fix: render the view "Back" lands on after the popup is reopened (closes #268)

goBack() only unhid its target. A reopened popup renders the wallet list
and the one view restoreView() lands on, so every other view is still the
blank static template from index.html: pressing Back from Settings onto an
address showed an empty address line and no balances, and the same held for
address-token, receive, confirm-tx and transaction.

The per-view dispatch and its data guards move out of restoreView() into
src/popup/viewRouter.js, and goBack() now routes a popped view through the
same code by way of a renderer index.js registers with setBackRenderer().
A view whose backing state is gone falls back to Home the way the restore
does, rather than showing an empty template.

The Back path renders only a view this page load has not rendered yet.
viewRouter.js keeps a page-load-scoped set of rendered views, written by
showView() — the last thing every render path runs, forward navigation and
the restore alike, so a view added later registers itself rather than
needing to be remembered. Back onto a view already in that set unhides it
and nothing more, exactly as it does for a view outside RESTORABLE_VIEWS:
rendering a second time would re-fetch and overwrite what the view holds,
such as an edit typed into Settings and not yet saved. Home stays the
exception and is re-rendered on every Back, as it was when goBack() called
the renderWalletList() registered through setRenderMain(), so the wallet
list reflects what changed while the user was away from it.

tests/backNavigation.test.js drives the real goBack() over the reproduction
and over each of address-token, receive, confirm-tx, transaction, success-tx
and error-tx, with and without their backing state, and pins that a view
this page load already rendered — a live-session view, or Settings revisited
— is only unhidden, while Home still re-renders. tests/e2e/run.js adds three
cases against the real popup in a real browser, because make check cannot
see a blank view: a real close and reopen then Back onto the address screen
and onto Receive, and an in-session Back onto Settings that must keep
unsaved input. All three were demonstrated failing first.

.gitea/workflows/e2e.yml

@@ -1,49 +0,0 @@
-name: e2e
-on: [push]
-
-# The browser end-to-end suites, one job per browser, deliberately kept out
-# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
-# script/cibuild is a plain `docker build .` whose Dockerfile runs
-# make check, so folding a browser suite into either would blow that cap
-# and slow the local fast path. Before this workflow every browser-level
-# guarantee in this repo held only when a human remembered to run it.
-#
-# One job per browser rather than two steps in one job, so a Chrome failure
-# does not hide the Firefox result.
-#
-# Each job is one script and nothing else. Both scripts need docker and
-# nothing else — they deliver the repo to the daemon as a build context and
-# build the extension inside the pinned image — which is what makes them
-# runnable here at all: the runner executes the job in a container against
-# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
-# by the host daemon and mounts an empty directory, and the runner image's
-# node is too old to install this repo's dependencies.
-#
-# These jobs REPORT, they do not gate. Whether a check blocks a merge is
-# Gitea branch protection, which this repo does not configure, so a failure
-# here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked on the measured
-# flake in the dApp signing wait -- two of six runs of unmutated code on a
-# loaded machine -- tracked as
-# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
-# random teaches people to merge past red.
-#
-# Nothing here may pass vacuously. There is no continue-on-error and no
-# `|| true`. Both scripts exit non-zero when docker is missing, when the
-# image build fails, and when the browser fails to start; the Chrome
-# harness aborts the suite outright if its network interception is not in
-# effect.
-jobs:
-    e2e-chrome:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e
-
-    e2e-firefox:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e-firefox

README.md

@@ -83,11 +83,10 @@ provide:
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
-- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
+- `script/test-e2e` — run the Chrome browser end-to-end suite (docker required;
-  only prerequisite: it builds a pinned image that carries the repo and a fresh
+  see [End-to-End Tests](#end-to-end-tests))
-  extension build, see [End-to-End Tests](#end-to-end-tests))
+- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (docker
-- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
+  required; builds its own pinned image, see
-  against an image with a pinned Firefox and geckodriver, see
   [End-to-End Tests](#end-to-end-tests))
 - `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
@@ -137,12 +136,11 @@ are outside `make check`.
 
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
-`mcr.microsoft.com/playwright` container (pinned by digest in
+`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
-`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
+docker is required and the suite fails loudly rather than skipping if it is
-required and the suite fails loudly rather than skipping if it is unavailable).
+unavailable). The suite lives in `tests/e2e/` and is driven by
-The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
+`playwright-core`, whose version must stay matched to the container's Playwright
-version must stay matched to the container's Playwright version — the browsers
+version — the browsers ship inside the image.
-ship inside the image.
 
