fix: render the view "Back" lands on after the popup is reopened (closes #268 )

goBack() only unhid its target. A reopened popup renders the wallet list and the one view restoreView() lands on, so every other view is still the blank static template from index.html: pressing Back from Settings onto an address showed an empty address line and no balances, and the same held for address-token, receive, confirm-tx and transaction. The per-view dispatch and its data guards move out of restoreView() into src/popup/viewRouter.js, and goBack() now routes a popped view through the same code by way of a renderer index.js registers with setBackRenderer(). A view whose backing state is gone falls back to Home the way the restore does, rather than showing an empty template. The Back path renders only a view this page load has not rendered yet. viewRouter.js keeps a page-load-scoped set of rendered views, written by showView() — the last thing every render path runs, forward navigation and the restore alike, so a view added later registers itself rather than needing to be remembered. Back onto a view already in that set unhides it and nothing more, exactly as it does for a view outside RESTORABLE_VIEWS: rendering a second time would re-fetch and overwrite what the view holds, such as an edit typed into Settings and not yet saved. Home stays the exception and is re-rendered on every Back, as it was when goBack() called the renderWalletList() registered through setRenderMain(), so the wallet list reflects what changed while the user was away from it. tests/backNavigation.test.js drives the real goBack() over the reproduction and over each of address-token, receive, confirm-tx, transaction, success-tx and error-tx, with and without their backing state, and pins that a view this page load already rendered — a live-session view, or Settings revisited — is only unhidden, while Home still re-renders. tests/e2e/run.js adds three cases against the real popup in a real browser, because make check cannot see a blank view: a real close and reopen then Back onto the address screen and onto Receive, and an in-session Back onto Settings that must keep unsaved input. All three were demonstrated failing first.
2026-08-12 11:32:46 +00:00
9 changed files with 40 additions and 912 deletions
--- a/TODO.md
+++ b/TODO.md
@@ -45,36 +45,6 @@ undefined identifiers, which is how
 # Completed Steps
 - 2026-08-14: The parts of the
  [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
  [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
  e2e suite did not cover are asserted. It had only shown that the two screens
  open without throwing. Now: the Add Token round trip leaves the navigation
  stack exactly as it found it, read out of extension storage rather than
  inferred from which screen is up, so an orphaned entry — the second-order
  damage of #150 — is caught where it happens rather than one Back press later;
  a common-token quick-pick puts its contract address in the field; the native
  ETH detail path renders with its own type, value and raw quantity and with the
  token contract row still hidden, against a new `seedNativeTransfer` fixture,
  since the normal-transactions endpoint answered `[]` unconditionally and there
  was no non-ERC-20 row to open; and tapping the token contract address puts it
  on the real clipboard, read back after a sentinel write. Each of the four was
  demonstrated failing against a deliberately broken build
  ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
  rebuilt every failure as `new Error(error.message)`, so the code the
  background produced and the content script relayed intact was dropped in the
  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
  the user deliberately declined was indistinguishable from one that broke. The
  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
  boundary sent one, `data`, passed through verbatim rather than matched against
  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
  here. An error the background sent with no code stays a plain `Error` with no
  `code` property, and `message` is unchanged in every case. All four request
  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
  now requires it on the page's Error as well as on the wire, for all four
  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
  it. A reopened popup renders the wallet list and the one screen it restores
  onto, so every screen further down the stack was still the blank template from
@@ -92,20 +62,6 @@ undefined identifiers, which is how
  and by three end-to-end cases against the real popup, each demonstrated
  failing on the unfixed build
  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
  that bear it, not to one of them. A ticker is not unique: seven of the 512
  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
  share a symbol with another bundled entry at a different real contract, and
  the table, built from the list first-wins, kept only the earlier one. The
  other seven were judged spoofs of their own symbol at their own address and
  hidden from the balance list, the history and the send selector, so a holder
  could not spend them. Both contracts of each pair come from the same CoinGecko
  fetch of 2026-02-27, so neither was stale and neither was dropped.
  `isSpoofedSymbol()` asks set membership instead of equality, which does not
  loosen the rule — a contract outside the set is still a spoof — and a test now
  walks `TOKENS` asserting no bundled token is filtered at its own address,
  which is the walk the suite lacked
  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
 - 2026-08-12: The dApp approval round trips are driven end to end in the
  browser. A test page served by the harness speaks EIP-1193 to the real inpage
  provider through the real content script, background worker and approval popup
--- a/src/content/inpage.js
+++ b/src/content/inpage.js
@@ -11,39 +11,6 @@
    let nextId = 1;
    const pending = {};
    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
    // rather than properties bolted onto an Error because this object crosses
    // no boundary after construction — it is built in the page's own realm and
    // handed straight to the caller's catch — so the prototype survives and
    // `error.name` is a stable thing for a dApp to see.
    class ProviderRpcError extends Error {
        constructor(code, message, data) {
            super(message);
            this.name = "ProviderRpcError";
            this.code = code;
            if (data !== undefined) this.data = data;
        }
    }
    // Rebuild a boundary error as the error the page catches, carrying the
    // code (and data) the extension reported. Without this a dApp cannot tell
    // a user's refusal (4001) from a wallet that broke, and retries or shows
    // an error instead of accepting the refusal.
