fix: add fallback popup window for tx and sign approval requests (closes #4)

requestTxApproval and requestSignApproval were missing the
openApprovalWindow fallback that requestApproval (connection
requests) already had. When chrome.action.openPopup() fails
(which it does when not triggered by a user gesture in MV3),
no popup appeared — the user had to manually click the toolbar
icon to find the confirmation screen.

Now all three approval types use the same pattern: try
openPopup() first, fall back to a centered standalone window.

src/background/index.js

@@ -93,13 +93,11 @@ function resetPopupUrl() {
     }
 }
 
-// Open approval in a separate popup window.
-// This is the primary mechanism for tx/sign approvals (triggered programmatically,
-// not from a user gesture) and the fallback for site-connection approvals.
+// Fallback: open approval in a separate window (used when openPopup is unavailable)
 function openApprovalWindow(id) {
     const popupUrl = runtime.getURL("src/popup/index.html?approval=" + id);
-    const popupWidth = 360;
-    const popupHeight = 600;
+    const popupWidth = 400;
+    const popupHeight = 500;
 
     windowsApi.getLastFocused((currentWin) => {
         const opts = {
@@ -150,9 +148,7 @@ function requestApproval(origin, hostname) {
 }
 
 // Open a tx-approval popup and return a promise that resolves with txHash or error.
-// Uses windows.create() directly because tx approvals are triggered programmatically
-// (from a dApp RPC call), not from a user gesture, so action.openPopup() is
-// unreliable in this context.
+// Tries the toolbar popup first, falls back to a standalone window.
 function requestTxApproval(origin, hostname, txParams) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
@@ -164,14 +160,26 @@ function requestTxApproval(origin, hostname, txParams) {
             type: "tx",
         };
 
+        if (actionApi && typeof actionApi.openPopup === "function") {
+            actionApi.setPopup({
+                popup: "src/popup/index.html?approval=" + id,
+            });
+            try {
+                const result = actionApi.openPopup();
+                if (result && typeof result.catch === "function") {
+                    result.catch(() => openApprovalWindow(id));
+                }
+            } catch {
                 openApprovalWindow(id);
+            }
+        } else {
+            openApprovalWindow(id);
+        }
     });
 }
 
 // Open a sign-approval popup and return a promise that resolves with { signature } or { error }.
-// Uses windows.create() directly because sign approvals are triggered programmatically
-// (from a dApp RPC call), not from a user gesture, so action.openPopup() is
-// unreliable in this context.
+// Tries the toolbar popup first, falls back to a standalone window.
 function requestSignApproval(origin, hostname, signParams) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
@@ -183,14 +191,27 @@ function requestSignApproval(origin, hostname, signParams) {
             type: "sign",
         };
 
+        if (actionApi && typeof actionApi.openPopup === "function") {
+            actionApi.setPopup({
+                popup: "src/popup/index.html?approval=" + id,
+            });
+            try {
+                const result = actionApi.openPopup();
+                if (result && typeof result.catch === "function") {
+                    result.catch(() => openApprovalWindow(id));
+                }
+            } catch {
                 openApprovalWindow(id);
+            }
+        } else {
+            openApprovalWindow(id);
+        }
     });
 }
 
 // Detect when an approval popup (browser-action) closes without a response.
-// TX and sign approvals now use windows.create() and are handled by the
-// windowsApi.onRemoved listener below, but we still handle site-connection
-// approval disconnects here.
+// TX and sign approvals are NOT auto-rejected on disconnect because toolbar
+// popups naturally close on focus loss and the user can reopen them.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];