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
@@ -322,46 +320,9 @@ Two limits are worth knowing, both real differences from the Chrome suite:
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
-pick it up either. Run them locally before changing anything under
+pick it up either. Neither is wired into the Gitea workflow yet —
-`src/popup/views/`.
+docker-in-docker in CI is a separate question. Run them locally before changing
-
+anything under `src/popup/views/`.
-### In CI
-
-`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
-`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
-20-second `make test` cap and the local fast path are untouched. Each job is a
-checkout and the matching `script/` entrypoint, nothing else.
-
-Docker is the only thing either job needs from the runner, and that is not an
-accident. The runner executes a job inside a container against the **host's**
-docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
-host and mounts an empty directory, and the runner image's node is too old to
-install this repo's dependencies. Both suites therefore ship the repo to the
-daemon as a build context and build the extension inside the image, which works
-identically on a laptop.
-
-The jobs **report, they do not gate.** A failure is a red mark against the
-commit that a reviewer has to account for, not a hard block: whether a check
-blocks a merge is Gitea branch protection, which this repo does not configure.
-
-That is not only a statement about configuration. The Chrome suite is
-**measurably flaky under load** — two of six runs of unmutated code on a busy
-machine lost the approval popup out from under the dApp signing wait, always in
-the `#183` section, tracked as
-[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
-has to be read before it is believed, and that flake is the blocker to ever
-making this a required check. Do not answer it with a retry wrapper: a suite
-that reruns until it is green stops being evidence.
-
-Nothing in either job can pass vacuously. There is no `continue-on-error` and no
-`|| true`; both scripts exit non-zero when docker is missing, when the image
-build fails, and when the browser fails to start; the Chrome harness aborts the
-suite outright if its network interception is not in effect.
-
-Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
-the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
-once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
-Firefox and geckodriver downloads the same way.
 
 ## Rationale
 

TODO.md

@@ -33,8 +33,7 @@ The backlog lives on the
 authoritative; this file does not duplicate it. Full policy file set present.
 Real-browser end-to-end suites (`make test-e2e` for Chrome,
 `make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
-cannot see a runtime `ReferenceError` in a popup view, and
+cannot see a runtime `ReferenceError` in a popup view.
-`.gitea/workflows/e2e.yml` runs both of them on every push.
 
 # Next Step
 
@@ -46,38 +45,6 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
-  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
-  push, separate from `check`, so `make check` and its 20-second `make test` cap
-  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
-  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
-  gate, the dApp approval round trips — was enforced only when a human
-  remembered to run it by hand. The suites could not run on the runner as they
-  stood: the runner executes a job in a container against the host's docker
-  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
-  and the runner image's node cannot install this repo's dependencies. Both
-  suites now ship the repo to the daemon as a build context and build the
-  extension inside the pinned image, so docker is the only prerequisite on a
-  runner or a laptop, and both run the image by ID rather than by tag so
-  concurrent clones cannot swap it. The jobs report rather than gate — this repo
-  configures no branch protection, and the Chrome suite is measurably flaky
-  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
-  rather than papered over
-  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
-- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
-  rebuilt every failure as `new Error(error.message)`, so the code the
-  background produced and the content script relayed intact was dropped in the
-  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
-  the user deliberately declined was indistinguishable from one that broke. The
-  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
-  boundary sent one, `data`, passed through verbatim rather than matched against
-  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
-  here. An error the background sent with no code stays a plain `Error` with no
-  `code` property, and `message` is unchanged in every case. All four request
-  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
-  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
-  now requires it on the page's Error as well as on the wire, for all four
-  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
   it. A reopened popup renders the wallet list and the one screen it restores
   onto, so every screen further down the stack was still the blank template from
@@ -387,5 +354,9 @@ tracker.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
   input validation) before any 1.0rc tag. Individual filed issues are parts of
   it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` and
+  `make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
+  suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.