    //
    // Whatever code arrived is passed through verbatim rather than being
    // matched against a list: the extension emits 4001, 4100 and 4902 today,
    // and a code this file has never heard of is still the truth about what
    // happened. An error reported with no code at all stays a plain Error —
    // a ProviderRpcError whose `code` is undefined would advertise a
    // conformance it does not have. `message` is untouched in every case.
    function toPageError(error) {
        const message = (error && error.message) || "Request failed";
        if (error && error.code !== undefined && error.code !== null) {
            return new ProviderRpcError(error.code, message, error.data);
        }
        return new Error(message);
    }
    // Listen for responses from the content script
    window.addEventListener("message", function onUuid(event) {
        if (event.source !== window) return;
@@ -53,7 +20,7 @@
        if (!p) return;
        delete pending[id];
        if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
        } else {
            p.resolve(result);
        }
--- a/src/shared/symbolSpoof.js
+++ b/src/shared/symbolSpoof.js
@@ -8,19 +8,12 @@
 // either verdict alone, because the balance list is where the user forms
 // their belief about what they own (issue #235).
 //
-// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
+// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
-// that may bear it, or to null.  Null means the symbol belongs to the native
+// bear it, or to null.  Null means the symbol belongs to the native asset,
-// asset, which has no contract at all, so no contract may bear it and every
+// which has no contract at all, so no contract may bear it and every one
-// one that does is a spoof.  "ETH" is the only such entry today; the rule is
+// that does is a spoof.  "ETH" is the only such entry today; the rule is
 // written so that a second one needs no change here or at any call site.
 //
 // The value is a set because a ticker is not unique: seven symbols in the
 // bundled list belong to two real contracts each, and answering with one of
 // them hid the other one's holders' money (issue #276).  Membership, not
 // equality, is therefore the question — but it is the same question, asked of
 // a table that can now state the truth.  Every address in a set is one the
 // wallet ships as a real token; a contract outside the set is still a spoof.
 //
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
 // question is whether the symbol reaches the user's eye as a known one,
@@ -100,7 +93,7 @@ function isSpoofedSymbol(symbol, contractAddress) {
    if (!KNOWN_SYMBOLS.has(sym)) return false;
    const legit = KNOWN_SYMBOLS.get(sym);
    if (legit === null) return true;
-    return !legit.has(contract);
+    return contract !== normalizeAddress(legit);
 }
 module.exports = {
--- a/src/shared/tokenList.js
+++ b/src/shared/tokenList.js
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
    TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
-// Build a map of symbol (uppercased) -> the set of contract addresses
+// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
-// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
+// Used for spoofed-symbol detection. "ETH" maps to null (native token).
 // "ETH" maps to null: the native asset has no contract, so no contract may
 // bear its symbol.
 //
 // The value is a set and not a single address because tickers are not unique
 // and the list above proves it: seven of these 512 tokens share a symbol with
 // another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
 // different real contracts each, all of them from the same source fetch.  A
 // one-address-per-symbol table can only answer that by picking a winner, and
 // the loser is then a token in our own bundled list that the spoof filter
 // hides from the balance list, the history and the send selector at its own
 // address, so the user cannot spend it (issue #276).  Naming every address
 // that bears the symbol is the only shape that says what is true; it does not
 // loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
    const upper = t.symbol.toUpperCase();
    if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, new Set());
+        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
    }
    const addresses = KNOWN_SYMBOLS.get(upper);
    // A null entry is the native asset and stays null: an ERC-20 that reports
    // the native symbol does not thereby become entitled to it.
    if (addresses !== null) {
        addresses.add(t.address.toLowerCase());
    }
 }
--- a/tests/e2e/network.js
+++ b/tests/e2e/network.js
@@ -46,24 +46,9 @@ const STUB_TX_HASH =
 const STUB_BLOCK_NUMBER = 21000000;
 // The native ETH transfer, seeded by opts.seedNativeTransfer. Its own hash
 // and an older block, so it is a second row rather than a leg of the token
 // transfer: mergeTransactions() consolidates a native entry and a token
 // transfer that share a hash into one row, which would leave nothing native
 // to open. 0.25 ETH clears the 100000 gwei dust threshold the default
 // filters apply, so the row is not silently dropped.
 const STUB_NATIVE_TX_HASH =
    "0xe7e0000000000000000000000000000000000000000000000000000000000e7e";
 const STUB_NATIVE_BLOCK_NUMBER = STUB_BLOCK_NUMBER - 1;
 const STUB_NATIVE_VALUE_WEI = "250000000000000000";
 // Fixed instant so timeAgo() output is stable across runs.
