup and content scripts: page/window context.
+    {
+        files: ["src/popup/**/*.js", "src/content/**/*.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.browser, ...extensionGlobals },
+        },
+    },
+
+    // MV3 background: a service worker, with no window and no document.
+    {
+        files: ["src/background/**/*.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.serviceworker, ...extensionGlobals },
+        },
+    },
+
+    // src/shared is bundled into both, so it may only use what both provide:
+    // the service worker globals are the intersection, plus the extension APIs.
+    {
+        files: ["src/shared/**/*.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.serviceworker, ...extensionGlobals },
+        },
+    },
+
+    // src/shared/ens.js is the documented exception to the line above: its own
+    // header says POPUP ONLY, it caches in localStorage, and only popup views
+    // require it. Linting it as a service worker would be wrong about the file.
+    {
+        files: ["src/shared/ens.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.browser, ...extensionGlobals },
+        },
+    },
+
+    // Unit tests: jest on node.
+    {
+        files: ["tests/**/*.test.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.node, ...globals.jest },
+        },
+    },
+
+    // The build script is a plain node program.
+    {
+        files: ["build.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.node },
+        },
+    },
+
+    // The e2e harnesses are node programs that also carry, inline, the
+    // callbacks they ship into the browser via page.evaluate — so both
+    // contexts really are present in the same file and both sets of globals
+    // are in scope somewhere in it.
+    {
+        files: ["tests/e2e/**/*.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: {
+                ...globals.node,
+                ...globals.browser,
+                ...extensionGlobals,
+            },
+        },
+    },
+
+    // This config file itself.
+    {
+        files: ["eslint.config.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.node },
+        },
+    },
+];

package.json

@@ -9,13 +9,16 @@
         "test": "jest --forceExit",
         "test:verbose": "jest --forceExit --verbose",
         "build": "node build.js",
-        "lint": "prettier --check .",
+        "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
     "devDependencies": {
+        "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "^4.2.1",
         "esbuild": "^0.27.3",
+        "eslint": "10.8.1",
+        "globals": "17.11.0",
         "jest": "^30.2.0",
         "playwright-core": "1.56.0",
         "prettier": "^3.8.1",

script/lint

@@ -1,13 +1,51 @@
 #!/bin/sh
-# script/lint: run the linter.
+# script/lint: run the linter (eslint, then prettier --check).
+#
+# Linting is containerized. ESLint results depend on the ESLint version, and
+# the pinned one is the one in the image; a host's own install must not be
+# able to decide whether this repo is green. From a host this therefore builds
+# the Dockerfile's `lint` stage, which runs this same script inside the image.
+#
+# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
+# what stops the recursion, so `make check` inside the CI build lints in place
+# instead of trying to reach a docker daemon it does not have.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    echo "Linting..."
-    yarn run lint 2>&1
+
+    case "${AUTISTMASK_LINT_NATIVE:-}" in
+    1)
+        echo "Linting..."
+        yarn run lint 2>&1
+        return 0
+        ;;
+    "") ;;
+    *)
+        # Set but not recognized: say so rather than silently taking the
+        # docker path, which would look like the variable had no effect.
+        echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
+            "'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
+        exit 1
+        ;;
+    esac
+
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "lint: docker is required; linting does not run on the host" >&2
+        exit 1
+    fi
+
+    echo "Linting in the pinned container..."
+    # --progress=plain: the default progress renderer collapses the lint
+    # output on success, and a lint run whose output cannot be seen is not
+    # evidence that it ran.
+    #
+    # --output=type=cacheonly: the exit status is the whole result; exporting
+    # an image afterwards costs about ten times the lint itself.
+    docker build --progress=plain --target lint \
+        --output=type=cacheonly . 2>&1
 }
 
 main "$@"

script/test

@@ -1,19 +1,49 @@
 #!/bin/sh
 # script/test: run the test suite.
+#
+# The timeout bounds a hung suite; it is not a performance budget. On a
+# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
+# the bound. Inside the image the same suite also pays a cold jest cache and
+# shares the runner with the rest of the build, which is not what that budget
+# describes, so the Dockerfile raises the bound through
+# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
+# produces a red that means nothing, and teaches "just run it again".
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
 
 main() {
     cd "$ROOT"
-    echo "Running tests..."
-    timeout 30 yarn run test 2>&1 || {
-        echo "--- Rerunning with --verbose for details ---"
-        timeout 30 yarn run test:verbose 2>&1 || true
-        # Always fail: the first run already proved the tests are broken, so a
-        # flaky pass on the rerun must not turn the build green.
+    echo "Running tests (timeout ${TIMEOUT}s)..."
+
+    status=0
+    timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
+    [ "$status" -eq 0 ] && return 0
+
+    # 124 is timeout(1) killing the suite. Say so: a kill is not a failed
+    # assertion, and the verbose rerun would only spend the same wall clock
+    # to be killed again.
+    if [ "$status" -eq 124 ]; then
+        echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
+        echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
         exit 1
-    }
+    fi
+
+    # 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
+    # is not a duration it accepts. The suite never ran, so it neither timed out
+    # nor failed, and the verbose rerun would only reprint the same complaint.
+    if [ "$status" -eq 125 ]; then
+        echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
+        echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
+        exit 1
+    fi
+
+    echo "--- Rerunning with --verbose for details ---"
+    timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
+    # Always fail: the first run already proved the tests are broken, so a
+    # flaky pass on the rerun must not turn the build green.
+    exit 1
 }
 
 main "$@"

script/test-e2e

@@ -5,19 +5,32 @@
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
-# yourself before touching popup views; it is the only check that can see
-# a used-but-not-imported identifier blow up at runtime.
+# yourself before touching popup views. ESLint's no-undef now catches a
+# used-but-not-imported identifier in make check, but only this suite sees
+# what a view actually does when it runs.
+# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
+# from check so that cap and the local fast path both stay intact.
+#
+# Docker is the only prerequisite. The repo reaches the container as a
+# build context and the extension is built inside it (see
+# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
+# on the machine that starts the run. That is not a convenience: a bind
+# mount cannot work under Gitea Actions, and the runner image's node is too
+# old to install this repo's dependencies.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-#
-# The playwright-core devDependency is pinned to the matching Playwright
-# version (1.56.0) and the two must be bumped together: the browsers ship
-# inside this image, and playwright-core looks for the exact browser
-# revision its own version expects. A mismatch fails at launch.
-IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
+IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+
+IIDFILE=""
+
+cleanup() {
+    if [ -n "$IIDFILE" ]; then
+        rm -f "$IIDFILE"
+    fi
+}
 
 main() {
     cd "$ROOT"
@@ -27,14 +40,23 @@ main() {
         exit 1
     fi
 
-    echo "Building extension for e2e..."
-    yarn run build 2>&1
+    IIDFILE="$(mktemp)"
+    trap cleanup EXIT
+    trap 'cleanup; exit 130' INT TERM
+
+    echo "Building the Chrome e2e image (extension included)..."
+    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
+    # The image is run by ID, not by tag: where two clones of this repo run
+    # the suite at once, the other build can move the tag between this
+    # build and this run, and the suite would then silently test the other
+    # checkout.
+    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # --user: keep files the suite touches owned by the caller, not root.
-    # HOME=/tmp: the mapped uid has no home directory in the image.
+    # HOME=/tmp: the image's root home is not a reliable place for the
+    #   browser profile.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
     #   the MV3 background service worker — including the phishing
@@ -51,13 +73,10 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
-        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        -v "$ROOT:/work" \
-        -w /work \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/run.js
 }
 

script/test-e2e-firefox

@@ -5,12 +5,17 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit.
+# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
+# on every push, in a job separate from check.
 #
-# Unlike script/test-e2e this builds its image locally, because no
+# Unlike script/test-e2e this builds its base image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
 # All three external artifacts are pinned by digest inside the Dockerfile;
-# see tests/e2e/firefox/Dockerfile.
+# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
+# the extension build are baked into the image rather than mounted.
+#
+# Docker is the only prerequisite: nothing here depends on the node, yarn
+# or make on the machine that starts the run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -18,6 +23,14 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
 
+IIDFILE=""
+
+cleanup() {
+    if [ -n "$IIDFILE" ]; then
+        rm -f "$IIDFILE"
+    fi
+}
+
 main() {
     cd "$ROOT"
 
@@ -26,16 +39,20 @@ main() {
         exit 1
     fi
 
-    echo "Building extension for e2e..."
-    yarn run build 2>&1
+    IIDFILE="$(mktemp)"
+    trap cleanup EXIT
+    trap 'cleanup; exit 130' INT TERM
 
-    # The build context is tests/e2e/firefox/ and holds nothing but the
-    # Dockerfile: the harness itself arrives over the bind mount below, so
-    # editing it never invalidates an image layer.
-    echo "Building the pinned Firefox e2e image..."
-    docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
+    echo "Building the pinned Firefox e2e image (extension included)..."
+    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
+        -f tests/e2e/firefox/Dockerfile .
 
     echo "Running the Firefox e2e suite..."
+    # The image is run by ID, not by tag: where two clones of this repo run
+    # the suite at once, the other build can move the tag between this
+    # build and this run, and the suite would then silently test the other
+    # checkout.
+    #
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
     # --network none: the suite stubs nothing, so this is what keeps the
     #   run offline and deterministic. The extension swallows its own
@@ -43,8 +60,8 @@ main() {
     #   network note in README.md. Weaker than the Chrome suite's
     #   fixture interception, and honestly so — it proves no request
     #   escaped, but it cannot report which ones were attempted.
-    # --user: keep files the suite touches owned by the caller, not root.
-    # HOME=/tmp: the mapped uid has no home directory in the image.
+    # HOME=/tmp: the image's root home is not a reliable place for the
+    #   browser profile.
     #
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
@@ -52,11 +69,8 @@ main() {
     docker run --rm \
         --shm-size=1g \
         --network none \
-        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        -v "$ROOT:/work" \
-        -w /work \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/firefox/run.js dist/firefox
 }
 