script/test-e2e

@@ -7,29 +7,17 @@
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
 # a used-but-not-imported identifier blow up at runtime.
-# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
-# from check so that cap and the local fast path both stay intact.
-#
-# Docker is the only prerequisite. The repo reaches the container as a
-# build context and the extension is built inside it (see
-# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
-# on the machine that starts the run. That is not a convenience: a bind
-# mount cannot work under Gitea Actions, and the runner image's node is too
-# old to install this repo's dependencies.
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-
+#
-IIDFILE=""
+# The playwright-core devDependency is pinned to the matching Playwright
-
+# version (1.56.0) and the two must be bumped together: the browsers ship
-cleanup() {
+# inside this image, and playwright-core looks for the exact browser
-    if [ -n "$IIDFILE" ]; then
+# revision its own version expects. A mismatch fails at launch.
-        rm -f "$IIDFILE"
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
-    fi
-}
 
 main() {
     cd "$ROOT"
@@ -39,23 +27,14 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
+    echo "Building extension for e2e..."
-    trap cleanup EXIT
+    yarn run build 2>&1
-    trap 'cleanup; exit 130' INT TERM
-
-    echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # HOME=/tmp: the image's root home is not a reliable place for the
+    # --user: keep files the suite touches owned by the caller, not root.
-    #   browser profile.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
     #   the MV3 background service worker — including the phishing
@@ -72,10 +51,13 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/run.js
 }
 

script/test-e2e-firefox

@@ -5,17 +5,12 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
+# and a browser suite does not fit.
-# on every push, in a job separate from check.
 #
-# Unlike script/test-e2e this builds its base image locally, because no
+# Unlike script/test-e2e this builds its image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
 # All three external artifacts are pinned by digest inside the Dockerfile;
-# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
+# see tests/e2e/firefox/Dockerfile.
-# the extension build are baked into the image rather than mounted.
-#
-# Docker is the only prerequisite: nothing here depends on the node, yarn
-# or make on the machine that starts the run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -23,14 +18,6 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
 
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -39,20 +26,16 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
+    echo "Building extension for e2e..."
-    trap cleanup EXIT
+    yarn run build 2>&1
-    trap 'cleanup; exit 130' INT TERM
 
-    echo "Building the pinned Firefox e2e image (extension included)..."
+    # The build context is tests/e2e/firefox/ and holds nothing but the
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
+    # Dockerfile: the harness itself arrives over the bind mount below, so
-        -f tests/e2e/firefox/Dockerfile .
+    # editing it never invalidates an image layer.
+    echo "Building the pinned Firefox e2e image..."
+    docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
 
     echo "Running the Firefox e2e suite..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
     # --network none: the suite stubs nothing, so this is what keeps the
     #   run offline and deterministic. The extension swallows its own
@@ -60,8 +43,8 @@ main() {
     #   network note in README.md. Weaker than the Chrome suite's
     #   fixture interception, and honestly so — it proves no request
     #   escaped, but it cannot report which ones were attempted.
-    # HOME=/tmp: the image's root home is not a reliable place for the
+    # --user: keep files the suite touches owned by the caller, not root.
-    #   browser profile.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     #
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
@@ -69,8 +52,11 @@ main() {
     docker run --rm \
         --shm-size=1g \
         --network none \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/firefox/run.js dist/firefox
 }
 

src/content/inpage.js

@@ -11,39 +11,6 @@
     let nextId = 1;
     const pending = {};
 
-    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
-    // rather than properties bolted onto an Error because this object crosses
-    // no boundary after construction — it is built in the page's own realm and
-    // handed straight to the caller's catch — so the prototype survives and
-    // `error.name` is a stable thing for a dApp to see.
-    class ProviderRpcError extends Error {
-        constructor(code, message, data) {
-            super(message);
-            this.name = "ProviderRpcError";
-            this.code = code;
-            if (data !== undefined) this.data = data;
-        }
-    }
-
-    // Rebuild a boundary error as the error the page catches, carrying the
-    // code (and data) the extension reported. Without this a dApp cannot tell
-    // a user's refusal (4001) from a wallet that broke, and retries or shows
-    // an error instead of accepting the refusal.
-    //
-    // Whatever code arrived is passed through verbatim rather than being
-    // matched against a list: the extension emits 4001, 4100 and 4902 today,
-    // and a code this file has never heard of is still the truth about what
-    // happened. An error reported with no code at all stays a plain Error —
-    // a ProviderRpcError whose `code` is undefined would advertise a
-    // conformance it does not have. `message` is untouched in every case.
-    function toPageError(error) {
-        const message = (error && error.message) || "Request failed";
-        if (error && error.code !== undefined && error.code !== null) {
-            return new ProviderRpcError(error.code, message, error.data);
-        }
-        return new Error(message);
-    }
-
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -53,7 +20,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
         } else {
             p.resolve(result);
         }