 const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
 const STUB_NATIVE_TX_TIMESTAMP = "2026-01-02T02:03:04.000000Z";
 // A 32-byte zero word. Returned for every eth_call, which is what makes
 // ethers' ENS reverse lookup resolve to "no resolver set" and return null
 // instead of throwing. A throw would be logged by src/shared/ens.js via
@@ -101,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records the whole observable shape of the error as it
+// The rejection branch records `code` as it arrives. EIP-1193 says a user
-// arrives — name, message, and whether a `code` is present at all as distinct
+// rejection is a ProviderRpcError carrying code 4001; what the page can
-// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// actually see is recorded here rather than assumed, and asserted in run.js.
 // carrying code 4001; what the page can actually see is recorded here rather
 // than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -137,7 +120,6 @@ const DAPP_HTML = [
    "                    return {",
    "                        settled: 'rejected',",
    "                        message: String((error && error.message) || error),",
    "                        name: error ? error.name : undefined,",
    "                        hasCode: !!error && 'code' in Object(error),",
    "                        code: error ? error.code : undefined,",
    "                    };",
@@ -273,25 +255,6 @@ function tokenTransferItems(address) {
    ];
 }
 // One received native ETH transfer, in the shape src/shared/transactions.js
 // parses. to.is_contract is false and there is no method, so parseTx() keeps
 // it a plain transfer rather than a contract call — which is what makes the
 // detail screen classify it "Native ETH Transfer" and leave the token
 // contract row hidden.
 function nativeTransactionItems(address) {
    return [
        {
            hash: STUB_NATIVE_TX_HASH,
            block_number: STUB_NATIVE_BLOCK_NUMBER,
            timestamp: STUB_NATIVE_TX_TIMESTAMP,
            from: { hash: STUB_COUNTERPARTY },
            to: { hash: address, is_contract: false },
            value: STUB_NATIVE_VALUE_WEI,
            status: "ok",
        },
    ];
 }
 // A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
 // this is what puts an ERC-20 in the send screen's token dropdown, which is
 // the only way the confirmation screen's ERC-20 path can be reached.
@@ -304,17 +267,12 @@ function tokenBalanceItems() {
    ];
 }
-// Full details for either seeded transaction — the detail screen fetches
+// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
-// them for whichever row was opened, and an unstubbed hash would be
+// decoder short-circuits; the on-chain detail fields still populate.
-// reported as escaping traffic. raw_input is "0x" so the calldata decoder
+function transactionDetails() {
 // short-circuits; the on-chain detail fields still populate.
 function transactionDetails(hash) {
    return {
-        hash: hash,
+        hash: STUB_TX_HASH,
-        block_number:
+        block_number: STUB_BLOCK_NUMBER,
            hash === STUB_NATIVE_TX_HASH
                ? STUB_NATIVE_BLOCK_NUMBER
                : STUB_BLOCK_NUMBER,
        nonce: 7,
        gas_used: "51000",
        gas_price: "1000000000",
@@ -518,10 +476,6 @@ function traceEnabled(raw) {
 * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
 *   transfer. Read at request time, so a test can flip it on the same
 *   options object without re-registering the route.
 * @param {boolean} [opts.seedNativeTransfer]  serve the stubbed native ETH
 *   transfer, read at request time like seedTokenTransfer. Without it the
 *   normal-transactions endpoint answers with an empty list, so there is no
 *   non-ERC-20 row to open.
 * @param {boolean} [opts.seedTokenBalance]  serve the stubbed ERC-20
 *   holding, which is what makes the token reachable from the send screen.
 * @param {string} [opts.ethBalanceWei]  hex wei answered to eth_getBalance;
@@ -593,13 +547,7 @@ async function installNetworkStubs(ctx, opts) {
        // Blockscout v2
        if (p.includes("/api/v2/")) {
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
-                const addr = blockscoutAddress(p);
+                return jsonResponse(route, { items: [] });
                return jsonResponse(route, {
                    items:
                        opts.seedNativeTransfer && addr
                            ? nativeTransactionItems(addr)
                            : [],
                });
            }
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
                const addr = blockscoutAddress(p);
@@ -616,10 +564,8 @@ async function installNetworkStubs(ctx, opts) {
                    opts.seedTokenBalance ? tokenBalanceItems() : [],
                );
            }
-            for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {
+            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
-                if (p.endsWith("/transactions/" + hash)) {
+                return jsonResponse(route, transactionDetails());
                    return jsonResponse(route, transactionDetails(hash));
                }
            }
        }
@@ -691,8 +637,6 @@ module.exports = {
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
    STUB_COUNTERPARTY,
    STUB_NATIVE_TX_HASH,
    STUB_NATIVE_VALUE_WEI,
    STUB_TOKEN,
    STUB_TX_HASH,
 };
--- a/tests/e2e/run.js
+++ b/tests/e2e/run.js
@@ -36,8 +36,6 @@ const {
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
    STUB_COUNTERPARTY,
    STUB_NATIVE_TX_HASH,
    STUB_NATIVE_VALUE_WEI,
    STUB_TOKEN,
    STUB_TX_HASH,
 } = require("./network");
@@ -171,264 +169,6 @@ test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
    assert(dots > 0, "token contract row rendered without its colour dot");
 });
 // --------------------- the rest of the #150 and #151 definition of done
 //
 // The two tests above assert that the screens #150 and #151 broke now open
 // without throwing, which is narrower than what those issues asked for.