src/background/index.js

@@ -24,6 +24,7 @@ const {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
+    TX_STAGE_NONCE,
 } = require("../shared/approvalVerify");
 const { prepareApprovalTx } = require("../shared/approvalTx");
 const {
@@ -57,6 +58,114 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
+// One transaction approval at a time, wallet-wide.
+//
+// The transaction a site asks for is populated before its approval window
+// opens, so that the object the user is shown is the object the signed
+// artifact is verified against. Populating fixes the nonce. Two requests
+// populated concurrently therefore take the SAME nonce — the node reports the
+// same pending count to both, neither having been broadcast — and whichever is
+// broadcast second is refused by the network for a nonce it can never be
+// re-signed at, because re-signing it would mean signing something other than
+// what was displayed.
+//
+// So the second request is refused while the first is unanswered. It is
+// refused before anything is populated, so no second nonce is allocated at
+// all, and while the page is still waiting with nothing on screen. The
+// alternatives were considered and rejected in
+// https://git.eeqj.de/sneak/AutistMask/issues/271: populating again at Confirm
+// puts a nonce on screen that is not the nonce that gets signed, and
+// allocating around in-flight approvals makes the wallet's own bookkeeping the
+// authority on a nonce the network has not accepted, which an abandoned
+// approval then leaves a hole in.
+//
+// Sign approvals are not gated: a signature consumes no nonce.
+//
+// The slot is null when free, and otherwise the handle of the request holding
+// it. Once that request has raised its approval the handle carries the
+// approval's id, so that retiring the approval frees the slot: every exit from
+// pendingApprovals goes through settleApproval(), which makes that one hook
+// complete. The holder's own finally is the backstop for the interval before
+// the approval exists.
+let txApprovalSlot = null;
+
+// EIP-1474 "resource unavailable": the standard code for a request that is
+// refused because another one is already pending.
+const TX_APPROVAL_PENDING_CODE = -32002;
+
+// True at every moment this can be sent: the slot is taken immediately before
+// the transaction is populated, so the other request is either being prepared
+// or on screen. It does not claim the other one is displayed yet, because for
+// the length of one network round trip it is not.
+const TX_APPROVAL_PENDING_MESSAGE =
+    "AutistMask handles one transaction at a time, and another one is" +
+    " already in progress, so this one was not sent. Please finish that" +
+    " transaction, then send this one again.";
+
+// Take the slot, or refuse. Nothing awaits between the test and the set, so
+// two requests that reach this in the same tick cannot both pass it — the
+// position of the call in the handler is irrelevant to that, which is why it
+// sits after the authorization checks. A page the wallet is going to refuse
+// anyway must not be able to take the slot away from the connected site.
+function reserveTxApprovalSlot() {
+    if (txApprovalSlot) return null;
+    txApprovalSlot = { approvalId: null };
+    return txApprovalSlot;
+}
+
+// Free the slot, if this handle is still the one holding it.
+function releaseTxApprovalSlot(handle) {
+    if (handle && txApprovalSlot !== handle) return;
+    txApprovalSlot = null;
+}
+
+// Free the slot held on behalf of a retired approval. Called from
+// settleApproval() for every approval, and a no-op for the ones the slot was
+// not taken for.
+function releaseTxApprovalSlotFor(approvalId) {
+    if (txApprovalSlot && txApprovalSlot.approvalId === approvalId) {
+        txApprovalSlot = null;
+    }
+}
+
+// Nonces this worker has already handed to the node, per chain and address.
+// This is the wallet's own knowledge that a nonce is spent, and it is checked
+// before a broadcast rather than after: a node's pending count can lag a
+// transaction it has itself just accepted, and a request populated inside that
+// window would otherwise be signed and sent at a nonce this wallet has already
+// used.
+//
+// The chain is part of the key because nonce spaces are per chain and the
+// wallet switches networks. Without it a nonce spent on one chain would refuse
+// that nonce on every other chain — and low nonces overlap across chains as a
+// matter of course, so the refusal would be both routine and false.
+//
+// The record dies with the worker, which is correct rather than merely
+// convenient: after a restart the node's count is the only answer available,
+// and a transaction of this wallet's that the node has forgotten is one the
+// user does want to be able to send again.
+const broadcastNonces = {};
+
+function broadcastNoncesFor(chainId, address) {
+    const key =
+        String(chainId).toLowerCase() +
+        ":" +
+        String(address || "").toLowerCase();
+    if (!broadcastNonces[key]) broadcastNonces[key] = new Set();
+    return broadcastNonces[key];
+}
+
+// An approved transaction's nonce as a decimal string, or null if it cannot be
+// read as a number. Verification refuses an unreadable nonce before this is
+// ever reached; null here only keeps the record from holding junk.
+function approvedNonce(approvedTx) {
+    try {
+        return BigInt(approvedTx.nonce).toString();
+    } catch {
+        return null;
+    }
+}
+
 async function getState() {
     const result = await storageApi.get("autistmask");
     return (
@@ -148,11 +257,41 @@ function settleApproval(id, result, options) {
     const holdsClaim = !!(options && options.holdsClaim);
     if (approval.attemptInFlight && !holdsClaim) return false;
     delete pendingApprovals[id];
+    // The transaction-approval slot is held for exactly as long as the
+    // approval it was taken for is alive, and this is the one place an
+    // approval stops being alive.
+    releaseTxApprovalSlotFor(id);
     approval.resolve(result);
     resetPopupUrl();
     return true;
 }
 
+// What a pending approval resolves to when it is given up on rather than
+// answered: the window was closed, or could not be opened at all. A tx or sign
+// approval answers the requesting page in EIP-1193 shape; a site-connection
+// approval answers the connection handler in its own.
+function abandonedResult(approval, code, message) {
+    if (approval.type === "tx" || approval.type === "sign") {
+        return { error: { code, message } };
+    }
+    return { approved: false, remember: false };
+}
+
+// A window the user closed without answering is a refusal by the user, which
+// is 4001 and the wording every other rejection path already uses.
+const APPROVAL_REJECTED_CODE = 4001;
+const APPROVAL_REJECTED_MESSAGE = "User rejected the request.";
+
+// The window could not be opened, so the user was never asked. This is the
+// wallet failing, not the user refusing, so it does not claim to be a
+// rejection: -32603 is the JSON-RPC code for the wallet's own internal
+// failure, and the page is told plainly that nothing was shown.
+const APPROVAL_WINDOW_FAILED_CODE = -32603;
+
+const APPROVAL_WINDOW_FAILED_MESSAGE =
+    "AutistMask could not open its approval window, so this request was not" +
+    " shown to you and nothing was sent.";
+
 // Take exclusive hold of a pending approval for one attempt, or refuse.
 //
 // An approval that failed retryably has to stay in pendingApprovals, so its
@@ -172,8 +311,26 @@ function claimApproval(approval) {
 
 // Release an approval whose attempt failed in a way the user can retry.
 // Nothing was broadcast, so the next attempt may claim it.
+//
+// Unless the window it would be retried in is already gone. The user closed it
+// while the attempt was running and settleApproval() declined then, correctly,
+// because the attempt still owned the approval; the attempt has now failed, so
+// nothing owns it and nothing can reach it. Left standing it would hold the
+// requesting page's promise open forever and, with it, the transaction
+// approval slot. It is settled here as the rejection the closed window
+// already meant.
 function releaseApproval(approval) {
     approval.attemptInFlight = false;
+    if (approval.windowClosed) {
+        settleApproval(
+            approval.id,
+            abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            ),
+        );
+    }
 }
 
 // Open approval in a separate popup window.
@@ -200,9 +357,35 @@ function openApprovalWindow(id) {
             );
         }
         windowsApi.create(opts, (win) => {
-            if (win) {
-                pendingApprovals[id].windowId = win.id;
+            const approval = pendingApprovals[id];
+            if (!approval) {
+                // Settled while the window was opening — an address switch,
+                // say. Nothing is waiting on it, and a window showing an
+                // approval that no longer exists is not left on screen.
+                if (win) {
+                    windowsApi.remove(win.id, () => {
+                        if (runtime.lastError) {
+                            // window already closed
+                        }
+                    });
+                }
+                return;
             }
+            if (!win) {
+                // No window means no way to ever answer this approval, and an
+                // approval nothing can answer holds the requesting page's
+                // promise open forever. Settle it now instead.
+                settleApproval(
+                    id,
+                    abandonedResult(
+                        approval,
+                        APPROVAL_WINDOW_FAILED_CODE,
+                        APPROVAL_WINDOW_FAILED_MESSAGE,
+                    ),
+                );
+                return;
+            }
+            approval.windowId = win.id;
         });
     });
 }
@@ -212,7 +395,7 @@ function openApprovalWindow(id) {
 function requestApproval(origin, hostname) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
-        pendingApprovals[id] = { origin, hostname, resolve };
+        pendingApprovals[id] = { id, origin, hostname, resolve };
 
         if (actionApi && typeof actionApi.openPopup === "function") {
             actionApi.setPopup({
@@ -243,10 +426,13 @@ function requestApproval(origin, hostname) {
 // it is pinned here rather than read again at signing time — an address switch
 // between approval and signing must refuse, not sign from an account this
 // screen never named.
-function requestTxApproval(origin, hostname, approvedTx, approvedFrom) {
+// `slot` is the transaction-approval slot its caller holds. Handing the
+// approval's id to it is what makes retiring the approval free the slot.
+function requestTxApproval(origin, hostname, approvedTx, approvedFrom, slot) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = {
+            id,
             origin,
             hostname,
             approvedTx,
@@ -254,6 +440,7 @@ function requestTxApproval(origin, hostname, approvedTx, approvedFrom) {
             resolve,
             type: "tx",
         };
+        if (slot) slot.approvalId = id;
 
         openApprovalWindow(id);
     });
@@ -267,6 +454,7 @@ function requestSignApproval(origin, hostname, signParams, approvedFrom) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = {
+            id,
             origin,
             hostname,
             signParams,
@@ -585,31 +773,68 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "eth_sendTransaction") {
-        const s = await getState();
-        const activeAddress = await getActiveAddress();
-        if (!activeAddress)
-            return { error: { message: "No accounts available" } };
+        return await handleSendTransaction(params, origin);
+    }
 
-        const hostname = extractHostname(origin);
-        const allowed = s.allowedSites[activeAddress] || [];
-        if (
-            !allowed.includes(hostname) &&
-            !connectedSites[origin + ":" + activeAddress]
-        ) {
-            return { error: { code: 4100, message: "Unauthorized" } };
+    // Proxy safe read-only methods to the RPC node
+    if (PROXY_METHODS.includes(method)) {
+        try {
+            const result = await proxyRpc(method, params);
+            return { result };
+        } catch (e) {
+            return { error: { message: e.message } };
         }
+    }
 
-        const txParams = params?.[0] || {};
-        if (namesAnotherAddress(txParams.from, activeAddress)) {
-            return {
-                error: {
-                    code: 4100,
-                    message:
-                        "This site asked to send from an address that is not the active one.",
-                },
-            };
-        }
+    return { error: { message: "Unsupported method: " + method } };
+}
 
+// The body of eth_sendTransaction, from the connection check through to the
+// user's decision. It takes the single transaction-approval slot once it knows
+// it is going to populate a transaction, and holds it until the requesting
+// page has its answer.
+async function handleSendTransaction(params, origin) {
+    const s = await getState();
+    const activeAddress = await getActiveAddress();
+    if (!activeAddress) return { error: { message: "No accounts available" } };
+
+    const hostname = extractHostname(origin);
+    const allowed = s.allowedSites[activeAddress] || [];
+    if (
+        !allowed.includes(hostname) &&
+        !connectedSites[origin + ":" + activeAddress]
+    ) {
+        return { error: { code: 4100, message: "Unauthorized" } };
+    }
+
+    const txParams = params?.[0] || {};
+    if (namesAnotherAddress(txParams.from, activeAddress)) {
+        return {
+            error: {
+                code: 4100,
+                message:
+                    "This site asked to send from an address that is not the active one.",
+            },
+        };
+    }
+
+    // Everything above refuses without populating anything, so the slot is
+    // taken here rather than at the top of the handler: a page the wallet was
+    // never going to serve must not be able to hold the slot and make the
+    // connected site's own transaction fail as "already in progress". The
+    // reservation is atomic because nothing awaits between its test and its
+    // set, not because of where it sits.
+    const slot = reserveTxApprovalSlot();
+    if (!slot) {
+        return {
+            error: {
+                code: TX_APPROVAL_PENDING_CODE,
+                message: TX_APPROVAL_PENDING_MESSAGE,
+            },
+        };
+    }
+
+    try {
         // Populate here, before any window opens, so that the transaction the
         // user is shown is a complete one and is the same object the signed
         // artifact is checked against. A failure raises no approval at all and
@@ -644,22 +869,17 @@ async function handleRpc(method, params, origin) {
             hostname,
             approvedTx,
             activeAddress,
+            slot,
         );
         if (decision.error) return { error: decision.error };
         return { result: decision.txHash };
+    } finally {
+        // Retiring the approval has normally freed the slot already, through
+        // settleApproval(); this covers the paths that return before an
+        // approval exists at all, and frees nothing if another request has
+        // since taken the slot.
+        releaseTxApprovalSlot(slot);
     }
-
-    // Proxy safe read-only methods to the RPC node
-    if (PROXY_METHODS.includes(method)) {
-        try {
-            const result = await proxyRpc(method, params);
-            return { result };
-        } catch (e) {
-            return { error: { message: e.message } };
-        }
-    }
-
-    return { error: { message: "Unsupported method: " + method } };
 }
 
 // Broadcast chainChanged to all tabs when the network is switched.
@@ -694,15 +914,11 @@ async function broadcastAccountsChanged() {
     // being signed and broadcast right now, and neither rejecting it to the
     // page nor closing the window it is reporting into is survivable.
     for (const [id, approval] of Object.entries(pendingApprovals)) {
-        const rejection =
-            approval.type === "tx" || approval.type === "sign"
-                ? {
-                      error: {
-                          code: 4001,
-                          message: "User rejected the request.",
-                      },
-                  }
-                : { approved: false, remember: false };
+        const rejection = abandonedResult(
+            approval,
+            APPROVAL_REJECTED_CODE,
+            APPROVAL_REJECTED_MESSAGE,
+        );
         if (!settleApproval(id, rejection)) continue;
         if (approval.windowId) {
             windowsApi.remove(approval.windowId, () => {
@@ -831,21 +1047,19 @@ startBackgroundJobs();
 // verify and broadcast it is waiting on, so a user closing an apparently-hung
 // window is an ordinary event with an attempt already in flight behind it.
 // settleApproval() refuses those, which leaves the attempt to report its real
-// outcome to the page.
+// outcome to the page — and the window is recorded as gone, so that an attempt
+// which then fails retryably settles instead of waiting in a window that no
+// longer exists.
 if (windowsApi && windowsApi.onRemoved) {
     windowsApi.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const rejection =
-                approval.type === "tx" || approval.type === "sign"
-                    ? {
-                          error: {
-                              code: 4001,
-                              message: "User rejected the request.",
-                          },
-                      }
-                    : { approved: false, remember: false };
-            settleApproval(id, rejection);
+            const rejection = abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            );
+            if (!settleApproval(id, rejection)) approval.windowClosed = true;
         }
     });
 }
@@ -959,7 +1173,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             sendResponse({
                 error: outcome.error,
                 retryable: outcome.retryable,
-                stage: TX_STAGE_SIGN,
+                stage: outcome.stage,
             });
             return false;
         }
@@ -975,8 +1189,15 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         }
 