tests/e2e/Dockerfile

@@ -1,34 +0,0 @@
-# Chrome end-to-end image: the pinned Playwright image with this repo and a
-# freshly built extension inside it, built by script/test-e2e. The suite is
-# still started with `docker run`, so every runtime flag the harness needs
-# (--ipc=host in particular) applies as before.
-#
-# The repo is baked in rather than bind-mounted because a bind mount does
-# not resolve under Gitea Actions: the runner runs the job in a container
-# against the HOST's docker socket, so the source side of a -v is resolved
-# by the host daemon while the job's checkout lives on a docker volume that
-# is not a host path -- the mount silently succeeds and /work is empty. A
-# build context is streamed to the daemon and so works from anywhere.
-# Building the extension here too means the machine starting a run needs
-# docker and nothing else.
-
-# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-#
-# The playwright-core devDependency is pinned to the matching Playwright
-# version (1.56.0) and the two must be bumped together: the browsers ship
-# inside this image, and playwright-core looks for the exact browser
-# revision its own version expects. A mismatch fails at launch.
-FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
-
-WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build

tests/e2e/firefox/Dockerfile

@@ -1,24 +1,10 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
-# with this repo and a freshly built extension inside it, built by
+# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
-# script/test-e2e-firefox. The harness itself has no dependencies, so
+# harness itself has no dependencies, so nothing is installed for it.
-# nothing is installed for it.
 #
-# The build context is the repo root. The repo is baked in rather than
+# All three external artifacts are pinned by digest. The Firefox version in
-# bind-mounted because a bind mount does not resolve under Gitea Actions:
+# particular must not float: -remote-allow-system-access is mandatory on 153
-# the runner runs the job in a container against the HOST's docker socket,
+# and was not on 142, so the flag the harness passes is version-coupled.
-# so the source side of a -v is resolved by the host daemon while the job's
-# checkout lives on a docker volume that is not a host path -- the mount
-# silently succeeds and /work is empty. Baking the build in is also the
-# only way this suite can have both a built extension and the
-# `--network none` it runs under, since a container with no network cannot
-# install anything.
-#
-# All three external artifacts are pinned by digest, and are fetched in
-# layers above the repo copy, so editing the harness or any source file
-# re-runs only the two cheap layers at the bottom. The Firefox version in
-# particular must not float: -remote-allow-system-access is mandatory on
-# 153 and was not on 142, so the flag the harness passes is
-# version-coupled.
 
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
@@ -62,16 +48,4 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 
 WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build
-
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]

tests/e2e/network.js

@@ -86,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records the whole observable shape of the error as it
+// The rejection branch records `code` as it arrives. EIP-1193 says a user
-// arrives — name, message, and whether a `code` is present at all as distinct
+// rejection is a ProviderRpcError carrying code 4001; what the page can
-// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// actually see is recorded here rather than assumed, and asserted in run.js.
-// carrying code 4001; what the page can actually see is recorded here rather
-// than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -122,7 +120,6 @@ const DAPP_HTML = [
     "                    return {",
     "                        settled: 'rejected',",
     "                        message: String((error && error.message) || error),",
-    "                        name: error ? error.name : undefined,",
     "                        hasCode: !!error && 'code' in Object(error),",
     "                        code: error ? error.code : undefined,",
     "                    };",