 // The four items below are the remainder (#188): the navigation stack out
 // of Add Token, the quick-pick actually populating the field, the native
 // ETH detail path the ERC-20 fix could have regressed, and tap-to-copy.
 // Leave the transaction detail screen for the address screen it was opened
 // from. The two tests above finish on it, and so does the last test here.
 async function leaveTransactionDetail(page) {
    if (await page.isVisible("#view-transaction")) {
        await page.click("#btn-tx-back");
    }
    await openAddressDetail(page);
 }
 // Back out to Home from wherever the previous test finished.
 async function goHome(page) {
    await leaveTransactionDetail(page);
    await page.click("#btn-address-back");
    await visible(page, "#view-main");
 }
 // The navigation stack as it was actually persisted, read out of extension
 // storage rather than inferred from which screen is showing. A stale entry
 // left behind by a forward navigation that threw is invisible on screen
 // until the user presses Back one time too many — which is exactly the
 // second-order damage #150 did — so the stack itself is what gets asserted.
 function persistedViewStack(page) {
    return page.evaluate(
        () =>
            new Promise((resolve) => {
                chrome.storage.local.get("autistmask", (r) => {
                    resolve((r.autistmask && r.autistmask.viewStack) || []);
                });
            }),
    );
 }
 // saveState() is fired from showView() without being awaited, so the write
 // lands shortly after the screen does. Polling for the expected stack keeps
 // that race out of the assertion; a stack that never becomes the expected
 // one fails with what it actually was.
 const VIEW_STACK_SETTLE_MS = 5000;
 async function waitForViewStack(page, expected, where) {
    const want = JSON.stringify(expected);
    const deadline = Date.now() + VIEW_STACK_SETTLE_MS;
    let seen;
    for (;;) {
        seen = await persistedViewStack(page);
        if (JSON.stringify(seen) === want) return;
        if (Date.now() >= deadline) break;
        await sleep(50);
    }
    throw new Error(
        "navigation stack " +
            where +
            " is " +
            JSON.stringify(seen) +
            ", expected " +
            want,
    );
 }
 // The invariant is stated as a delta against whatever the earlier tests
 // left on the stack, not as an absolute: a round trip into Add Token and
 // back out must leave the stack exactly as it found it. That is what "no
 // duplicated or orphaned stack entry" means, and it holds whatever the
 // starting depth is.
 test("Back from Add Token unwinds the stack exactly once (#150)", async (env) => {
    await goHome(env.page);
    const base = await persistedViewStack(env.page);
    await env.page.locator("#wallet-list .btn-addr-info").first().click();
    await visible(env.page, "#view-address");
    await waitForViewStack(env.page, base.concat("main"), "on address detail");
    await env.page.click("#btn-add-token");
    await visible(env.page, "#view-add-token");
    await waitForViewStack(
        env.page,
        base.concat("main", "address"),
        "on the add token screen",
    );
    await env.page.click("#btn-add-token-back");
    await visible(env.page, "#view-address");
    assert(
        !(await env.page.isVisible("#view-add-token")),
        "the add token screen is still showing after Back",
    );
    await waitForViewStack(
        env.page,
        base.concat("main"),
        "after Back from add token",
    );
    await env.page.click("#btn-address-back");
    await visible(env.page, "#view-main");
    await waitForViewStack(env.page, base, "after a second Back");
 });
 test("a common-token quick-pick fills in the contract address (#150)", async (env) => {
    await openAddressDetail(env.page);
    await env.page.click("#btn-add-token");
    await visible(env.page, "#view-add-token");
    const before = await env.page.inputValue("#add-token-address");
    assert(
        before === "",
        "the add token screen opened with the address field already filled: " +
            JSON.stringify(before),
    );
    const pick = env.page.locator("#common-token-list .common-token").first();
    const wanted = await pick.getAttribute("data-address");
    assert(
        /^0x[0-9a-fA-F]{40}$/.test(wanted || ""),
        "the first quick-pick button carries no contract address: " +
            JSON.stringify(wanted),
    );
    await pick.click();
    const after = await env.page.inputValue("#add-token-address");
    assert(
        after === wanted,
        "clicking the " +
            (await pick.innerText()).trim() +
            " quick-pick left the address field as " +
            JSON.stringify(after) +
            ", expected " +
            JSON.stringify(wanted),
    );
    await env.page.click("#btn-add-token-back");
    await visible(env.page, "#view-address");
 });
 // The native amount as the transaction list writes it (four decimals) and
 // as the detail screen writes it (full precision). Both are rendered here
 // from the fixture rather than read off the screen, so the assertions
 // compare against the wei the stub served.