         (async () => {
+            // The chain this attempt is on, read once. Verification below
+            // refuses an artifact signed for any other chain, and the nonce
+            // record is both consulted and written under this one, so a
+            // network switch part-way through cannot make the check and the
+            // record disagree about which chain the nonce was spent on.
+            let chainId;
             try {
                 await loadState();
+                chainId = currentNetwork().chainId;
                 const activeAddress = await getActiveAddress();
                 // An address switch between approval and signing refuses. The
                 // approval named one account; signing from whichever account
@@ -999,7 +1220,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     msg.rawSignedTx,
                     approval.approvedTx,
                     approval.approvedFrom,
-                    currentNetwork().chainId,
+                    chainId,
                 );
             } catch (e) {
                 // A signed transaction that is not the approved one is not
@@ -1019,7 +1240,31 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: TX_STAGE_VERIFY,
+                    stage: outcome.stage,
+                });
+                return;
+            }
+
+            // A nonce this worker has already broadcast for this address on
+            // this chain. The node is not asked: it has answered once already,
+            // and the wallet holding the receipt of that answer is what makes
+            // this failure one the user can be told did not reach the network.
+            // A nonce spent on another chain is not spent here — the chains
+            // count separately, and refusing across them would block ordinary
+            // use with a message that is not true.
+            const nonce = approvedNonce(approval.approvedTx);
+            const spent = broadcastNoncesFor(chainId, approval.approvedFrom);
+            if (nonce !== null && spent.has(nonce)) {
+                const outcome = describeTxFailure(TX_STAGE_NONCE, null);
+                settleApproval(
+                    msg.id,
+                    { error: { message: outcome.error } },
+                    { holdsClaim: true },
+                );
+                sendResponse({
+                    error: outcome.error,
+                    retryable: outcome.retryable,
+                    stage: outcome.stage,
                 });
                 return;
             }
@@ -1027,6 +1272,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             try {
                 const provider = getProvider(state.rpcUrl);
                 const tx = await provider.broadcastTransaction(msg.rawSignedTx);
+                if (nonce !== null) spent.add(nonce);
                 settleApproval(
                     msg.id,
                     { txHash: tx.hash },
@@ -1039,6 +1285,11 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // tell a transaction that never left from one already in the
                 // mempool. The page has been given its outcome for this
                 // request; a second attempt would report a second one.
+                //
+                // Unless the node blamed the nonce, which is the one answer
+                // that says plainly it did not take the transaction:
+                // describeTxFailure() reclassifies that, and the stage it
+                // returns is the one reported.
                 const outcome = describeTxFailure(TX_STAGE_BROADCAST, e);
                 settleApproval(
                     msg.id,
@@ -1048,7 +1299,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 sendResponse({
                     error: outcome.error,
                     retryable: outcome.retryable,
-                    stage: TX_STAGE_BROADCAST,
+                    stage: outcome.stage,
                 });
             }
         })();

src/content/inpage.js

@@ -79,7 +79,7 @@
         for (const cb of cbs) {
             try {
                 cb(data);
-            } catch (e) {
+            } catch {
                 // ignore listener errors
             }
         }

src/popup/index.js

@@ -12,7 +12,6 @@ const {
     setBackRenderer,
     pushCurrentView,
     goBack,
-    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 // Renders a view the popup lands on without having navigated to it forward:

src/popup/views/addWallet.js

@@ -194,7 +194,7 @@ async function importPrivateKey(ctx) {
     let addr;
     try {
         addr = addressFromPrivateKey(key);
-    } catch (e) {
+    } catch {
         showFlash("Invalid private key.");
         return;
     }
@@ -246,7 +246,7 @@ async function importXprvKey(ctx) {
     let result;
     try {
         result = hdWalletFromXprv(xprv);
-    } catch (e) {
+    } catch {
         showFlash(
             "That extended private key is not valid. Please check it and try again.",
         );

src/popup/views/addressDetail.js

@@ -12,8 +12,8 @@ const {
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, currentAddress, saveState } = require("../../shared/state");
-const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
+const { state, saveState } = require("../../shared/state");
+const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,
@@ -44,7 +44,6 @@ function show() {
     state.selectedToken = null;
     const wallet = state.wallets[state.selectedWallet];
     const addr = wallet.addresses[state.selectedAddress];
-    const wi = state.selectedWallet;
     const ai = state.selectedAddress;
     $("address-title").textContent =
         wallet.name + " \u2014 Address " + (ai + 1);
@@ -64,7 +63,7 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
-    const usdTotal = formatUsd(getAddressValueUsd(addr));
+    const usdTotal = formatAddressTotal(getAddressValue(addr));
     $("address-usd-total").innerHTML = usdTotal || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element
@@ -246,7 +245,6 @@ function renderTransactions(txs) {
         row.addEventListener("click", () => {
             const idx = parseInt(row.dataset.tx, 10);
             const tx = loadedTxs[idx];
-            const counterparty = tx.direction === "sent" ? tx.to : tx.from;
             tx.fromEns = ensNameMap.get(tx.from) || null;
             tx.toEns = ensNameMap.get(tx.to) || null;
             ctx.showTransactionDetail(tx);

src/popup/views/addressToken.js

@@ -16,13 +16,9 @@ const {
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, currentAddress, saveState } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
-const {
-    formatUsd,
-    getPrice,
-    getAddressValueUsd,
-} = require("../../shared/prices");
+const { formatUsd, getPrice } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,

src/popup/views/approval.js

@@ -9,7 +9,7 @@ const {
     attachCopyHandlers,
     onViewLeave,
 } = require("./helpers");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { networkByChainId } = require("../../shared/networks");
 const {
     formatEther,
@@ -537,7 +537,7 @@ function clearSignPassword() {
     hideError("approve-sign-error");
 }
 
-function init(ctx) {
+function init(_ctx) {
     onViewLeave("approve-tx", clearTxPassword);
     onViewLeave("approve-sign", clearSignPassword);
 

src/popup/views/confirmTx.js

@@ -2,20 +2,12 @@
 // Shows transaction details, warnings, errors. On Sign & Send,
 // reads inline password, decrypts secret, signs and broadcasts.
 
-const {
-    parseEther,
-    parseUnits,
-    formatEther,
-    formatUnits,
-    Contract,
-} = require("ethers");
+const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
 const {
     $,
     showError,
     hideError,
     showView,
-    showFlash,
-    flashCopyFeedback,
     addressTitle,
     escapeHtml,
     renderAddressHtml,
@@ -23,7 +15,7 @@ const {
     goBack,
     onViewLeave,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -399,7 +391,7 @@ function clearPassword() {
     hideError("confirm-tx-password-error");
 }
 
-function init(ctx) {
+function init(_ctx) {
     onViewLeave("confirm-tx", clearPassword);
 
     $("btn-confirm-send").addEventListener("click", async () => {
@@ -421,7 +413,7 @@ function init(ctx) {
                 wallet.encryptedSecret,
                 password,
             );
-        } catch (e) {
+        } catch {
             showError(
                 "confirm-tx-password-error",
                 "That password is incorrect. Please try again.",

src/popup/views/deleteAddress.js

@@ -17,7 +17,7 @@ const {
     addressHoldsFunds,
     balanceLinesForAddress,
 } = require("./helpers");
-const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
+const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { state, saveState } = require("../../shared/state");
 const {
@@ -84,16 +84,16 @@ function recoveryPathText(wallet) {
 // own: the rendered lines round to four decimals, so a sentence built from a
 // rounded number would report "0.0000 ETH" for an address holding real money.
 // The lines below it carry the amounts, in the same format as Home and
-// AddressDetail, followed by the USD total when prices are known (null on
-// testnet and before the first price fetch, where the line is left off rather
-// than printed as $0.00).
+// AddressDetail, followed by the USD total when there is one to give — no
+// total line at all on testnet or before the first price fetch, and no figure
+// when every holding here is one with no price, since "$0.00" directly under
+// "This address holds a balance." is a contradiction.
 function balanceWarningHtml(addr) {
     if (!addressHoldsFunds(addr)) return " ";
-    const usd = getAddressValueUsd(addr);
-    const total =
-        usd === null
-            ? ""
-            : `<div class="text-xs text-muted mt-1">Total: ${formatUsd(usd)}</div>`;
+    const line = formatAddressTotal(getAddressValue(addr));
+    const total = line
+        ? `<div class="text-xs text-muted mt-1">${line}</div>`
+        : "";
     return (
         `<p class="mb-1">This address holds a balance. Removing it does not ` +
         `move or spend anything; the balance stays at the address.</p>` +

src/popup/views/deleteWallet.js

@@ -73,7 +73,7 @@ function init(_ctx) {
         // Verify password against the wallet's encrypted data
         try {
             await decryptWithPassword(wallet.encryptedSecret, pw);
-        } catch (_e) {
+        } catch {
             $("delete-wallet-flash").textContent =
                 "That password is incorrect. Please try again.";
             $("delete-wallet-flash").style.visibility = "visible";

src/popup/views/helpers.js

@@ -1,11 +1,7 @@
 // Shared DOM helpers used by all views.
 
 const { isDebug } = require("../../shared/log");
-const {
-    formatUsd,
-    getPrice,
-    getAddressValueUsd,
-} = require("../../shared/prices");
+const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { markViewRendered } = require("../viewRouter");
 

src/popup/views/home.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     isoDate,
     timeAgo,
@@ -28,8 +27,9 @@ const {
 } = require("../../shared/walletDefects");
 const {
     formatUsd,
+    formatAddressTotal,
     getPrice,
-    getAddressValueUsd,
+    getAddressValue,
 } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -71,9 +71,7 @@ function renderTotalValue() {
     el.textContent = ethStr + ethUsd;
 
     if (subEl) {
-        const totalUsd = getAddressValueUsd(addr);
-        subEl.innerHTML =
-            totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
+        subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
     }
 }
 
@@ -257,8 +255,8 @@ function walletListHtml() {
             html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
             html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
             html += `</div>`;
-            const addrUsd = formatUsd(getAddressValueUsd(addr));
-            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || "&nbsp;"}</div>`;
+            const addrTotal = formatAddressTotal(getAddressValue(addr));
+            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || "&nbsp;"}</div>`;
             html += balanceLinesForAddress(
                 addr,
                 state.trackedTokens,

src/popup/views/receive.js

@@ -57,7 +57,7 @@ function show() {
     attachCopyHandlers("view-receive");
 }
 
-function init(ctx) {
+function init(_ctx) {
     $("btn-receive-copy").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {

src/popup/views/send.js

@@ -4,7 +4,6 @@ const {
     $,
     showFlash,
     addressTitle,
-    escapeHtml,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
@@ -210,7 +209,7 @@ function init(_ctx) {
                 }
                 resolvedTo = resolved;
                 ensName = to;
-            } catch (e) {
+            } catch {
                 showFlash("Failed to resolve ENS name.");
                 return;
             }

src/popup/views/settings.js

@@ -14,7 +14,6 @@ const {
     parseDustThresholdGwei,
 } = require("../dustThreshold");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");

src/popup/views/transactionDetail.js

@@ -23,8 +23,6 @@ const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
 const { decodeCalldata } = require("./approval");
 
-let ctx;
-
 /**
  * Determine a human-readable transaction type string from tx fields.
  */
@@ -166,7 +164,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
+    loadFullTxDetails(tx.hash, tx.to);
 
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
@@ -274,7 +272,7 @@ function populateOnChainDetails(txData) {
     }
 }
 
-async function loadFullTxDetails(txHash, toAddress, isContractCall) {
+async function loadFullTxDetails(txHash, toAddress) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -349,8 +347,9 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
     }
 }
 
+// The ctx this view is initialized with is unused: this module is the leaf of
+// the navigation, and the other views reach it through their own ctx.
 function init(_ctx) {
-    ctx = _ctx;
     $("btn-tx-back").addEventListener("click", () => {
         goBack();
     });

src/popup/views/txStatus.js

@@ -12,7 +12,7 @@ const {
     clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
@@ -229,10 +229,6 @@ function tokenLabel(address) {
     return t ? t.symbol : null;
 }
 