tests/e2e/run.js

@@ -1757,14 +1757,15 @@ async function lastResponseError(page) {
 }
 
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and EIP-1193 code 4001 is present both
+// rather than hanging or resolving, and the response that crossed the
-// on the wire and on the Error the calling page catches.
+// boundary carried EIP-1193 code 4001.
 //
-// Both ends matter because they used to disagree. The code crossed the
+// The code is asserted on the wire because that is the only place it
-// boundary correctly and src/content/inpage.js then threw it away, rebuilding
+// survives. src/content/inpage.js rebuilds the rejection as `new
-// every rejection as `new Error(error.message)` — so a dApp branching on
+// Error(error.message)`, so the Error the calling page catches carries the
-// `err.code === 4001` saw undefined and could not tell a refusal from a
+// message and no code. That is reported rather than asserted either way —
-// failure (#274). Asserting only the wire would leave that gap invisible.
+// locking in the current behaviour would make the gap permanent, and
+// asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
     const outcome = await settleRequest(page, key);
     assert(
@@ -1786,32 +1787,15 @@ async function assertUserRejection(page, key, label) {
             " did not carry EIP-1193 code 4001 across the boundary: " +
             JSON.stringify(error),
     );
-    assert(
-        outcome.hasCode,
-        label +
-            " reached the page as an error with no code property at all, so a " +
-            "dApp cannot tell the user's refusal from a failure: " +
-            JSON.stringify(outcome),
-    );
-    assert(
-        outcome.code === 4001,
-        label +
-            " reached the page with code " +
-            JSON.stringify(outcome.code) +
-            " rather than EIP-1193 4001",
-    );
-    assert(
-        outcome.name === "ProviderRpcError",
-        label +
-            " reached the page as " +
-            JSON.stringify(outcome.name) +
-            " rather than an EIP-1193 ProviderRpcError",
-    );
     console.log(
         "# " +
             label +
-            ": code 4001 on the wire and on the page's " +
+            ": boundary code=" +
-            outcome.name,
+            error.code +
+            " page Error.code=" +
+            JSON.stringify(outcome.code) +
+            " page Error carries a code=" +
+            outcome.hasCode,
     );
     return outcome;
 }