 const NATIVE_ROW_TEXT =
    parseFloat(formatEther(STUB_NATIVE_VALUE_WEI)).toFixed(4) + " ETH";
 const NATIVE_DETAIL_TEXT = formatEther(STUB_NATIVE_VALUE_WEI) + " ETH";
 test("the native ETH transaction detail still renders (#151)", async (env) => {
    // The ERC-20 fix could only have regressed this path by making the
    // token-contract branch run for a transfer that has no contract, so
    // the assertions below are as much about that row staying hidden as
    // about the screen coming up.
    env.routeOpts.seedNativeTransfer = true;
    await env.page.reload();
    await openAddressDetail(env.page);
    const row = env.page
        .locator("#tx-list .tx-row")
        .filter({ hasText: NATIVE_ROW_TEXT });
    await row.waitFor({ state: "visible", timeout: 30000 });
    await row.click();
    await visible(env.page, "#view-transaction");
    const hash = await env.page.locator("#tx-detail-hash").innerText();
    assert(
        hash.includes(STUB_NATIVE_TX_HASH),
        "the native transaction detail shows the wrong hash: " + hash,
    );
    const type = (await env.page.locator("#tx-detail-type").innerText()).trim();
    assert(
        type === "Native ETH Transfer",
        "the native transaction was classified " + JSON.stringify(type),
    );
    const value = await env.page.locator("#tx-detail-value").innerText();
    assert(
        value.includes(NATIVE_DETAIL_TEXT),
        "the native transaction detail shows " +
            JSON.stringify(value) +
            ", expected it to contain " +
            NATIVE_DETAIL_TEXT,
    );
    const native = await env.page.locator("#tx-detail-native").innerText();
    assert(
        native.includes(STUB_NATIVE_VALUE_WEI + " wei"),
        "the raw quantity row shows " +
            JSON.stringify(native) +
            ", expected the value in wei",
    );
    assert(
        !(await env.page.isVisible("#tx-detail-token-contract-section")),
        "the token contract row is showing on a transfer that has no token " +
            "contract",
    );
    // Back to one seeded transaction for everything after this: the tests
    // below were written against a list holding the token transfer alone.
    env.routeOpts.seedNativeTransfer = false;
 });
 test("tap-to-copy on the transaction detail screen copies the address (#151)", async (env) => {
    // Read the clipboard back rather than watching the handler run: what
    // #151 asks for is the address reaching the clipboard, and a spy on
    // navigator.clipboard would assert the call and not the effect.
    //
    // Granted context-wide rather than for the popup's origin: an
    // origin-scoped grant is refused for chrome-extension: URLs, which
    // both Playwright and Chrome treat as opaque here.
    await env.ctx.grantPermissions(["clipboard-read", "clipboard-write"]);
    await leaveTransactionDetail(env.page);
    const row = env.page
        .locator("#tx-list .tx-row")
        .filter({ hasText: STUB_TOKEN.symbol });
    await row.waitFor({ state: "visible", timeout: 30000 });
    await row.click();
    await visible(env.page, "#view-transaction");
    await visible(env.page, "#tx-detail-token-contract-section");
    // Seed a sentinel first, so a clipboard that nothing writes to cannot
    // pass on whatever was left in it.
    const SENTINEL = "e2e-clipboard-untouched";
    await env.page.evaluate((s) => navigator.clipboard.writeText(s), SENTINEL);
    const seeded = await env.page.evaluate(() =>
        navigator.clipboard.readText(),
    );
    assert(
        seeded === SENTINEL,
        "the harness could not seed the clipboard, so the assertion below " +
            "would prove nothing; it read back " +
            JSON.stringify(seeded),
    );
    await env.page.locator("#tx-detail-token-contract [data-copy]").click();
    const copied = await env.page.evaluate(() =>
        navigator.clipboard.readText(),
    );
    assert(
        copied.toLowerCase() === STUB_TOKEN.address,
        "tapping the token contract address put " +
            JSON.stringify(copied) +
            " on the clipboard, expected " +
            STUB_TOKEN.address,
    );
    const flash = await env.page.locator("#flash-msg").innerText();
    assert(
        flash.trim() === "Copied!",
        "the copy gave no confirmation, flash line reads " +
            JSON.stringify(flash),
    );
 });
 // -------------------------------------------- recovery phrase (#161)
 // The gear toggles, so pressing it while Settings is already up leaves it.