-function etherscanTokenLink(address) {
-    return `${currentNetwork().explorerUrl}/token/${address}`;
-}
-
 function decodedDetailsHtml(decoded) {
     if (!decoded || !decoded.details) return "";
     let html = `<div class="border border-border border-dashed p-2 mb-3">`;

src/shared/approvalVerify.js

@@ -602,6 +602,12 @@ const TX_STAGE_BROADCAST = "broadcast";
 // may yet succeed, so the one thing the popup must not say is "start again
 // from the site".
 const TX_STAGE_INFLIGHT = "inflight";
+// A transaction refused for a nonce that is already spoken for, either by the
+// node's own answer or by this wallet's record of what it has broadcast. It is
+// the one broadcast-stage failure that is not ambiguous: the transaction was
+// not taken, so the user is told it did not reach the network and to send it
+// again, rather than being warned that it might already be out there.
+const TX_STAGE_NONCE = "nonce";
 
 function errorText(err) {
     if (typeof err === "string" && err !== "") return err;
@@ -611,6 +617,59 @@ function errorText(err) {
     return "The transaction could not be sent.";
 }
 
+// Every string a failure might carry its reason in. ethers reports the node's
+// own words in `shortMessage`, but a JSON-RPC error it could not classify is
+// nested under `error` or `info.error` with the node's message intact, and the
+// classification below has to see that too.
+function failureTexts(err) {
+    if (typeof err === "string") return [err];
+    if (!err || typeof err !== "object") return [];
+    const texts = [];
+    for (const text of [err.shortMessage, err.message, err.reason]) {
+        if (text) texts.push(String(text));
+    }
+    const nested = err.error || (err.info && err.info.error);
+    if (nested && nested.message) texts.push(String(nested.message));
+    return texts;
+}
+
+// What the Ethereum clients say when a transaction's nonce is already spoken
+// for: either it is below the account's next nonce, or another transaction is
+// sitting in the pool at that nonce and this one did not outbid it. Either way
+// the node answered, and its answer was that it did not take this transaction.
+//
+// "already known" is deliberately absent. A node that says it knows the
+// transaction has it, so that transaction did reach the network and the
+// ambiguous broadcast wording is the correct one for it.
+const NONCE_COLLISION_PATTERNS = [
+    /nonce too low/i,
+    /nonce has already been used/i,
+    /invalid nonce/i,
+    /oldnonce/i,
+    /replacement transaction underpriced/i,
+    /replacement fee too low/i,
+];
+
+// ethers' own classification of the same two conditions.
+const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
+
+// Whether a failed send is a nonce collision.
+function isNonceCollision(err) {
+    if (!err) return false;
+    if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
+    return failureTexts(err).some((text) =>
+        NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
+    );
+}
+
+// What both the requesting page and the popup are told about a nonce
+// collision. The node's own words ("nonce too low") are a fragment and are
+// replaced rather than passed through: they are not a sentence, and they say
+// less than the wallet knows.
+const NONCE_COLLISION_MESSAGE =
+    "The transaction was not sent, because its nonce had already been used" +
+    " by another transaction.";
+
 // What the background does with a pending transaction approval after a failed
 // attempt: what it tells the popup, and whether the approval is spent
 // (resolved to the requesting page as an error and deleted) or left standing
@@ -627,12 +686,31 @@ function errorText(err) {
 //    that never left from one that is already in the mempool. The approval is
 //    spent and the requesting page has been given its outcome; a second
 //    attempt against it would report a second outcome for one request.
+//  - nonce: terminal too, and the one case where the wallet does know the
+//    transaction never left. The approval carries a nonce that is spent, so
+//    the artifact signed against it can never be accepted and the user is told
+//    to send it again from the site.
+//
+// The stage comes back out because a broadcast failure the node blamed on the
+// nonce is reclassified here; the caller reports the stage this returns rather
+// than the one it passed in.
 function describeTxFailure(stage, err) {
+    if (
+        stage === TX_STAGE_NONCE ||
+        (stage === TX_STAGE_BROADCAST && isNonceCollision(err))
+    ) {
+        return {
+            error: NONCE_COLLISION_MESSAGE,
+            retryable: false,
+            spendApproval: true,
+            stage: TX_STAGE_NONCE,
+        };
+    }
     const error = errorText(err);
     const retryable =
         stage === TX_STAGE_SIGN ||
         (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
-    return { error, retryable, spendApproval: !retryable };
+    return { error, retryable, spendApproval: !retryable, stage };
 }
 
 // What the popup shows and does after the background reports a failed signing
@@ -642,14 +720,20 @@ function describeTxFailure(stage, err) {
 //
 // A failed broadcast gets its own wording: the transaction may already be on
 // the network, so telling the user to start again from the site is exactly the
-// wrong instruction.
+// wrong instruction. A nonce collision is the exception to that exception —
+// the transaction demonstrably did not go out, and saying it might have would
+// send the user hunting for a transaction that does not exist.
 function describeSigningFailure(response, fallbackMessage) {
     let message = (response && response.error) || fallbackMessage;
     if (!/[.!?]$/.test(message)) message += ".";
     const retryable = !!(response && response.retryable);
     const stage = response && response.stage;
     if (!retryable) {
-        if (stage === TX_STAGE_BROADCAST) {
+        if (stage === TX_STAGE_NONCE) {
+            message +=
+                " The transaction did not reach the network." +
+                " Please send it again from the site.";
+        } else if (stage === TX_STAGE_BROADCAST) {
             message +=
                 " The transaction may still have reached the network." +
                 " Check the account before sending it again.";
@@ -675,9 +759,11 @@ module.exports = {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
+    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
     ApprovalMismatchError,
+    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -686,6 +772,7 @@ module.exports = {
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
     TX_STAGE_INFLIGHT,
+    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 };

src/shared/prices.js

@@ -21,7 +21,7 @@ async function refreshPrices() {
         const fetched = await getTopTokenPrices(25);
         Object.assign(prices, fetched);
         lastFetchedAt = now;
-    } catch (e) {
+    } catch {
         // prices stay stale on error
     }
 }
@@ -55,42 +55,77 @@ function formatUsd(amount) {
     );
 }
 
-function getAddressValueUsd(addr) {
+// What an address is worth, as { usd, partial }.
+//
+// Prices are fetched for the top 25 tokens only, so an address can hold real
+// assets this code has no price for. Adding up the priced ones and calling the
+// result the total states a number the holdings do not support: an address
+// holding nothing but unpriced tokens comes out at $0.00, which tells the user
+// their address is worth nothing when it may hold a great deal. Worth zero and
+// worth an unknown amount are separate facts and get separate fields, the same
+// way an absent holders_count is not a count of zero.
+//
+//   usd:     the value of the holdings a price is known for, or null when
+//            nothing is knowable at all — testnet, or before the first fetch.
+//   partial: the address also holds a token with no price, so usd is a floor
+//            and not the total.
+//
+// Render it through formatAddressTotal() rather than reading usd alone.
+function getAddressValue(addr) {
     const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    const ethBal = parseFloat(addr.balance || "0");
-    total += ethBal * prices.ETH;
+    if (currentNetwork().isTestnet) return { usd: null, partial: false };
+    if (!prices.ETH) return { usd: null, partial: false };
+    let usd = parseFloat(addr.balance || "0") * prices.ETH;
+    let partial = false;
     for (const token of addr.tokenBalances || []) {
         const tokenBal = parseFloat(token.balance || "0");
-        if (tokenBal > 0 && prices[token.symbol]) {
-            total += tokenBal * prices[token.symbol];
+        // A balance of zero is not a holding: it can neither add to the total
+        // nor make it incomplete.
+        if (!(tokenBal > 0)) continue;
+        if (prices[token.symbol]) {
+            usd += tokenBal * prices[token.symbol];
+        } else {
+            partial = true;
         }
     }
-    return total;
+    return { usd, partial };
 }
 
-function getWalletValueUsd(wallet) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    for (const addr of wallet.addresses) {
-        total += getAddressValueUsd(addr);
-    }
-    return total;
+// The same pair for a whole wallet, and for every wallet at once. One
+// unpriced holding anywhere makes the sum a floor, so partial carries up.
+function getWalletValue(wallet) {
+    return sumValues(wallet.addresses.map(getAddressValue));
 }
 
-function getTotalValueUsd(wallets) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
-    if (!prices.ETH) return null;
-    let total = 0;
-    for (const wallet of wallets) {
-        total += getWalletValueUsd(wallet);
+function getTotalValue(wallets) {
+    return sumValues(wallets.map(getWalletValue));
+}
+
+function sumValues(values) {
+    let usd = null;
+    let partial = false;
+    for (const value of values) {
+        if (value.usd === null) continue;
+        usd = (usd === null ? 0 : usd) + value.usd;
+        partial = partial || value.partial;
     }
-    return total;
+    return { usd, partial };
+}
+
+// The one rendering of an address total, so no screen says it differently.
+//
+// A partial total is shown and named as partial: the figure is the ETH and
+// priced tokens the user does hold, which is worth having, and suppressing it
+// would throw away a number that is correct as far as it goes. What is never
+// shown is a figure covering no holdings at all — the $0.00 sum of an empty
+// set beside a list of tokens is the bug this replaces.
+function formatAddressTotal(value) {
+    if (!value || value.usd === null) return "";
+    if (!value.partial) return "Total: " + formatUsd(value.usd);
+    if (value.usd > 0) {
+        return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
+    }
+    return "Total: unpriced tokens only";
 }
 
 module.exports = {
@@ -99,7 +134,8 @@ module.exports = {
     clearPrices,
     getPrice,
     formatUsd,
-    getAddressValueUsd,
-    getWalletValueUsd,
-    getTotalValueUsd,
+    formatAddressTotal,
+    getAddressValue,
+    getWalletValue,
+    getTotalValue,
 };

src/shared/txValidation.js

@@ -82,7 +82,7 @@ function toFixedPoint(value) {
     if (text === "") return null;
     try {
         return parseUnits(text, SCALE_DECIMALS);
-    } catch (e) {
+    } catch {
         return null;
     }
 }

src/shared/uniswap.js

@@ -102,6 +102,11 @@ function decodeV2SwapExactIn(input) {
 // Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
 // ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
 //        address[] path, bool payerIsUser)
+//
+// Nothing calls this: decode() has no 0x09 arm, so a V2 exact-out swap gets
+// its command name and no token or amount detail. Kept for the fix, which is
+// https://git.eeqj.de/sneak/AutistMask/issues/283.
+// eslint-disable-next-line no-unused-vars
 function decodeV2SwapExactOut(input) {
     try {
         const d = coder.decode(

src/shared/vault.js

@@ -57,7 +57,7 @@ async function cryptoBackend() {
     try {
         await WebAssembly.compile(EMPTY_WASM_MODULE);
         return "wasm";
-    } catch (_) {
+    } catch {
         return "asmjs";
     }
 }