tests/inpageErrors.test.js

@@ -1,310 +0,0 @@
-// The EIP-1193 error the page actually catches (src/content/inpage.js).
-//
-// The bug this pins down (issue #274): the provider rebuilt every failure as
-// `new Error(error.message)`, so the `code` the background produced and the
-// content script relayed intact was thrown away in the last hop. A dApp
-// checking `err.code === 4001` — the standard way to tell "the user said no"
-// from "the wallet broke" — saw undefined, and well-behaved sites showed an
-// error or retried instead of accepting the refusal.
-//
-// inpage.js is a bare IIFE injected into the page's JS context, not a module:
-// it takes no import and exports nothing, and reaches for `window` at load.
-// So it is evaluated here the way the browser evaluates it, against a stub
-// window, and the provider is collected from `window.ethereum`. The globals it
-// touches are passed in as function parameters rather than assigned to
-// globalThis: nothing leaks between tests, and the source is compiled in this
-// realm, so the errors it constructs are comparable against this file's own
-// `Error` — which a second realm's intrinsics would silently defeat.
-//
-// There is no jsdom in this repo; see tests/txStatus.test.js.
-
-const fs = require("fs");
-const path = require("path");
-const { webcrypto } = require("crypto");
-
-const SOURCE = fs.readFileSync(
-    path.join(__dirname, "..", "src", "content", "inpage.js"),
-    "utf8",
-);
-
-const loadInto = new Function(
-    "window",
-    "self",
-    "crypto",
-    "Event",
-    "CustomEvent",
-    SOURCE,
-);
-
-class StubEvent {
-    constructor(type) {
-        this.type = type;
-    }
-}
-
-class StubCustomEvent extends StubEvent {
-    constructor(type, init) {
-        super(type);
-        this.detail = init && init.detail;
-    }
-}
-
-// Every code the background emits on the RPC path today, read out of
-// src/background/index.js. The provider must not know this list — it passes
-// through whatever arrived — but the cases below are the real ones.
-const REJECTED = 4001; // user rejected the request
-const UNAUTHORIZED = 4100; // site not connected / wrong address
-const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
-
-// A stub window with the four things inpage.js touches: message listeners,
-// postMessage out to the content script, window.ethereum, and dispatchEvent
-// for the EIP-6963 announcement.
-function loadProvider() {
-    const messageListeners = [];
-    const posted = [];
-
-    const win = {
-        addEventListener(type, fn) {
-            if (type === "message") messageListeners.push(fn);
-        },
-        removeEventListener(type, fn) {
-            const i = messageListeners.indexOf(fn);
-            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
-        },
-        postMessage(data) {
-            posted.push(data);
-        },
-        dispatchEvent() {
-            return true;
-        },
-    };
-    win.window = win;
-
-    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
-
-    // Deliver the content script's answer to an outstanding request. The id is
-    // read back off the wire rather than assumed: inpage.js issues its own
-    // eth_chainId at load, so the first id a test sees is not 1.
-    function respond(response) {
-        const request = posted
-            .filter((m) => m.type === "AUTISTMASK_REQUEST")
-            .pop();
-        expect(request).toBeDefined();
-        const event = {
-            source: win,
-            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
-        };
-        for (const fn of messageListeners.slice()) fn(event);
-    }
-
-    return { provider: win.ethereum, posted, respond };
-}
-
-// Start a request, answer it with `response`, and hand back the rejection.
-// Fails the test if the call resolves instead.
-async function rejectionFrom(start, response) {
-    const { provider, respond } = loadProvider();
-    const settled = start(provider).then(
-        (result) => ({ resolved: result }),
-        (error) => ({ error }),
-    );
-    // The provider posts synchronously, so the request is already on the wire.
-    respond(response);
-    const outcome = await settled;
-    expect(outcome).not.toHaveProperty("resolved");
-    return outcome.error;
-}
-
-describe("an EIP-1193 code reaches the page", () => {
-    test("a user rejection arrives as code 4001", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-
-    test("it is a ProviderRpcError, and an Error", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect(err.name).toBe("ProviderRpcError");
-    });
-
-    test("4100 unauthorized arrives intact", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
-            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
-        );
-        expect(err.code).toBe(UNAUTHORIZED);
-        expect(err.message).toBe("Unauthorized");
-    });
-
-    test("4902 unrecognized chain arrives intact", async () => {
-        const message =
-            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "wallet_switchEthereumChain" }),
-            { error: { code: UNRECOGNIZED_CHAIN, message } },
-        );
-        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
-        expect(err.message).toBe(message);
-    });
-
-    // The provider is not allowed to know the list above: a code added to the
-    // background later must reach the page without this file being edited.
-    test("a code the provider has never heard of is passed through", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_accounts" }),
-            { error: { code: 4900, message: "Disconnected" } },
-        );
-        expect(err.code).toBe(4900);
-    });
-
-    test("data is carried when the boundary sent it", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_call" }),
-            {
-                error: {
-                    code: -32000,
-                    message: "execution reverted",
-                    data: "0x08c379a0",
-                },
-            },
-        );
-        expect(err.code).toBe(-32000);
-        expect(err.data).toBe("0x08c379a0");
-    });
-
-    test("no data property is invented when the boundary sent none", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect("data" in err).toBe(false);
-    });
-});
-
-describe("the message is untouched", () => {
-    test("a coded error keeps the message byte for byte", async () => {
-        const message =
-            "This site asked to sign as an address that is not " +
-            "the active one.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign" }),
-            { error: { code: UNAUTHORIZED, message } },
-        );
-        expect(err.message).toBe(message);
-    });
-
-    test("an error the background sent with no code keeps its message", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err.message).toBe("No accounts available");
-    });
-
-    // A ProviderRpcError whose code is undefined would claim a conformance it
-    // does not have, and `'code' in err` is exactly what a careful dApp asks.
-    test("an error with no code gets no code property at all", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect("code" in err).toBe(false);
-    });
-
-    test("an error with no message keeps the generic fallback", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { code: REJECTED } },
-        );
-        expect(err.message).toBe("Request failed");
-        expect(err.code).toBe(REJECTED);
-    });
-});
-
-// Every entry point the provider exposes, not just eth_requestAccounts. They
-// all funnel through the same response listener, and this is what says so.
-describe("every request path carries the code", () => {
-    const rejection = {
-        error: { code: REJECTED, message: "User rejected the request." },
-    };
-
-    test("request()", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("enable()", async () => {
-        const err = await rejectionFrom((p) => p.enable(), rejection);
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send(method, params)", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send("eth_requestAccounts", []),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send({ method, params })", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("sendAsync() hands the code to its callback", async () => {
-        const { provider, respond } = loadProvider();
-        const called = new Promise((resolve) => {
-            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
-                resolve(e),
-            );
-        });
-        respond(rejection);
-        const err = await called;
-        expect(err.name).toBe("ProviderRpcError");
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-});
-
-describe("the success path is unchanged", () => {
-    test("a result still resolves", async () => {
-        const { provider, respond } = loadProvider();
-        const settled = provider.request({ method: "eth_requestAccounts" });
-        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
-        await expect(settled).resolves.toEqual([
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        ]);
-        expect(provider.selectedAddress).toBe(
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        );
-    });
-});