@@ -2017,14 +1757,15 @@ async function lastResponseError(page) {
 }
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and EIP-1193 code 4001 is present both
+// rather than hanging or resolving, and the response that crossed the
-// on the wire and on the Error the calling page catches.
+// boundary carried EIP-1193 code 4001.
 //
-// Both ends matter because they used to disagree. The code crossed the
+// The code is asserted on the wire because that is the only place it
-// boundary correctly and src/content/inpage.js then threw it away, rebuilding
+// survives. src/content/inpage.js rebuilds the rejection as `new
-// every rejection as `new Error(error.message)` — so a dApp branching on
+// Error(error.message)`, so the Error the calling page catches carries the
-// `err.code === 4001` saw undefined and could not tell a refusal from a
+// message and no code. That is reported rather than asserted either way —
-// failure (#274). Asserting only the wire would leave that gap invisible.
+// locking in the current behaviour would make the gap permanent, and
 // asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
    const outcome = await settleRequest(page, key);
    assert(
@@ -2046,32 +1787,15 @@ async function assertUserRejection(page, key, label) {
            " did not carry EIP-1193 code 4001 across the boundary: " +
            JSON.stringify(error),
    );
    assert(
        outcome.hasCode,
        label +
            " reached the page as an error with no code property at all, so a " +
            "dApp cannot tell the user's refusal from a failure: " +
            JSON.stringify(outcome),
    );
    assert(
        outcome.code === 4001,
        label +
            " reached the page with code " +
            JSON.stringify(outcome.code) +
            " rather than EIP-1193 4001",
    );
    assert(
        outcome.name === "ProviderRpcError",
        label +
            " reached the page as " +
            JSON.stringify(outcome.name) +
            " rather than an EIP-1193 ProviderRpcError",
    );
    console.log(
        "# " +
            label +
-            ": code 4001 on the wire and on the page's " +
+            ": boundary code=" +
-            outcome.name,
+            error.code +
            " page Error.code=" +
            JSON.stringify(outcome.code) +
            " page Error carries a code=" +
            outcome.hasCode,
    );
    return outcome;
 }
@@ -2631,7 +2355,6 @@ async function main() {
    // starting state of a run is readable without hunting through tests.
    const routeOpts = {
        seedTokenTransfer: false,
        seedNativeTransfer: false,
        seedTokenBalance: false,
        ethBalanceWei: null,
        failGasEstimate: false,
--- a/tests/inpageErrors.test.js
+++ b/tests/inpageErrors.test.js
@@ -1,310 +0,0 @@
 // The EIP-1193 error the page actually catches (src/content/inpage.js).
 //
 // The bug this pins down (issue #274): the provider rebuilt every failure as
 // `new Error(error.message)`, so the `code` the background produced and the
 // content script relayed intact was thrown away in the last hop. A dApp
 // checking `err.code === 4001` — the standard way to tell "the user said no"
 // from "the wallet broke" — saw undefined, and well-behaved sites showed an
 // error or retried instead of accepting the refusal.
 //
 // inpage.js is a bare IIFE injected into the page's JS context, not a module:
 // it takes no import and exports nothing, and reaches for `window` at load.
 // So it is evaluated here the way the browser evaluates it, against a stub
 // window, and the provider is collected from `window.ethereum`. The globals it
 // touches are passed in as function parameters rather than assigned to
 // globalThis: nothing leaks between tests, and the source is compiled in this
 // realm, so the errors it constructs are comparable against this file's own
 // `Error` — which a second realm's intrinsics would silently defeat.
 //
 // There is no jsdom in this repo; see tests/txStatus.test.js.
 const fs = require("fs");
 const path = require("path");
 const { webcrypto } = require("crypto");
 const SOURCE = fs.readFileSync(
    path.join(__dirname, "..", "src", "content", "inpage.js"),
    "utf8",
 );
 const loadInto = new Function(
    "window",
    "self",
    "crypto",
    "Event",
    "CustomEvent",
    SOURCE,
 );
 class StubEvent {
    constructor(type) {
        this.type = type;
    }
 }
 class StubCustomEvent extends StubEvent {
    constructor(type, init) {
        super(type);
        this.detail = init && init.detail;
    }
 }
 // Every code the background emits on the RPC path today, read out of
 // src/background/index.js. The provider must not know this list — it passes
 // through whatever arrived — but the cases below are the real ones.
 const REJECTED = 4001; // user rejected the request
 const UNAUTHORIZED = 4100; // site not connected / wrong address
 const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
 // A stub window with the four things inpage.js touches: message listeners,
 // postMessage out to the content script, window.ethereum, and dispatchEvent
 // for the EIP-6963 announcement.