tests/addressValue.test.js

@@ -0,0 +1,238 @@
+// The USD total of an address that holds something this build cannot price
+// (issue #261).
+//
+// Prices exist for the top 25 tokens only, so an address can hold real assets
+// with no price attached. Summing what is priced and printing the result as
+// the total says "$0.00" for an address holding nothing but unpriced tokens —
+// worth-nothing and worth-an-unknown-amount collapsed into one number, in the
+// direction that matters. The two are separate facts here, the same way an
+// absent holders_count is not a count of zero.
+//
+// The value and its rendering are asserted directly, and then through the two
+// call sites that return their markup as a string: the wallet list on Home and
+// the balance warning on the address-removal confirmation. AddressDetail and
+// the Home summary line render into the DOM and are covered by tests/e2e.
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const {
+    prices,
+    clearPrices,
+    getAddressValue,
+    getWalletValue,
+    getTotalValue,
+    formatAddressTotal,
+} = require("../src/shared/prices");
+const { state } = require("../src/shared/state");
+const { walletListHtml } = require("../src/popup/views/home");
+const { balanceWarningHtml } = require("../src/popup/views/deleteAddress");
+
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+const NOVEL = "0x1111111111111111111111111111111111111111";
+
+// No ETH, and a token no price is known for. The case the user is told is
+// worth $0.00 today.
+const UNPRICED_ONLY = {
+    address: "0x" + "a".repeat(40),
+    balance: "0",
+    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
+};
+
+// Nothing at all: the address really is worth zero.
+const EMPTY = {
+    address: "0x" + "b".repeat(40),
+    balance: "0",
+    tokenBalances: [],
+};
+
+// Every holding priced.
+const FULLY_PRICED = {
+    address: "0x" + "c".repeat(40),
+    balance: "1.5",
+    tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
+};
+
+// Part priced, part not: 1.5 ETH plus a token with no price.
+const PARTLY_PRICED = {
+    address: "0x" + "d".repeat(40),
+    balance: "1.5",
+    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
+};
+
+beforeEach(() => {
+    clearPrices();
+    prices.ETH = 2000;
+    prices.USDC = 1;
+    state.wallets = [];
+    state.trackedTokens = [];
+    state.showZeroBalanceTokens = false;
+    state.activeAddress = null;
+});
+
+afterEach(() => {
+    clearPrices();
+});
+
+// The total line only, in each of the two markup-returning call sites. The
+// ETH balance line above it legitimately reads $0.00 for an address with no
+// ETH, so the assertions have to name the line under test.
+function walletListTotal(addr) {
+    state.wallets = [{ name: "Wallet 1", type: "hd", addresses: [addr] }];
+    const match = walletListHtml().match(/min-h-\[1rem\]">([^<]*)</);
+    return match && match[1];
+}
+
+function removalWarningTotal(addr) {
+    const match = balanceWarningHtml(addr).match(/mt-1">([^<]*)</);
+    return match && match[1];
+}
+
+describe("the value of an address, and whether it is the whole value", () => {
+    test("an address holding only unpriced tokens has an incomplete value", () => {
+        expect(getAddressValue(UNPRICED_ONLY)).toEqual({
+            usd: 0,
+            partial: true,
+        });
+    });
+
+    test("an address holding nothing is complete, and zero", () => {
+        expect(getAddressValue(EMPTY)).toEqual({ usd: 0, partial: false });
+    });
+
+    test("a fully priced address is complete, and unchanged", () => {
+        expect(getAddressValue(FULLY_PRICED)).toEqual({
+            usd: 5500,
+            partial: false,
+        });
+    });
+
+    test("a partly priced address keeps the part it can price", () => {
+        expect(getAddressValue(PARTLY_PRICED)).toEqual({
+            usd: 3000,
+            partial: true,
+        });
+    });
+
+    // A token balance of zero is not a holding, so it cannot make the total
+    // incomplete: an address with a spent-out unpriced token is worth zero.
+    test("a zero balance in an unpriced token leaves the value complete", () => {
+        const addr = {
+            address: "0x1",
+            balance: "0",
+            tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "0" }],
+        };
+        expect(getAddressValue(addr)).toEqual({ usd: 0, partial: false });
+    });
+
+    // Before the first price fetch, and on testnet, nothing is knowable: that
+    // is a third state, and it stays distinct from both of the others.
+    test("no prices at all means no value, not an incomplete one", () => {
+        clearPrices();
+        expect(getAddressValue(FULLY_PRICED)).toEqual({
+            usd: null,
+            partial: false,
+        });
+    });
+
+    test("one unpriced holding makes a wallet and the grand total partial", () => {
+        const wallet = { addresses: [FULLY_PRICED, UNPRICED_ONLY] };
+        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: true });
+        expect(getTotalValue([wallet])).toEqual({ usd: 5500, partial: true });
+    });
+
+    test("a wallet of fully priced addresses stays complete", () => {
+        const wallet = { addresses: [FULLY_PRICED, EMPTY] };
+        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: false });
+    });
+});
+
+describe("how that value is written on screen", () => {
+    test("a complete total is the figure", () => {
+        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe(
+            "Total: $5,500.00",
+        );
+    });
+
+    test("an address worth zero says so", () => {
+        expect(formatAddressTotal(getAddressValue(EMPTY))).toBe("Total: $0.00");
+    });
+
+    // The figure is still worth having — it is the ETH the user does hold —
+    // but on its own it understates the address, so it is named as partial.
+    test("a partly priced total is given, and marked as partial", () => {
+        expect(formatAddressTotal(getAddressValue(PARTLY_PRICED))).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    // Nothing priced is held, so there is no figure to give: printing the
+    // $0.00 sum of an empty set is the bug.
+    test("a total with nothing priced in it gives no figure", () => {
+        const line = formatAddressTotal(getAddressValue(UNPRICED_ONLY));
+        expect(line).toBe("Total: unpriced tokens only");
+        expect(line).not.toContain("$");
+    });
+
+    test("an unknown value is written as nothing at all", () => {
+        clearPrices();
+        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe("");
+    });
+});
+
+describe("the wallet list on Home", () => {
+    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
+        expect(walletListTotal(UNPRICED_ONLY)).toBe(
+            "Total: unpriced tokens only",
+        );
+    });
+
+    test("an address holding nothing is still totalled at $0.00", () => {
+        expect(walletListTotal(EMPTY)).toBe("Total: $0.00");
+    });
+
+    test("a fully priced address shows its total", () => {
+        expect(walletListTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
+    });
+
+    test("a partly priced address shows the priced part, marked partial", () => {
+        expect(walletListTotal(PARTLY_PRICED)).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    test("an address whose value is unknown keeps its blank line", () => {
+        clearPrices();
+        expect(walletListTotal(FULLY_PRICED)).toBe("&nbsp;");
+    });
+});
+
+describe("the balance warning on the address-removal confirmation", () => {
+    // "This address holds a balance." followed by "Total: $0.00" is a flat
+    // contradiction, on the one screen whose job is to warn.
+    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
+        expect(balanceWarningHtml(UNPRICED_ONLY)).toContain(
+            "This address holds a balance.",
+        );
+        expect(removalWarningTotal(UNPRICED_ONLY)).toBe(
+            "Total: unpriced tokens only",
+        );
+    });
+
+    test("a fully priced address still shows its total", () => {
+        expect(removalWarningTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
+    });
+
+    test("a partly priced address shows the priced part, marked partial", () => {
+        expect(removalWarningTotal(PARTLY_PRICED)).toBe(
+            "Total: $3,000.00 plus unpriced tokens",
+        );
+    });
+
+    test("no total line is written when the value is unknown", () => {
+        clearPrices();
+        expect(removalWarningTotal(FULLY_PRICED)).toBe(null);
+    });
+});

tests/approvalVerify.test.js

@@ -14,8 +14,10 @@ const {
     assertWithinCeilings,
     sameAddress,
     failureIsRetryable,
+    isNonceCollision,
     describeTxFailure,
     describeSigningFailure,
+    NONCE_COLLISION_MESSAGE,
     ALLOWED_TX_TYPES,
     SERIALIZED_FIELDS,
     FORBIDDEN_FIELDS,
@@ -23,6 +25,7 @@ const {
     TX_STAGE_SIGN,
     TX_STAGE_VERIFY,
     TX_STAGE_BROADCAST,
+    TX_STAGE_NONCE,
     MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
 } = require("../src/shared/approvalVerify");
@@ -1191,7 +1194,6 @@ describe("signing failure and retry", () => {
             "already known",
             "timeout of 30000ms exceeded",
             "could not coalesce error",
-            "replacement transaction underpriced",
         ]) {
             const outcome = describeTxFailure(
                 TX_STAGE_BROADCAST,
@@ -1199,10 +1201,76 @@ describe("signing failure and retry", () => {
             );
             expect(outcome.retryable).toBe(false);
             expect(outcome.spendApproval).toBe(true);
+            expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
             expect(outcome.error).toBe(message);
         }
     });
 
+    // The one broadcast failure that is not ambiguous. The node answered, and
+    // its answer was that the nonce was already spoken for, so this
+    // transaction is not in a mempool anywhere.
+    test("a nonce the node refused is classified however it was worded", () => {
+        for (const err of [
+            new Error("nonce too low"),
+            new Error("replacement transaction underpriced"),
+            Object.assign(new Error("could not coalesce error"), {
+                code: "NONCE_EXPIRED",
+            }),
+            Object.assign(new Error("could not coalesce error"), {
+                code: "REPLACEMENT_UNDERPRICED",
+            }),
+            // The shape ethers hands up when it could not classify the node's
+            // error itself: the node's own words are nested underneath.
+            Object.assign(new Error("could not coalesce error"), {
+                info: { error: { code: -32000, message: "OldNonce" } },
+            }),
+        ]) {
+            const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
+            expect(
+                describeSigningFailure(
+                    outcome,
+                    "The transaction could not be sent.",
+                ).message,
+            ).toMatch(/did not reach the network/);
+            expect(outcome.retryable).toBe(false);
+            expect(outcome.spendApproval).toBe(true);
+            expect(outcome.error).toBe(NONCE_COLLISION_MESSAGE);
+            expect(outcome.stage).toBe(TX_STAGE_NONCE);
+            expect(isNonceCollision(err)).toBe(true);
+        }
+    });
+
+    // A node that says it knows the transaction has it, so it did reach the
+    // network and the ambiguous wording is the correct one.
+    test("already known is not a nonce collision", () => {
+        const err = new Error("already known");
+        const outcome = describeTxFailure(TX_STAGE_BROADCAST, err);
+        expect(
+            describeSigningFailure(
+                outcome,
+                "The transaction could not be sent.",
+            ).message,
+        ).toMatch(/may still have reached the network/);
+        expect(outcome.stage).toBe(TX_STAGE_BROADCAST);
+        expect(isNonceCollision(err)).toBe(false);
+    });
+
+    test("a nonce collision says the transaction did not reach the network", () => {
+        const outcome = describeTxFailure(
+            TX_STAGE_BROADCAST,
+            new Error("nonce too low"),
+        );
+        const copy = describeSigningFailure(
+            outcome,
+            "The transaction could not be sent.",
+        );
+        expect(copy.retryable).toBe(false);
+        expect(copy.message).toMatch(/did not reach the network/);
+        expect(copy.message).not.toMatch(/may still have reached the network/);
+        expect(copy.message).toMatch(/Please send it again from the site\.$/);
+        expect(copy.message).toMatch(/^[A-Z].*\.$/);
+    });
+
     test("a failed broadcast does not tell the user to send it again", () => {
         const outcome = describeSigningFailure(
             {

tests/backgroundApproval.test.js

@@ -30,6 +30,8 @@ const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 
 const ORIGIN = "https://dapp.example";
 const HOSTNAME = "dapp.example";
+// A page the wallet has never been connected to, whose requests are refused.
+const UNCONNECTED_ORIGIN = "https://stranger.example";
 const EXT_URL = "chrome-extension://autistmask/";
 
 // What the dApp asks for: no nonce, no gas, no fees. This is the shape that
@@ -51,10 +53,16 @@ const MESSAGE = "0x48656c6c6f204175746973744d61736b";
 // The transaction the background populates and the approval screen displays.
 // The nonce is a parameter because the duplicate case turns on two artifacts
 // differing in a field the dApp fixed nothing for.
-function populated(nonce) {
+// The two chains the tests switch between, as both forms the code uses: the
+// hex chain id the wallet's network record carries, and the number the node
+// and the signed artifact carry.
+const MAINNET = { hex: "0x1", num: 1 };
+const SEPOLIA = { hex: "0xaa36a7", num: 11155111 };
+
+function populated(nonce, chainId) {
     return {
         type: 2,
-        chainId: 1,
+        chainId: chainId || MAINNET.num,
         nonce,
         gasLimit: 100000n,
         maxFeePerGas: 2000000000n,
@@ -65,17 +73,17 @@ function populated(nonce) {
     };
 }
 
-function signedAtNonce(nonce, withWallet) {
-    return (withWallet || signer).signTransaction(populated(nonce));
+function signedAtNonce(nonce, withWallet, chainId) {
+    return (withWallet || signer).signTransaction(populated(nonce, chainId));
 }
 
 // The node the background populates against. Its answers are the numbers the
 // approval screen shows, so they are also the numbers every artifact below is
 // signed at.
-function fakeProvider(broadcastTransaction, overrides) {
+function fakeProvider(broadcastTransaction, overrides, chainId) {
     return {
         broadcastTransaction,
-        getNetwork: async () => Network.from(1),
+        getNetwork: async () => Network.from(chainId || MAINNET.num),
         getTransactionCount: async () => NONCE,
         estimateGas: async () => 100000n,
         getFeeData: async () => ({
@@ -111,14 +119,20 @@ function loadBackground(options) {
     const broadcastTransaction = jest.fn();
     const loadState = jest.fn(opts.loadState || (async () => {}));
 
+    // The network the wallet is on, which the tests switch under a pending
+    // approval. The node the transaction is populated against is on the same
+    // one, as it would be: switching networks switches the RPC endpoint too.
+    let chain = MAINNET;
+
     jest.doMock("../src/shared/state", () => ({
         state: { rpcUrl: "https://rpc.invalid", wallets: [] },
         loadState,
         saveState: jest.fn(async () => {}),
-        currentNetwork: () => ({ chainId: "0x1" }),
+        currentNetwork: () => ({ chainId: chain.hex }),
     }));
     jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => fakeProvider(broadcastTransaction, opts.provider),
+        getProvider: () =>
+            fakeProvider(broadcastTransaction, opts.provider, chain.num),
         refreshBalances: jest.fn(async () => {}),
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
@@ -170,7 +184,9 @@ function loadBackground(options) {
             getLastFocused: (cb) => cb(null),
             create: (options2, cb) => {
                 created.push(options2);
-                cb({ id: created.length });
+                // A browser that answers with no window at all. The approval
+                // then has no window it can ever be answered in.
+                cb(opts.noWindow ? undefined : { id: created.length });
             },
             remove: (id, cb) => {
                 removed.push(id);
@@ -204,8 +220,12 @@ function loadBackground(options) {
 
     // Raise a pending transaction approval the way a dApp does, and dig the
     // approval id back out of the popup URL the background opened.
-    function requestTx(txParams) {
+    function requestTx(txParams, origin) {
         let rpcResult = null;
+        // The window this request opens, if it opens one. A request refused
+        // before an approval is raised opens none, and the window belonging to
+        // some other request must not be handed back as this one's.
+        const windowIndex = created.length;
         const sendResponse = jest.fn((r) => {
             rpcResult = r;
         });
@@ -215,11 +235,16 @@ function loadBackground(options) {
                 method: "eth_sendTransaction",
                 params: [txParams || TX_PARAMS],
             },
-            { origin: ORIGIN },
+            { origin: origin || ORIGIN },
             sendResponse,
         );
         return {
-            id: () => new URL(created[0].url).searchParams.get("approval"),
+            id: () =>
+                created.length > windowIndex
+                    ? new URL(created[windowIndex].url).searchParams.get(
+                          "approval",
+                      )
+                    : null,
             result: () => rpcResult,
         };
     }
@@ -269,6 +294,10 @@ function loadBackground(options) {
         setActiveAddress: (address) => {
             persisted.activeAddress = address;
         },
+        // The user switching network in the toolbar popup.
+        setNetwork: (network) => {
+            chain = network;
+        },
         fromPopup: { url: EXT_URL + "src/popup/index.html" },
     };
 }
@@ -444,6 +473,318 @@ describe("one approval, one broadcast", () => {
     });
 });
 
+// Populating the transaction before the approval window opens is what makes
+// the displayed object the verified object. It also fixes the nonce before the
+// user has answered anything: two requests populated concurrently take the
+// same nonce from a node that has seen neither of them broadcast, and the
+// second can then never be sent, because the only way to give it a fresh nonce
+// is to populate it again after the user has read the old one off the screen.
+// So the second request is refused while the first is unanswered.
+describe("one transaction approval at a time", () => {
+    test("a second eth_sendTransaction while one is pending is refused before it takes a nonce", async () => {
+        const getTransactionCount = jest.fn(async () => NONCE);
+        const bg = loadBackground({ provider: { getTransactionCount } });
+
+        const first = bg.requestTx();
+        await settle();
+        expect(first.id()).toBeTruthy();
+        expect(getTransactionCount).toHaveBeenCalledTimes(1);
+
+        const second = bg.requestTx();
+        await settle();
+
+        expect(second.result()).toEqual({
+            error: {
+                code: -32002,
+                message: expect.stringMatching(
+                    /one transaction at a time.+already in progress/,
+                ),
+            },
+        });
+        // Where the refusal happened matters as much as that it happened: no
+        // second window, and the node was never asked for a second nonce.
+        expect(bg.created).toHaveLength(1);
+        expect(getTransactionCount).toHaveBeenCalledTimes(1);
+
+        // The refusal leaves the pending approval untouched, and it still
+        // sends.
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+    });
+
+    // The slot is only defensible if the wallet was going to raise an approval
+    // anyway. Taken any earlier, a request the wallet refuses outright still
+    // holds it, and any page at all — connected or not — can deny the user's
+    // own transactions for as long as it keeps asking.
+    test("a request the wallet refuses does not take the slot from the connected site", async () => {
+        const bg = loadBackground();
+
+        // Both delivered before either reaches its first suspension point,
+        // which is the interleaving the slot exists for.
+        const stranger = bg.requestTx(TX_PARAMS, UNCONNECTED_ORIGIN);
+        const connected = bg.requestTx();
+        await settle();
+
+        expect(stranger.result()).toEqual({
+            error: { code: 4100, message: "Unauthorized" },
+        });
+        // The connected site's transaction was raised, not refused as one the
+        // user already has in progress.
+        expect(connected.result()).toBeNull();
+        expect(connected.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(1);
+    });
+
+    // The user closes an approval window that looks hung while the attempt
+    // behind it is still running, and that attempt then fails in a way that
+    // would normally leave the approval standing for a retry. There is no
+    // window left to retry in, so leaving it standing answers the requesting
+    // page never — and holds the slot for the life of the worker with it.
+    test("an approval whose window closed under a failed attempt is answered, and frees the next request", async () => {
+        const stalled = deferred();
+        const bg = loadBackground({
+            loadState: async () => {
+                await stalled.promise;
+                throw new Error("The wallet data could not be read.");
+            },
+        });
+
+        const first = bg.requestTx();
+        await settle();
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        // The attempt owns the approval, so closing the window does not settle
+        // it: the attempt may yet broadcast, and it is the one that reports.
+        bg.closeWindow(1);
+        await settle();
+        expect(first.result()).toBeNull();
+
+        stalled.resolve();
+        await settle();
+        expect(first.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+
+        const second = bg.requestTx();
+        await settle();
+        expect(second.result()).toBeNull();
+        expect(second.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    // An approval with no window is one nothing can ever answer.
+    test("a request whose approval window cannot be opened is answered rather than left waiting", async () => {
+        const bg = loadBackground({ noWindow: true });
+
+        const first = bg.requestTx();
+        await settle();
+        expect(first.result()).toEqual({
+            error: {
+                code: -32603,
+                message: expect.stringMatching(
+                    /could not open its approval window/,
+                ),
+            },
+        });
+
+        // And it did not take the slot with it.
+        const second = bg.requestTx();
+        await settle();
+        expect(second.result()).toEqual({
+            error: {
+                code: -32603,
+                message: expect.stringMatching(
+                    /could not open its approval window/,
+                ),
+            },
+        });
+    });
+
+    test("an answered approval frees the next request", async () => {
+        const bg = loadBackground();
+        const first = bg.requestTx();
+        await settle();
+
+        // The user closes the approval window, which rejects it.
+        bg.closeWindow(1);
+        await settle();
+        expect(first.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+
+        const second = bg.requestTx();
+        await settle();
+        expect(second.id()).toBeTruthy();
+        expect(bg.created).toHaveLength(2);
+    });
+
+    test("a signature request is not held up by a pending transaction", async () => {
+        const bg = loadBackground();
+        bg.requestTx();
+        await settle();
+
+        // A signature consumes no nonce, so it has nothing to collide with.
+        const signing = bg.requestSign();
+        await settle();
+        expect(signing.id()).toBeTruthy();
+        expect(signing.result()).toBeNull();
+        expect(bg.created).toHaveLength(2);
+    });
+});
+
+// A nonce collision found before the transaction reaches the network is the
+// one send failure the wallet can speak about with certainty. The user is told
+// it did not go out and to send it again, rather than being warned it might
+// already be on the chain — which would send them looking for a transaction
+// that does not exist, and stop them retrying the one that never went.
+describe("a nonce collision is reported as a transaction that did not go out", () => {
+    test("a broadcast the node refused for the nonce is not reported as possibly sent", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.broadcastTransaction.mockRejectedValue(
+            Object.assign(new Error("nonce too low"), {
+                code: "NONCE_EXPIRED",
+            }),
+        );
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: pending.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: expect.stringMatching(/nonce had already been used/),
+            retryable: false,
+            stage: "nonce",
+        });
+        expect(pending.result()).toEqual({
+            error: {
+                message: expect.stringMatching(
+                    /transaction was not sent, because its nonce/,
+                ),
+            },
+        });
+    });
+
+    test("a nonce this wallet already broadcast is refused without asking the node again", async () => {
+        const bg = loadBackground();
+        const first = bg.requestTx();
+        await settle();
+
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+
+        // The stubbed node still reports NONCE as the next nonce — a pending
+        // count that lags a broadcast the node has already taken — so this
+        // second approval is populated at a nonce this worker has spent.
+        const second = bg.requestTx();
+        await settle();
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: second.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: expect.stringMatching(/nonce had already been used/),
+            retryable: false,
+            stage: "nonce",
+        });
+        expect(second.result()).toEqual({
+            error: {
+                message: expect.stringMatching(/nonce had already been used/),
+            },
+        });
+    });
+
+    // Nonce spaces are per chain, and the wallet switches networks. A nonce
+    // this wallet spent on one chain says nothing about the same nonce on
+    // another — and low nonces overlap across chains as a matter of course, so
+    // a record that ignored the chain would refuse ordinary transactions,
+    // permanently and with a message that is not true of them.
+    test("a nonce spent on one chain is not refused on another", async () => {
+        const bg = loadBackground();
+
+        const first = bg.requestTx();
+        await settle();
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: first.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.result()).toEqual({ result: "0xfeed" });
+
+        // The user switches network. On this chain the address has sent
+        // nothing, so the node populates the next transaction at the same
+        // nonce — correctly.
+        bg.setNetwork(SEPOLIA);
+        const second = bg.requestTx();
+        await settle();
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xbeef" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id: second.id(),
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE, undefined, SEPOLIA.num),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(2);
+        expect(second.result()).toEqual({ result: "0xbeef" });
+    });
+});
+
 // The approval carries the transaction the user was shown and the address it
 // was raised for, and the artifact is checked against both. Every case here is
 // one the old comparison — against the dApp's request, for the address that is

tests/deleteAddress.test.js

@@ -150,7 +150,7 @@ describe("the balance warning on the removal confirmation", () => {
         expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
     });
 
-    // getAddressValueUsd() returns null on testnet and before the first
+    // getAddressValue() reports no value on testnet and before the first
     // price fetch. A "Total: $0.00" there would be a lie about the holdings.
     test("no USD total is shown when prices are not known", () => {
         expect(balanceWarningHtml(TOKEN_ONLY)).not.toContain("Total:");

tests/e2e/Dockerfile

@@ -0,0 +1,34 @@
+# Chrome end-to-end image: the pinned Playwright image with this repo and a
+# freshly built extension inside it, built by script/test-e2e. The suite is
+# still started with `docker run`, so every runtime flag the harness needs
+# (--ipc=host in particular) applies as before.
+#
+# The repo is baked in rather than bind-mounted because a bind mount does
+# not resolve under Gitea Actions: the runner runs the job in a container
+# against the HOST's docker socket, so the source side of a -v is resolved
+# by the host daemon while the job's checkout lives on a docker volume that
+# is not a host path -- the mount silently succeeds and /work is empty. A
+# build context is streamed to the daemon and so works from anywhere.
+# Building the extension here too means the machine starting a run needs
+# docker and nothing else.
+
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
+
+WORKDIR /work
+
+# Same layering as the root Dockerfile: script/bootstrap installs the
+# prerequisites and the dependencies, and the manifests are copied first so
+# that layer is cached until they change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN make build

tests/e2e/firefox/Dockerfile

@@ -1,10 +1,24 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
-# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
-# harness itself has no dependencies, so nothing is installed for it.
+# with this repo and a freshly built extension inside it, built by
+# script/test-e2e-firefox. The harness itself has no dependencies, so
+# nothing is installed for it.
 #
-# All three external artifacts are pinned by digest. The Firefox version in
-# particular must not float: -remote-allow-system-access is mandatory on 153
-# and was not on 142, so the flag the harness passes is version-coupled.
+# The build context is the repo root. The repo is baked in rather than
+# bind-mounted because a bind mount does not resolve under Gitea Actions:
+# the runner runs the job in a container against the HOST's docker socket,
+# so the source side of a -v is resolved by the host daemon while the job's
+# checkout lives on a docker volume that is not a host path -- the mount
+# silently succeeds and /work is empty. Baking the build in is also the
+# only way this suite can have both a built extension and the
+# `--network none` it runs under, since a container with no network cannot
+# install anything.
+#
+# All three external artifacts are pinned by digest, and are fetched in
+# layers above the repo copy, so editing the harness or any source file
+# re-runs only the two cheap layers at the bottom. The Firefox version in
+# particular must not float: -remote-allow-system-access is mandatory on
+# 153 and was not on 142, so the flag the harness passes is
+# version-coupled.
 