 function loadProvider() {
    const messageListeners = [];
    const posted = [];
    const win = {
        addEventListener(type, fn) {
            if (type === "message") messageListeners.push(fn);
        },
        removeEventListener(type, fn) {
            const i = messageListeners.indexOf(fn);
            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
        },
        postMessage(data) {
            posted.push(data);
        },
        dispatchEvent() {
            return true;
        },
    };
    win.window = win;
    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
    // Deliver the content script's answer to an outstanding request. The id is
    // read back off the wire rather than assumed: inpage.js issues its own
    // eth_chainId at load, so the first id a test sees is not 1.
    function respond(response) {
        const request = posted
            .filter((m) => m.type === "AUTISTMASK_REQUEST")
            .pop();
        expect(request).toBeDefined();
        const event = {
            source: win,
            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
        };
        for (const fn of messageListeners.slice()) fn(event);
    }
    return { provider: win.ethereum, posted, respond };
 }
 // Start a request, answer it with `response`, and hand back the rejection.
 // Fails the test if the call resolves instead.
 async function rejectionFrom(start, response) {
    const { provider, respond } = loadProvider();
    const settled = start(provider).then(
        (result) => ({ resolved: result }),
        (error) => ({ error }),
    );
    // The provider posts synchronously, so the request is already on the wire.
    respond(response);
    const outcome = await settled;
    expect(outcome).not.toHaveProperty("resolved");
    return outcome.error;
 }
 describe("an EIP-1193 code reaches the page", () => {
    test("a user rejection arrives as code 4001", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
    test("it is a ProviderRpcError, and an Error", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err).toBeInstanceOf(Error);
        expect(err.name).toBe("ProviderRpcError");
    });
    test("4100 unauthorized arrives intact", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
        );
        expect(err.code).toBe(UNAUTHORIZED);
        expect(err.message).toBe("Unauthorized");
    });
    test("4902 unrecognized chain arrives intact", async () => {
        const message =
            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "wallet_switchEthereumChain" }),
            { error: { code: UNRECOGNIZED_CHAIN, message } },
        );
        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
        expect(err.message).toBe(message);
    });
    // The provider is not allowed to know the list above: a code added to the
    // background later must reach the page without this file being edited.
    test("a code the provider has never heard of is passed through", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_accounts" }),
            { error: { code: 4900, message: "Disconnected" } },
        );
        expect(err.code).toBe(4900);
    });
    test("data is carried when the boundary sent it", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_call" }),
            {
                error: {
                    code: -32000,
                    message: "execution reverted",
                    data: "0x08c379a0",
                },
            },
        );
        expect(err.code).toBe(-32000);
        expect(err.data).toBe("0x08c379a0");
    });
    test("no data property is invented when the boundary sent none", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect("data" in err).toBe(false);
    });
 });
 describe("the message is untouched", () => {
    test("a coded error keeps the message byte for byte", async () => {
        const message =
            "This site asked to sign as an address that is not " +
            "the active one.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign" }),
            { error: { code: UNAUTHORIZED, message } },
        );
        expect(err.message).toBe(message);
    });
    test("an error the background sent with no code keeps its message", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err.message).toBe("No accounts available");
    });
    // A ProviderRpcError whose code is undefined would claim a conformance it
    // does not have, and `'code' in err` is exactly what a careful dApp asks.
    test("an error with no code gets no code property at all", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err).toBeInstanceOf(Error);
        expect("code" in err).toBe(false);
    });
    test("an error with no message keeps the generic fallback", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { code: REJECTED } },
        );
        expect(err.message).toBe("Request failed");
        expect(err.code).toBe(REJECTED);
    });
 });
 // Every entry point the provider exposes, not just eth_requestAccounts. They
 // all funnel through the same response listener, and this is what says so.
 describe("every request path carries the code", () => {
    const rejection = {
        error: { code: REJECTED, message: "User rejected the request." },
    };
    test("request()", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("enable()", async () => {
        const err = await rejectionFrom((p) => p.enable(), rejection);
        expect(err.code).toBe(REJECTED);
    });
    test("send(method, params)", async () => {
        const err = await rejectionFrom(
            (p) => p.send("eth_requestAccounts", []),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("send({ method, params })", async () => {
        const err = await rejectionFrom(
            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("sendAsync() hands the code to its callback", async () => {
        const { provider, respond } = loadProvider();
        const called = new Promise((resolve) => {
            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
                resolve(e),
            );
        });
        respond(rejection);
        const err = await called;
        expect(err.name).toBe("ProviderRpcError");
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
 });
 describe("the success path is unchanged", () => {
    test("a result still resolves", async () => {
        const { provider, respond } = loadProvider();
        const settled = provider.request({ method: "eth_requestAccounts" });
        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
        await expect(settled).resolves.toEqual([
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        ]);
        expect(provider.selectedAddress).toBe(
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        );
    });
 });
--- a/tests/symbolSpoof.test.js
+++ b/tests/symbolSpoof.test.js
@@ -56,7 +56,7 @@ global.chrome = {
 };
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
-const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { filterTransactions } = require("../src/shared/transactions");
 const {
    fetchTokenBalances,
@@ -284,138 +284,12 @@ describe("the shared rule: symbols that render as a known symbol", () => {
    // asserts the claim it stands for — `[ -~]` would admit an interior
    // space and let a whitespace-bearing entry through the guard.