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
@@ -48,4 +62,16 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 
 WORKDIR /work
+
+# Same layering as the root Dockerfile: script/bootstrap installs the
+# prerequisites and the dependencies, and the manifests are copied first so
+# that layer is cached until they change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN make build
+
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]

tests/e2e/firefox/driver.js

@@ -88,7 +88,7 @@ class Driver {
         let parsed;
         try {
             parsed = JSON.parse(text);
-        } catch (_) {
+        } catch {
             throw new Error(
                 method + " " + path + ": non-JSON response: " + text,
             );
@@ -199,7 +199,9 @@ class Driver {
     // condition it was waiting on rather than "timed out".
     async waitFor(what, script, args = [], timeout = DEFAULT_WAIT_MS) {
         const deadline = Date.now() + timeout;
-        let last = null;
+        // Assigned on every path through the loop body before it is read, so
+        // there is no initializer to give it.
+        let last;
         for (;;) {
             try {
                 const v = await this.execute(script, args);
@@ -420,7 +422,7 @@ async function waitForDriverReady(base, timeoutMs) {
                 const body = await res.json();
                 if (body && body.value && body.value.ready !== false) return;
             }
-        } catch (_) {
+        } catch {
             // not listening yet
         }
         if (Date.now() >= deadline) {

tests/e2e/harness.js

@@ -287,7 +287,7 @@ async function pageCompilesWasm(page) {
         try {
             await WebAssembly.compile(new Uint8Array(bytes));
             return true;
-        } catch (_) {
+        } catch {
             return false;
         }
     }, EMPTY_WASM_MODULE);

tests/e2e/run.js

@@ -68,7 +68,11 @@ function withTimeout(promise, name) {
     const timeout = new Promise((_, reject) => {
         timer = setTimeout(
             () =>
-                reject(new Error("timed out after " + TEST_TIMEOUT_MS + "ms")),
+                reject(
+                    new Error(
+                        name + ": timed out after " + TEST_TIMEOUT_MS + "ms",
+                    ),
+                ),
             TEST_TIMEOUT_MS,
         );
     });

tests/uniswap.test.js

@@ -1,4 +1,4 @@
-const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
+const { AbiCoder, Interface, solidityPacked } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 
 const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";

yarn.lock

@@ -427,6 +427,90 @@
   resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz#0eaf705c941a218a43dba8e09f1df1d6cd2f1f17"
   integrity sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==
 
+"@eslint-community/eslint-utils@^4.8.0":
+  version "4.10.1"
+  resolved "https://registry.yarnpkg.com/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz#8911bd72b2c3640a543609e0400b8c4d2e7e7cb6"
+  integrity sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==
+  dependencies:
+    eslint-visitor-keys "^3.4.3"
+
+"@eslint-community/regexpp@^4.12.2":
+  version "4.12.2"
+  resolved "https://registry.yarnpkg.com/@eslint-community/regexpp/-/regexpp-4.12.2.tgz#bccdf615bcf7b6e8db830ec0b8d21c9a25de597b"
+  integrity sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==
+
+"@eslint/config-array@^0.23.5":
+  version "0.23.5"
+  resolved "https://registry.yarnpkg.com/@eslint/config-array/-/config-array-0.23.5.tgz#56e86d243049195d8acc0c06a1b3dfdc3fa3de95"
+  integrity sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==
+  dependencies:
+    "@eslint/object-schema" "^3.0.5"
+    debug "^4.3.1"
+    minimatch "^10.2.4"
+
+"@eslint/config-helpers@^0.7.0":
+  version "0.7.0"
+  resolved "https://registry.yarnpkg.com/@eslint/config-helpers/-/config-helpers-0.7.0.tgz#09ee4aa07b73f059ec2d4c74bf4b2ff02b322377"
+  integrity sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==
+  dependencies:
+    "@eslint/core" "^1.2.1"
+
+"@eslint/core@^1.2.1":
+  version "1.2.1"
+  resolved "https://registry.yarnpkg.com/@eslint/core/-/core-1.2.1.tgz#c1da7cd1b82fa8787f98b5629fb811848a1b63ce"
+  integrity sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==
+  dependencies:
+    "@types/json-schema" "^7.0.15"
+
+"@eslint/js@10.0.1":
+  version "10.0.1"
+  resolved "https://registry.yarnpkg.com/@eslint/js/-/js-10.0.1.tgz#1e8a876f50117af8ab67e47d5ad94d38d6622583"
+  integrity sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==
+
+"@eslint/object-schema@^3.0.5":
+  version "3.0.5"
+  resolved "https://registry.yarnpkg.com/@eslint/object-schema/-/object-schema-3.0.5.tgz#88e9bf4d11d2b19c082e78ebe7ce88724a5eb091"
+  integrity sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==
+
+"@eslint/plugin-kit@^0.7.2":
+  version "0.7.2"
+  resolved "https://registry.yarnpkg.com/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz#4b0962f3f2c7ce8bc98b3ecfe34525c09d2cb729"
+  integrity sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==
+  dependencies:
+    "@eslint/core" "^1.2.1"
+    levn "^0.4.1"
+
+"@humanfs/core@^0.19.2":
+  version "0.19.2"
+  resolved "https://registry.yarnpkg.com/@humanfs/core/-/core-0.19.2.tgz#a8272ca03b2acf492670222b2320b6c421bfde60"
+  integrity sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==
+  dependencies:
+    "@humanfs/types" "^0.15.0"
+
+"@humanfs/node@^0.16.6":
+  version "0.16.8"
+  resolved "https://registry.yarnpkg.com/@humanfs/node/-/node-0.16.8.tgz#8f800cccc13f4f8cd3116e2d9c0a94939da3e3ed"
+  integrity sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==
+  dependencies:
+    "@humanfs/core" "^0.19.2"
+    "@humanfs/types" "^0.15.0"
+    "@humanwhocodes/retry" "^0.4.0"
+
+"@humanfs/types@^0.15.0":
+  version "0.15.0"
+  resolved "https://registry.yarnpkg.com/@humanfs/types/-/types-0.15.0.tgz#f2a09f62012390b2bff3fc6fb248ddec8c09a090"
+  integrity sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==
+
+"@humanwhocodes/module-importer@^1.0.1":
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz#af5b2691a22b44be847b0ca81641c5fb6ad0172c"
+  integrity sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==
+
+"@humanwhocodes/retry@^0.4.0", "@humanwhocodes/retry@^0.4.2":
+  version "0.4.3"
+  resolved "https://registry.yarnpkg.com/@humanwhocodes/retry/-/retry-0.4.3.tgz#c2b9d2e374ee62c586d3adbea87199b1d7a7a6ba"
+  integrity sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==
+
 "@isaacs/cliui@^8.0.2":
   version "8.0.2"
   resolved "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz"
@@ -1008,6 +1092,16 @@
   dependencies:
     "@babel/types" "^7.28.2"
 
+"@types/esrecurse@^4.3.1":
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/@types/esrecurse/-/esrecurse-4.3.1.tgz#6f636af962fbe6191b830bd676ba5986926bccec"
+  integrity sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==
+
+"@types/estree@^1.0.6", "@types/estree@^1.0.8":
+  version "1.0.9"
+  resolved "https://registry.yarnpkg.com/@types/estree/-/estree-1.0.9.tgz#cf3f0e876d7bee15a93ab925b82bf570a3904a24"
+  integrity sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==
+
 "@types/istanbul-lib-coverage@*", "@types/istanbul-lib-coverage@^2.0.1", "@types/istanbul-lib-coverage@^2.0.6":
   version "2.0.6"
   resolved "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz"
@@ -1027,6 +1121,11 @@
   dependencies:
     "@types/istanbul-lib-report" "*"
 
+"@types/json-schema@^7.0.15":
+  version "7.0.15"
+  resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.15.tgz#596a1747233694d50f6ad8a7869fcb6f56cf5841"
+  integrity sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==
+
 "@types/node@*", "@types/node@22.7.5":
   version "22.7.5"
   resolved "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz"
@@ -1153,11 +1252,31 @@
   resolved "https://registry.yarnpkg.com/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz#538b1e103bf8d9864e7b85cc96fa8d6fb6c40777"
   integrity sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==
 
+acorn-jsx@^5.3.2:
+  version "5.3.2"
+  resolved "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz#7ed5bb55908b3b2f1bc55c6af1653bada7f07937"
+  integrity sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==
+
+acorn@^8.16.0:
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.18.0.tgz#4faf01b2d6d326bfeed97aea1f52220b5f4c1940"
+  integrity sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==
+
 aes-js@4.0.0-beta.5:
   version "4.0.0-beta.5"
   resolved "https://registry.npmjs.org/aes-js/-/aes-js-4.0.0-beta.5.tgz"
   integrity sha512-G965FqalsNyrPqgEGON7nIx1e/OVENSgiEIzyC63haUMuvNnwIgIjMs52hlTCKhkBny7A2ORNlfY9Zu+jmGk1Q==
 
+ajv@^6.14.0:
+  version "6.15.0"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.15.0.tgz#07e982c74626167aa7a2495c53817892d7139492"
+  integrity sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    fast-json-stable-stringify "^2.0.0"
+    json-schema-traverse "^0.4.1"
+    uri-js "^4.2.2"
+
 ansi-escapes@^4.3.2:
   version "4.3.2"
   resolved "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz"
@@ -1297,6 +1416,13 @@ brace-expansion@^5.0.2:
   dependencies:
     balanced-match "^4.0.2"
 
+brace-expansion@^5.0.8:
+  version "5.0.9"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf"
+  integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==
+  dependencies:
+    balanced-match "^4.0.2"
+
 braces@^3.0.3:
   version "3.0.3"
   resolved "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz"
@@ -1429,7 +1555,7 @@ cross-spawn@^7.0.3, cross-spawn@^7.0.6:
     shebang-command "^2.0.0"
     which "^2.0.1"
 
-debug@^4.1.0, debug@^4.1.1, debug@^4.3.1:
+debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2:
   version "4.4.3"
   resolved "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz"
   integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==
@@ -1446,6 +1572,11 @@ dedent@^1.6.0:
   resolved "https://registry.npmjs.org/dedent/-/dedent-1.7.1.tgz"
   integrity sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==
 
+deep-is@^0.1.3:
+  version "0.1.4"
+  resolved "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz#a6f2dce612fadd2ef1f519b73551f17e85199831"
+  integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==
+
 deepmerge@^4.3.1:
   version "4.3.1"
   resolved "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz"
@@ -1548,11 +1679,105 @@ escape-string-regexp@^2.0.0:
   resolved "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz"
   integrity sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==
 
+escape-string-regexp@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz#14ba83a5d373e3d311e5afca29cf5bfad965bf34"
+  integrity sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==
+
+eslint-scope@^9.1.2:
+  version "9.1.2"
+  resolved "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-9.1.2.tgz#b9de6ace2fab1cff24d2e58d85b74c8fcea39802"
+  integrity sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==
+  dependencies:
+    "@types/esrecurse" "^4.3.1"
+    "@types/estree" "^1.0.8"
+    esrecurse "^4.3.0"
+    estraverse "^5.2.0"
+
+eslint-visitor-keys@^3.4.3:
+  version "3.4.3"
+  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz#0cd72fe8550e3c2eae156a96a4dddcd1c8ac5800"
+  integrity sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==
+
+eslint-visitor-keys@^5.0.1:
+  version "5.0.1"
+  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz#9e3c9489697824d2d4ce3a8ad12628f91e9f59be"
+  integrity sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==
+
+eslint@10.8.1:
+  version "10.8.1"
+  resolved "https://registry.yarnpkg.com/eslint/-/eslint-10.8.1.tgz#fb37d514c19b6dd5b2d6b70169fd26fddfa97967"
+  integrity sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==
+  dependencies:
+    "@eslint-community/eslint-utils" "^4.8.0"
+    "@eslint-community/regexpp" "^4.12.2"
+    "@eslint/config-array" "^0.23.5"
+    "@eslint/config-helpers" "^0.7.0"
+    "@eslint/core" "^1.2.1"
+    "@eslint/plugin-kit" "^0.7.2"
+    "@humanfs/node" "^0.16.6"
+    "@humanwhocodes/module-importer" "^1.0.1"
+    "@humanwhocodes/retry" "^0.4.2"
+    "@types/estree" "^1.0.6"
+    ajv "^6.14.0"
+    cross-spawn "^7.0.6"
+    debug "^4.3.2"
+    escape-string-regexp "^4.0.0"
+    eslint-scope "^9.1.2"
+    eslint-visitor-keys "^5.0.1"
+    espree "^11.2.0"
+    esquery "^1.7.0"
+    esutils "^2.0.2"
+    fast-deep-equal "^3.1.3"
+    file-entry-cache "^8.0.0"
+    find-up "^5.0.0"
+    glob-parent "^6.0.2"
+    ignore "^5.2.0"
+    imurmurhash "^0.1.4"
+    is-glob "^4.0.0"
+    json-stable-stringify-without-jsonify "^1.0.1"
+    minimatch "^10.2.5"
+    natural-compare "^1.4.0"
+    optionator "^0.9.3"
+
+espree@^11.2.0:
+  version "11.2.0"
+  resolved "https://registry.yarnpkg.com/espree/-/espree-11.2.0.tgz#01d5e47dc332aaba3059008362454a8cc34ccaa5"
+  integrity sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==
+  dependencies:
+    acorn "^8.16.0"
+    acorn-jsx "^5.3.2"
+    eslint-visitor-keys "^5.0.1"
+
 esprima@^4.0.0:
   version "4.0.1"
   resolved "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz"
   integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
 