    test("no bundled symbol is touched by the normalization", () => {
-        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
+        for (const [symbol, address] of KNOWN_SYMBOLS) {
            expect(symbol).toBe(symbol.trim());
            expect(symbol).toMatch(/^[!-~]+$/);
-            if (addresses === null) continue;
+            if (address === null) continue;
            for (const address of addresses) {
            expect(isSpoofedSymbol(symbol, address)).toBe(false);
        }
        }
    });
 });
 // Issue #276: the guard that was missing.  The suite walked KNOWN_SYMBOLS,
 // which is built from TOKENS, so it could only ever assert that the table
 // agrees with itself.  Seven symbols appear twice in the bundled list at two
 // different real contracts, and the table kept whichever came first, so the
 // other seven contracts — tokens in our own shipped list, at their own
 // addresses — were judged spoofs and hidden from the balance list, the
 // history and the send selector.  That is the over-filtering direction: it
 // hides a holding the user cannot then spend.
 //
 // This walk is over TOKENS, the data the wallet actually ships, so it fails
 // whenever a bundled token would be filtered at its own address no matter
 // which side of the table the mistake is on.
 describe("the shipped token list", () => {
    test("no bundled token is filtered at its own address", () => {
        const filtered = TOKENS.filter((t) =>
            isSpoofedSymbol(t.symbol, t.address),
        ).map((t) => t.symbol + " @ " + t.address);
        expect(filtered).toEqual([]);
    });
    // The third failure mode the issue asks about: a symbol whose table entry
    // names an address that is in neither the table nor the list would be a
    // contract we vouch for and do not ship.  There is none, and the table is
    // built from the list, so this asserts the derivation has not acquired a
    // hand-written entry.
    test("every address the table vouches for is a bundled token", () => {
        const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
            if (addresses === null) continue;
            expect(addresses.size).toBeGreaterThan(0);
            for (const address of addresses) {
                expect(address).toBe(address.toLowerCase());
                expect(bundled.has(address)).toBe(true);
                // And it is the token that actually reports that symbol.
                const token = TOKENS.find(
                    (t) => t.address.toLowerCase() === address,
                );
                expect(token.symbol.toUpperCase()).toBe(symbol);
            }
        }
    });
    // Both contracts behind a shared ticker must pass, from either side: a
    // rule that admits only the one the table happens to visit first is the
    // bug, not the fix.
    test("both contracts behind a shared ticker are admitted", () => {
        const bySymbol = new Map();
        for (const t of TOKENS) {
            const upper = t.symbol.toUpperCase();
            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
            bySymbol.get(upper).push(t);
        }
        const shared = [...bySymbol].filter(([, list]) => list.length > 1);
        // The shared tickers are a fact about the shipped data; if a future
        // list has none, this test would silently assert nothing.
        expect(shared.length).toBeGreaterThan(0);
        for (const [, list] of shared) {
            for (const t of list) {
                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
            }
        }
    });
    // The seven from issue #276, named so that the reconciliation is a fact
    // in the suite: each is two real contracts from the same source fetch,
    // and the table now holds both rather than the one that came first.
    test("the seven shared tickers each name both bundled contracts", () => {
        const expected = {
            TON: [
                "0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
                "0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
            ],
            FRAX: [
                "0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
                "0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
            ],
            REUSD: [
                "0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
                "0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
            ],
            EURE: [
                "0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
                "0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
            ],
            MSUSD: [
                "0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
                "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
            ],
            MUSD: [
                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
                "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
            ],
            JPYC: [
                "0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
                "0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
            ],
        };
        for (const [symbol, addresses] of Object.entries(expected)) {
            expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
                [...addresses].sort(),
            );
            for (const address of addresses) {
                expect(isSpoofedSymbol(symbol, address)).toBe(false);
            }
        }
    });
    // The other direction, on the same symbols: widening the table to hold
    // every bundled address for a ticker must not turn it into a pass for
    // any other contract.
    test("a shared ticker from a third contract is still a spoof", () => {
        const bySymbol = new Map();
        for (const t of TOKENS) {
            const upper = t.symbol.toUpperCase();
            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
            bySymbol.get(upper).push(t);
        }
        for (const [symbol, list] of bySymbol) {
            if (list.length < 2) continue;
            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
        }
    });
 });
--- a/tests/transactions.test.js
+++ b/tests/transactions.test.js
@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
    });
    test("USDC and WETH map to their genuine lowercased contracts", () => {
-        expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
-        expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
    });
    test("the spam fixture symbol is not in the known token list", () => {