+esquery@^1.7.0:
+  version "1.7.0"
+  resolved "https://registry.yarnpkg.com/esquery/-/esquery-1.7.0.tgz#08d048f261f0ddedb5bae95f46809463d9c9496d"
+  integrity sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==
+  dependencies:
+    estraverse "^5.1.0"
+
+esrecurse@^4.3.0:
+  version "4.3.0"
+  resolved "https://registry.yarnpkg.com/esrecurse/-/esrecurse-4.3.0.tgz#7ad7964d679abb28bee72cec63758b1c5d2c9921"
+  integrity sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==
+  dependencies:
+    estraverse "^5.2.0"
+
+estraverse@^5.1.0, estraverse@^5.2.0:
+  version "5.3.0"
+  resolved "https://registry.yarnpkg.com/estraverse/-/estraverse-5.3.0.tgz#2eea5290702f26ab8fe5370370ff86c965d21123"
+  integrity sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==
+
+esutils@^2.0.2:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/esutils/-/esutils-2.0.3.tgz#74d2eb4de0b8da1293711910d50775b9b710ef64"
+  integrity sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==
+
 ethereum-blockies-base64@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmjs.org/ethereum-blockies-base64/-/ethereum-blockies-base64-1.0.2.tgz"
@@ -1605,11 +1830,21 @@ expect@30.2.0:
     jest-mock "30.2.0"
     jest-util "30.2.0"
 
-fast-json-stable-stringify@^2.1.0:
+fast-deep-equal@^3.1.1, fast-deep-equal@^3.1.3:
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
+  integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
+
+fast-json-stable-stringify@^2.0.0, fast-json-stable-stringify@^2.1.0:
   version "2.1.0"
   resolved "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz"
   integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
 
+fast-levenshtein@^2.0.6:
+  version "2.0.6"
+  resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
+  integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
+
 fb-watchman@^2.0.2:
   version "2.0.2"
   resolved "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz"
@@ -1617,6 +1852,13 @@ fb-watchman@^2.0.2:
   dependencies:
     bser "2.1.1"
 
+file-entry-cache@^8.0.0:
+  version "8.0.0"
+  resolved "https://registry.yarnpkg.com/file-entry-cache/-/file-entry-cache-8.0.0.tgz#7787bddcf1131bffb92636c69457bbc0edd6d81f"
+  integrity sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==
+  dependencies:
+    flat-cache "^4.0.0"
+
 fill-range@^7.1.1:
   version "7.1.1"
   resolved "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz"
@@ -1632,6 +1874,27 @@ find-up@^4.0.0, find-up@^4.1.0:
     locate-path "^5.0.0"
     path-exists "^4.0.0"
 
+find-up@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/find-up/-/find-up-5.0.0.tgz#4c92819ecb7083561e4f4a240a86be5198f536fc"
+  integrity sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==
+  dependencies:
+    locate-path "^6.0.0"
+    path-exists "^4.0.0"
+
+flat-cache@^4.0.0:
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/flat-cache/-/flat-cache-4.0.1.tgz#0ece39fcb14ee012f4b0410bd33dd9c1f011127c"
+  integrity sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==
+  dependencies:
+    flatted "^3.2.9"
+    keyv "^4.5.4"
+
+flatted@^3.2.9:
+  version "3.4.4"
+  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.4.tgz#aeeca2a506303f0cee61c59e6c9f2a88d2f29fc6"
+  integrity sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==
+
 foreground-child@^3.1.0:
   version "3.3.1"
   resolved "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz"
@@ -1670,6 +1933,13 @@ get-stream@^6.0.0:
   resolved "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz"
   integrity sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==
 
+glob-parent@^6.0.2:
+  version "6.0.2"
+  resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-6.0.2.tgz#6d237d99083950c79290f24c7642a3de9a28f9e3"
+  integrity sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==
+  dependencies:
+    is-glob "^4.0.3"
+
 glob@^10.3.10:
   version "10.5.0"
   resolved "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz"
@@ -1694,6 +1964,11 @@ glob@^7.1.4:
     once "^1.3.0"
     path-is-absolute "^1.0.0"
 
+globals@17.11.0:
+  version "17.11.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.11.0.tgz#d643485bb30220d7751e511cf4f68c73d3870d87"
+  integrity sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==
+
 graceful-fs@^4.2.11, graceful-fs@^4.2.4:
   version "4.2.11"
   resolved "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz"
@@ -1714,6 +1989,11 @@ human-signals@^2.1.0:
   resolved "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz"
   integrity sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==
 
+ignore@^5.2.0:
+  version "5.3.2"
+  resolved "https://registry.yarnpkg.com/ignore/-/ignore-5.3.2.tgz#3cd40e729f3643fd87cb04e50bf0eb722bc596f5"
+  integrity sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==
+
 import-local@^3.2.0:
   version "3.2.0"
   resolved "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz"
@@ -1760,7 +2040,7 @@ is-generator-fn@^2.1.0:
   resolved "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz"
   integrity sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==
 
-is-glob@^4.0.3:
+is-glob@^4.0.0, is-glob@^4.0.3:
   version "4.0.3"
   resolved "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz"
   integrity sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==
@@ -2212,21 +2492,51 @@ jsesc@^3.0.2:
   resolved "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz"
   integrity sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==
 
+json-buffer@3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/json-buffer/-/json-buffer-3.0.1.tgz#9338802a30d3b6605fbe0613e094008ca8c05a13"
+  integrity sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==
+
 json-parse-even-better-errors@^2.3.0:
   version "2.3.1"
   resolved "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz"
   integrity sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==
 
+json-schema-traverse@^0.4.1:
+  version "0.4.1"
+  resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz#69f6a87d9513ab8bb8fe63bdb0979c448e684660"
+  integrity sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==
+
+json-stable-stringify-without-jsonify@^1.0.1:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz#9db7b59496ad3f3cfef30a75142d2d930ad72651"
+  integrity sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==
+
 json5@^2.2.3:
   version "2.2.3"
   resolved "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz"
   integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
 
+keyv@^4.5.4:
+  version "4.5.4"
+  resolved "https://registry.yarnpkg.com/keyv/-/keyv-4.5.4.tgz#a879a99e29452f942439f2a405e3af8b31d4de93"
+  integrity sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==
+  dependencies:
+    json-buffer "3.0.1"
+
 leven@^3.1.0:
   version "3.1.0"
   resolved "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz"
   integrity sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==
 
+levn@^0.4.1:
+  version "0.4.1"
+  resolved "https://registry.yarnpkg.com/levn/-/levn-0.4.1.tgz#ae4562c007473b932a6200d403268dd2fffc6ade"
+  integrity sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==
+  dependencies:
+    prelude-ls "^1.2.1"
+    type-check "~0.4.0"
+
 libsodium-sumo@^0.8.0:
   version "0.8.2"
   resolved "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.8.2.tgz"
@@ -2325,6 +2635,13 @@ locate-path@^5.0.0:
   dependencies:
     p-locate "^4.1.0"
 
+locate-path@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-6.0.0.tgz#55321eb309febbc59c4801d931a72452a681d286"
+  integrity sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==
+  dependencies:
+    p-locate "^5.0.0"
+
 lru-cache@^10.2.0:
   version "10.4.3"
   resolved "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz"
@@ -2376,6 +2693,13 @@ mimic-fn@^2.1.0:
   resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz"
   integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
 
+minimatch@^10.2.4, minimatch@^10.2.5:
+  version "10.2.6"
+  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.6.tgz#fd956bbe0b77241e9f15ac5dccb1c638060968ef"
+  integrity sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==
+  dependencies:
+    brace-expansion "^5.0.8"
+
 minimatch@^3.0.4, minimatch@^3.1.1:
   version "3.1.3"
   resolved "https://registry.npmjs.org/minimatch/-/minimatch-3.1.3.tgz"
@@ -2456,6 +2780,18 @@ onetime@^5.1.2:
   dependencies:
     mimic-fn "^2.1.0"
 
+optionator@^0.9.3:
+  version "0.9.4"
+  resolved "https://registry.yarnpkg.com/optionator/-/optionator-0.9.4.tgz#7ea1c1a5d91d764fb282139c88fe11e182a3a734"
+  integrity sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==
+  dependencies:
+    deep-is "^0.1.3"
+    fast-levenshtein "^2.0.6"
+    levn "^0.4.1"
+    prelude-ls "^1.2.1"
+    type-check "^0.4.0"
+    word-wrap "^1.2.5"
+
 p-limit@^2.2.0:
   version "2.3.0"
   resolved "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz"
@@ -2463,7 +2799,7 @@ p-limit@^2.2.0:
   dependencies:
     p-try "^2.0.0"
 
-p-limit@^3.1.0:
+p-limit@^3.0.2, p-limit@^3.1.0:
   version "3.1.0"
   resolved "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz"
   integrity sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==
@@ -2477,6 +2813,13 @@ p-locate@^4.1.0:
   dependencies:
     p-limit "^2.2.0"
 
+p-locate@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-5.0.0.tgz#83c8315c6785005e3bd021839411c9e110e6d834"
+  integrity sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==
+  dependencies:
+    p-limit "^3.0.2"
+
 p-try@^2.0.0:
   version "2.2.0"
   resolved "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz"
@@ -2562,6 +2905,11 @@ pnglib@0.0.1:
   resolved "https://registry.npmjs.org/pnglib/-/pnglib-0.0.1.tgz"
   integrity sha512-95ChzOoYLOPIyVmL+Y6X+abKGXUJlvOVLkB1QQkyXl7Uczc6FElUy/x01NS7r2GX6GRezloO/ecCX9h4U9KadA==
 
+prelude-ls@^1.2.1:
+  version "1.2.1"
+  resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
+  integrity sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==
+
 prettier@^3.8.1:
   version "3.8.1"
   resolved "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz"
@@ -2576,6 +2924,11 @@ pretty-format@30.2.0:
     ansi-styles "^5.2.0"
     react-is "^18.3.1"
 
+punycode@^2.1.0:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
+  integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
+
 pure-rand@^7.0.0:
   version "7.0.1"
   resolved "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz"
@@ -2822,6 +3175,13 @@ tslib@^2.8.1:
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.8.1.tgz#612efe4ed235d567e8aba5f2a5fab70280ade83f"
   integrity sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==
 
+type-check@^0.4.0, type-check@~0.4.0:
+  version "0.4.0"
+  resolved "https://registry.yarnpkg.com/type-check/-/type-check-0.4.0.tgz#07b8203bfa7056c0657050e3ccd2c37730bab8f1"
+  integrity sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==
+  dependencies:
+    prelude-ls "^1.2.1"
+
 type-detect@4.0.8:
   version "4.0.8"
   resolved "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz"
@@ -2872,6 +3232,13 @@ update-browserslist-db@^1.2.0:
     escalade "^3.2.0"
     picocolors "^1.1.1"
 
+uri-js@^4.2.2:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
+  integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==
+  dependencies:
+    punycode "^2.1.0"
+
 v8-to-istanbul@^9.0.1:
   version "9.3.0"
   resolved "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz"
@@ -2900,6 +3267,11 @@ which@^2.0.1:
   dependencies:
     isexe "^2.0.0"
 
+word-wrap@^1.2.5:
+  version "1.2.5"
+  resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.5.tgz#d2c45c6dd4fbce621a66f136cbe328afd0410b34"
+  integrity sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==
+
 "wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
   version "7.0.0"
   resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz"