fix: answer the page when a background handler throws (closes #280)

handleRpc(...).then(sendResponse) had no .catch(), and sendResponse is the only
thing that settles the dApp's window.ethereum.request() promise. Any throw
inside handleRpc therefore sent nothing back: the content script posted nothing,
and the page's promise stayed pending forever with no error and no timeout,
indistinguishable from a slow wallet. handleRpc does real work -- state loads,
provider calls, transaction population, approval plumbing -- so "it does not
throw today" was not a property anyone was maintaining.

A rejected handleRpc now answers { code: -32603, message }. -32603 is the
JSON-RPC internal error EIP-1474 defines and EIP-1193 defers to for RPC-layer
failures; no EIP-1193 4xxx code describes "the wallet broke" and none was
invented for it. The cause is not put in the message: the page gets a stable
sentence, the background console gets the method and the throw, so the failure
is visible rather than swallowed.

The two async IIFEs behind AUTISTMASK_TX_RESPONSE and AUTISTMASK_SIGN_RESPONSE
are the same shape one level down. Every statement is inside a try, but a throw
from one of the catch blocks escapes as an unhandled rejection and neither the
popup nor the page is answered. Each gets a last-resort .catch() that settles
the approval through settleApproval() -- the existing chokepoint, with no new
delete or resolve -- and answers the popup. The transaction one reports the
broadcast stage, because it cannot tell whether the transaction reached the
network and that is the wording that does not invite a second send. Every other
message handler on the path is synchronous and cannot leave a promise pending.

Each of the three is driven by a real failure rather than a hook in the handler:
a rejecting extension-storage read, which getState() awaits unguarded, and a
failure classifier that throws while classifying a genuine verification failure.
All three were demonstrated failing against the unfixed code, the RPC one with
sendResponse at zero calls, which is precisely the page-side hang.

README.md

@@ -638,21 +638,6 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 
-A reopened popup renders the wallet list and the one screen it restores onto,
-and nothing else, so every screen on the stack behind that one is still the
-blank template from `index.html`. "Back" therefore renders its target rather
-than only unhiding it, through the same dispatch and data guards as the restore
-(`src/popup/viewRouter.js`), and falls back to Home when the state the target
-would render is gone.
-
-It renders only a screen this page load has not rendered yet. Forward navigation
-renders as it goes, and `viewRouter.js` records every screen that reaches
-`showView()`, so "Back" onto a screen already on the page unhides it and nothing
-more — rendering it a second time would re-fetch and overwrite what it holds,
-such as an edit typed into Settings and not yet saved. Home is the one screen
-"Back" always re-renders, so the wallet list reflects anything that changed
-while the user was away from it.
-
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret

TODO.md

@@ -45,18 +45,25 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-14: Approving a site connection is no longer a race against the popup
-  closing. The decision now rides the approval port the popup already holds,
-  which is the same channel the close disconnects, so it is delivered ahead of
-  that disconnect however fast the teardown is; `windows.onRemoved` no longer
-  decides a site approval whose port is connected, since that event is ordered
-  against nothing either. Rejecting and closing without deciding both still
-  report a rejection, and the popup delays its own close by nothing. The e2e
-  harness's deferred-`window.close()` accommodation is gone with it, so the two
-  site-prompt tests now drive the shipped decide-then-close in a real Chromium;
-  against the unfixed code the approval came back to the page as
-  `{"settled":"rejected","code":4001}`
-  ([#275](https://git.eeqj.de/sneak/AutistMask/issues/275)).
+- 2026-08-14: A background message handler that throws now rejects the page
+  instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
+  and `sendResponse` is the only thing that settles the dApp's
+  `window.ethereum.request()` promise — so any throw inside `handleRpc` left
+  that promise pending forever, with no error and no timeout, indistinguishable
+  from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
+  internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
+  describes "the wallet broke" and none was invented) and logs the method and
+  the throw to the background console rather than swallowing them. The two async
+  IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
+  same shape one level down — every statement inside a `try`, but a throw out of
+  a `catch` block escaping unhandled — and each got a last-resort `.catch()`
+  settling the approval through `settleApproval()` and answering the popup; the
+  transaction one reports the broadcast stage, because it cannot tell whether
+  the transaction reached the network. Every other handler on the path is
+  synchronous. All three are driven by real failures — a rejecting storage read,
+  and a failure classifier that throws while classifying a genuine verification
+  failure — and were demonstrated failing first, the RPC one with `sendResponse`
+  at zero calls ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the
@@ -71,23 +78,6 @@ undefined identifiers, which is how
   `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
   now requires it on the page's Error as well as on the wire, for all four
   rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
-- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
-  it. A reopened popup renders the wallet list and the one screen it restores
-  onto, so every screen further down the stack was still the blank template from
-  `index.html`, and Back walked straight onto it — an empty address, no
-  balances, no QR code. The Back path now goes through the same per-view
-  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
-  with `restoreView()`), falling back to Home when the state the target would
-  render is gone. It renders only a view this page load has not rendered yet:
-  `viewRouter.js` records every view that reaches `showView()`, which is where
-  forward navigation and the restore both end, so Back onto a view already on
-  the page unhides it and nothing more. That is what keeps a second render from
-  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
-  a transaction list already loaded. Home is the exception and is always
-  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
-  and by three end-to-end cases against the real popup, each demonstrated
-  failing on the unfixed build
-  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
   that bear it, not to one of them. A ticker is not unique: seven of the 512
   bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —

src/background/index.js

@@ -57,6 +57,16 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
+// What the page is told when a request failed in a way the wallet has no
+// specific answer for. -32603 is the JSON-RPC internal error EIP-1474 defines
+// and EIP-1193 defers to for RPC-layer failures; no EIP-1193 4xxx code
+// describes "the wallet broke", and one is not invented here. The cause is
+// logged rather than put in the message: the page gets a stable sentence, the
+// background console gets the throw.
+const INTERNAL_ERROR_CODE = -32603;
+const INTERNAL_ERROR_MESSAGE =
+    "AutistMask could not complete this request because of an internal error.";
+
 async function getState() {
     const result = await storageApi.get("autistmask");
     return (
@@ -279,50 +289,13 @@ function requestSignApproval(origin, hostname, signParams, approvedFrom) {
     });
 }
 
-// Anything only the extension's own pages may say. A content script speaks
-// with the page's URL, so this is what separates the popup from the site the
-// popup is being asked about.
-function isExtensionSender(sender) {
-    const extUrl = runtime.getURL("");
-    return !!(sender && sender.url && sender.url.startsWith(extUrl));
-}
-
-// The approval popup's port: it carries the user's decision on a
-// site-connection approval, and its disconnect is how that approval learns the
-// popup closed without one.
-//
-// The decision travels this port rather than a one-off runtime.sendMessage()
-// for exactly one reason: the port is also what the popup's window.close()
-// disconnects. A message posted on a port is delivered before that port's
-// disconnect, so approve-then-close settles as an approval no matter how fast
-// the teardown is. Sent as a one-off message the two crossed on independent
-// channels with nothing ordering them, and the teardown won every time when
-// the prompt was driven in a tab: the user approved and the dApp was told they
-// had refused.
-//
-// TX and sign approvals do not decide here. They stay pending across a
-// disconnect — the user can reopen the toolbar popup — and are rejected by the
-// windowsApi.onRemoved listener below.
+// Detect when an approval popup (browser-action) closes without a response.
+// TX and sign approvals now use windows.create() and are handled by the
+// windowsApi.onRemoved listener below, but we still handle site-connection
+// approval disconnects here.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
-        if (pendingApprovals[id]) {
-            // This approval has a popup that can speak for it, so its
-            // disconnect is a trustworthy "closed"; see onRemoved below.
-            pendingApprovals[id].portConnected = true;
-        }
-        port.onMessage.addListener((msg) => {
-            if (!msg || msg.type !== "AUTISTMASK_APPROVAL_DECISION") return;
-            if (!isExtensionSender(port.sender)) return;
-            const approval = pendingApprovals[id];
-            if (!approval || approval.type === "tx" || approval.type === "sign")
-                return;
-            settleApproval(id, {
-                approved: !!msg.approved,
-                remember: !!msg.remember,
-            });
-            resetPopupUrl();
-        });
         port.onDisconnect.addListener(() => {
             const approval = pendingApprovals[id];
             if (approval) {
@@ -869,32 +842,20 @@ startBackgroundJobs();
 // window is an ordinary event with an attempt already in flight behind it.
 // settleApproval() refuses those, which leaves the attempt to report its real
 // outcome to the page.
-//
-// A site-connection approval whose popup connected its port is not decided
-// here. That popup approves and closes in the same breath, and this event
-// races the decision on a channel of its own — the same race the port exists
-// to end. Its port disconnect says the same thing this event does, in an order
-// that is defined, so the disconnect is left to say it. The window closing
-// before any port connected is the one case with nothing else to speak for it,
-// and is rejected here so the dApp is not left waiting on a window that is
-// gone.
 if (windowsApi && windowsApi.onRemoved) {
     windowsApi.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const isSite = approval.type !== "tx" && approval.type !== "sign";
-            if (isSite && approval.portConnected) continue;
-            settleApproval(
-                id,
-                isSite
-                    ? { approved: false, remember: false }
-                    : {
+            const rejection =
+                approval.type === "tx" || approval.type === "sign"
+                    ? {
                           error: {
                               code: 4001,
                               message: "User rejected the request.",
                           },
-                      },
-            );
+                      }
+                    : { approved: false, remember: false };
+            settleApproval(id, rejection);
         }
     });
 }
@@ -914,24 +875,43 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // keep fallback
             }
         }
-        handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
+        handleRpc(msg.method, msg.params, trustedOrigin)
+            .then((response) => {
                 sendResponse(response);
+            })
+            .catch((err) => {
+                // Without this the page's window.ethereum.request() promise
+                // stays pending forever: no response is sent, the content
+                // script posts nothing back, and the dApp cannot tell the
+                // failure from a slow wallet. handleRpc does real work —
+                // state loads, provider calls, transaction population — so
+                // "it does not throw today" is not a property anyone is
+                // maintaining.
+                log.errorf("RPC request failed:", msg.method, err);
+                sendResponse({
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                });
             });
         return true;
     }
 
     // Validate that popup-only messages originate from the extension itself.
-    // The site-connection decision is not here: it is a port message, and it
-    // is checked the same way where the port is served.
     const POPUP_ONLY_TYPES = [
         "AUTISTMASK_GET_APPROVAL",
+        "AUTISTMASK_APPROVAL_RESPONSE",
         "AUTISTMASK_TX_RESPONSE",
         "AUTISTMASK_SIGN_RESPONSE",
     ];
-    if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
+    if (POPUP_ONLY_TYPES.includes(msg.type)) {
+        const extUrl = runtime.getURL("");
+        if (!sender.url || !sender.url.startsWith(extUrl)) {
             sendResponse({ error: "Unauthorized sender" });
             return false;
         }
+    }
 
     if (msg.type === "AUTISTMASK_GET_APPROVAL") {
         const approval = pendingApprovals[msg.id];
@@ -962,6 +942,15 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         return false;
     }
 
+    if (msg.type === "AUTISTMASK_APPROVAL_RESPONSE") {
+        settleApproval(msg.id, {
+            approved: msg.approved,
+            remember: msg.remember,
+        });
+        resetPopupUrl();
+        return false;
+    }
+
     if (msg.type === "AUTISTMASK_TX_RESPONSE") {
         const approval = pendingApprovals[msg.id];
         if (!approval) return false;
@@ -1089,7 +1078,31 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     stage: TX_STAGE_BROADCAST,
                 });
             }
-        })();
+        })().catch((e) => {
+            // Every statement above is inside a try, but a throw from one of
+            // the catch blocks escapes as an unhandled rejection and neither
+            // the popup nor the page is ever answered. Settle both, through
+            // the same chokepoint as every other retirement. The stage is
+            // broadcast because this cannot tell whether the transaction
+            // reached the network, and that is the wording that does not
+            // invite a second send.
+            log.errorf("transaction approval response failed:", e);
+            settleApproval(
+                msg.id,
+                {
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                },
+                { holdsClaim: true },
+            );
+            sendResponse({
+                error: INTERNAL_ERROR_MESSAGE,
+                retryable: false,
+                stage: TX_STAGE_BROADCAST,
+            });
+        });
         return true;
     }
 
@@ -1173,7 +1186,25 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 }
                 sendResponse({ error: errMsg, retryable });
             }
-        })();
+        })().catch((e) => {
+            // Same shape as the transaction path: a throw out of the catch
+            // block above would leave the popup and the page both waiting.
+            log.errorf("sign approval response failed:", e);
+            settleApproval(
+                msg.id,
+                {
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                },
+                { holdsClaim: true },
+            );
+            sendResponse({
+                error: INTERNAL_ERROR_MESSAGE,
+                retryable: false,
+            });
+        });
         return true;
     }
 

src/popup/index.js

@@ -9,17 +9,16 @@ const {
     $,
     showView,
     updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
     pushCurrentView,
     goBack,
     clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Renders a view the popup lands on without having navigated to it forward:
-// on restore here, and on Back. Only the views that can be fully re-rendered
-// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
-// through it; anything else falls back to the nearest restorable parent.
-const { renderView, makeBackRenderer } = require("./viewRouter");
+// Views that can be fully re-rendered from persisted state. All others fall
+// back to the nearest restorable parent; see the module for why the
+// secret-bearing views are absent.
+const { RESTORABLE_VIEWS } = require("./restorableViews");
 
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -109,23 +108,92 @@ const ctx = {
     },
 };
 
-// The view modules the router renders through, keyed as it expects them.
-const viewModules = {
-    main: { show: () => fallbackView() },
-    addressDetail,
-    addressToken,
-    receive,
-    settings,
-    settingsAddToken,
-    confirmTx,
-    transactionDetail,
-    txStatus,
-};
+function needsAddress(view) {
+    return (
+        view === "address" ||
+        view === "address-token" ||
+        view === "receive" ||
+        view === "transaction"
+    );
+}
+
+function hasValidAddress() {
+    return (
+        state.selectedWallet !== null &&
+        state.selectedAddress !== null &&
+        state.wallets[state.selectedWallet] &&
+        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
+    );
+}
 
 function restoreView() {
-    if (!renderView(state.currentView, state, viewModules)) {
+    const view = state.currentView;
+    if (!view || !RESTORABLE_VIEWS.has(view)) {
+        return fallbackView();
+    }
+
+    if (needsAddress(view) && !hasValidAddress()) {
+        return fallbackView();
+    }
+
+    if (view === "address-token" && !state.selectedToken) {
+        return fallbackView();
+    }
+
+    switch (view) {
+        case "address":
+            addressDetail.show();
+            break;
+        case "address-token":
+            addressToken.show();
+            break;
+        case "receive":
+            receive.show();
+            break;
+        case "settings":
+            settings.show();
+            break;
+        case "settings-addtoken":
+            settingsAddToken.show();
+            break;
+        case "confirm-tx":
+            if (state.viewData && state.viewData.pendingTx) {
+                confirmTx.restore();
+            } else {
                 fallbackView();
             }
+            break;
+        case "transaction":
+            if (state.viewData && state.viewData.tx) {
+                transactionDetail.render();
+            } else {
+                fallbackView();
+            }
+            break;
+        case "wait-tx":
+            // Resumes the receipt poll from the persisted broadcast time.
+            if (!txStatus.restoreWait()) {
+                fallbackView();
+            }
+            break;
+        case "success-tx":
+            if (state.viewData && state.viewData.hash) {
+                txStatus.renderSuccess();
+            } else {
+                fallbackView();
+            }
+            break;
+        case "error-tx":
+            if (state.viewData && state.viewData.message) {
+                txStatus.renderError();
+            } else {
+                fallbackView();
+            }
+            break;
+        default:
+            fallbackView();
+            break;
+    }
 }
 
 function fallbackView() {
@@ -179,7 +247,7 @@ async function init() {
         settings.show();
     });
 
-    setBackRenderer(makeBackRenderer(state, viewModules));
+    setRenderMain(renderWalletList);
 
     welcome.init(ctx);
     addWallet.init(ctx);

src/popup/viewRouter.js

@@ -1,167 +0,0 @@
-// Rendering a view the popup lands on without having navigated to it
-// forward: on restore, and on Back. In both cases the view may never have
-// been rendered in this page load — a reopened popup renders only the
-// wallet list and the view it restores onto, so every other view is still
-// the blank static template from index.html — so unhiding it is not enough.
-//
-// Forward navigation renders as it goes and must NOT come through here:
-// rendering a second time would re-fetch and clobber whatever the view has
-// in flight.
-//
-// The view modules are injected and nothing here touches the DOM, so the
-// dispatch and its data guards can be tested directly; src/popup/index.js
-// cannot be required outside a browser.
-
-const { RESTORABLE_VIEWS } = require("./restorableViews");
-
-// The views this page load has rendered.
-//
-// The Back path cannot otherwise tell its two cases apart. A view the popup
-// never rendered is still the blank template from index.html and has to be
-// rendered; a view already on the page must NOT be rendered again, because
-// a second render re-fetches and overwrites whatever the user has typed
-// into it and not yet saved.
-//
-// Registration is showView() in views/helpers.js, which is the last thing
-// every render path runs — restoreView()'s, the Back path's, and every
-// forward show(). That is the point of putting it there rather than in the
-// individual views: a view added later registers itself with no one having
-// to remember it, so this cannot decay.
-//
-// Module scope is page-load scope: the popup loads this module once per
-// page load, and a reopened popup gets a fresh, empty set — which is
-// exactly the state that makes the Back path render.
-const renderedViews = new Set();
-
-function markViewRendered(view) {
-    if (view) renderedViews.add(view);
-}
-
-// Begin a fresh page-load scope. The popup gets one by being loaded; the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one.
-function resetRenderedViews() {
-    renderedViews.clear();
-}
-
-// Home is the exception: Back re-renders it every time, which is what the
-// popup did before this router existed (index.js registered
-// renderWalletList() as setRenderMain(), and goBack() called it on every
-// Back onto "main"). It must stay that way — the wallet list has to reflect
-// what changed while the user was away from it, such as a wallet renamed or
-// an address removed in Settings — and Home holds no unsaved input to lose.
-const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
-
-// Views that render an address the user picked and cannot be rendered
-// without one.
-const ADDRESS_VIEWS = new Set([
-    "address",
-    "address-token",
-    "receive",
-    "transaction",
-]);
-
-function needsAddress(view) {
-    return ADDRESS_VIEWS.has(view);
-}
-
-function hasValidAddress(state) {
-    return Boolean(
-        state.selectedWallet !== null &&
-        state.selectedAddress !== null &&
-        state.wallets[state.selectedWallet] &&
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
-    );
-}
-
-// Render `view` from persisted state. Each view module shows itself, so a
-// true return means the view is both rendered and on screen.
-//
-// Returns false when the view is not one the popup renders from state, or
-// when the state it would render is gone — a token no longer selected, a
-// transaction no longer persisted. The caller falls back rather than
-// putting an empty template on screen.
-function renderView(view, state, views) {
-    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
-    if (needsAddress(view) && !hasValidAddress(state)) return false;
-    if (view === "address-token" && !state.selectedToken) return false;
-
-    const data = state.viewData || {};
-    switch (view) {
-        case "main":
-            views.main.show();
-            return true;
-        case "address":
-            views.addressDetail.show();
-            return true;
-        case "address-token":
-            views.addressToken.show();
-            return true;
-        case "receive":
-            views.receive.show();
-            return true;
-        case "settings":
-            views.settings.show();
-            return true;
-        case "settings-addtoken":
-            views.settingsAddToken.show();
-            return true;
-        case "confirm-tx":
-            if (!data.pendingTx) return false;
-            views.confirmTx.restore();
-            return true;
-        case "transaction":
-            if (!data.tx) return false;
-            views.transactionDetail.render();
-            return true;
-        case "wait-tx":
-            // Resumes the receipt poll from the persisted broadcast time,
-            // and answers false when there is nothing resumable left.
-            return Boolean(views.txStatus.restoreWait());
-        case "success-tx":
-            if (!data.hash) return false;
-            views.txStatus.renderSuccess();
-            return true;
-        case "error-tx":
-            if (!data.message) return false;
-            views.txStatus.renderError();
-            return true;
-        default:
-            return false;
-    }
-}
-
-// The Back-path renderer, registered with setBackRenderer() in
-// views/helpers.js.
-//
-// Returns false — leaving goBack() to unhide the view, as it always did —
-// in the two cases where the view is known to be on the page already:
-//
-//   - It is not one the popup renders from persisted state. The restored
-//     stack is filtered against RESTORABLE_VIEWS, so such a view can only
-//     be on the stack from this page load, where forward navigation
-//     rendered it on the way in.
-//   - This page load has rendered it. Re-rendering would re-fetch and
-//     clobber what it holds; Home is rendered anyway, see above.
-//
-// What is left is the case the router exists for: a view on the stack that
-// this page load has never rendered, whose template is still blank.
-function makeBackRenderer(state, views) {
-    return function renderBack(view) {
-        if (!RESTORABLE_VIEWS.has(view)) return false;
-        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
-            return false;
-        }
-        if (!renderView(view, state, views)) {
-            views.main.show();
-        }
-        return true;
-    };
-}
-
-module.exports = {
-    renderView,
-    makeBackRenderer,
-    markViewRendered,
-    resetRenderedViews,
-};

src/popup/views/approval.js

@@ -441,7 +441,7 @@ function showSignApproval(details) {
 
 function show(id) {
     approvalId = id;
-    approvalPort = runtime.connect({ name: "approval:" + id });
+    runtime.connect({ name: "approval:" + id });
     runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
         if (!details) {
             window.close();
@@ -470,14 +470,6 @@ function show(id) {
 }
 
 let approvalId = null;
-// The port this approval was opened on. Closing this window disconnects it,
-// and the background treats that disconnect as "closed without deciding" for a
-// site connection — so the decision goes out on this same port and not as a
-// one-off message. One channel is ordered: a message posted on it is delivered
-// before its own disconnect, however immediately the close follows. Two
-// channels were not, and the close won, reporting a user who approved as
-// having refused.
-let approvalPort = null;
 let pendingTxDetails = null;
 // The exact objects shown to the user, kept so the popup signs what it
 // displayed rather than re-fetching or re-populating anything at approval
@@ -545,20 +537,6 @@ function clearSignPassword() {
     hideError("approve-sign-error");
 }
 
-// Answer a site-connection approval and close. The decision goes out on the
-// approval port — see approvalPort above for why — and carries no approval id,
-// because the port name already names the approval the background will settle.
-function decideSite(approved) {
-    if (approvalPort) {
-        approvalPort.postMessage({
-            type: "AUTISTMASK_APPROVAL_DECISION",
-            approved,
-            remember: $("approve-remember").checked,
-        });
-    }
-    window.close();
-}
-
 function init(ctx) {
     onViewLeave("approve-tx", clearTxPassword);
     onViewLeave("approve-sign", clearSignPassword);
@@ -569,11 +547,25 @@ function init(ctx) {
     });
 
     $("btn-approve").addEventListener("click", () => {
-        decideSite(true);
+        const remember = $("approve-remember").checked;
+        runtime.sendMessage({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: true,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-reject").addEventListener("click", () => {
-        decideSite(false);
+        const remember = $("approve-remember").checked;
+        runtime.sendMessage({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: false,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-approve-tx").addEventListener("click", async () => {

src/popup/views/helpers.js

@@ -7,7 +7,6 @@ const {
     getAddressValueUsd,
 } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -77,10 +76,6 @@ function showView(name) {
     }
     clearFlash();
     state.currentView = name;
-    // A view's show() ends here, so this is where the Back path learns the
-    // view is no longer the blank template from index.html and must not be
-    // rendered a second time. See viewRouter.js.
-    markViewRendered(name);
     saveState();
     updateDebugBanner(name);
 }
@@ -116,19 +111,12 @@ function updateDebugBanner(viewName) {
     }
 }
 
-// Callback that renders a view being navigated BACK onto. Set once by
-// index.js via setBackRenderer(), which routes the view through the same
-// per-view render and data guards restoreView() uses.
-//
-// It answers true when it took the navigation — the view is rendered and
-// shown, or its backing data was gone and it fell back — and false for a
-// view the popup does not render from persisted state. Those can only be
-// on the stack from this page load, because the stack is filtered on load,
-// so they have already been rendered and only need unhiding.
-let _renderBack = null;
+// Callback to re-render the main/home view when navigating back to it.
+// Set once by index.js via setRenderMain().
+let _renderMain = null;
 
-function setBackRenderer(fn) {
-    _renderBack = fn;
+function setRenderMain(fn) {
+    _renderMain = fn;
 }
 
 // Push the current view onto the navigation stack so goBack() can
@@ -148,11 +136,9 @@ function goBack() {
     } else {
         target = "main";
     }
-    // A popped view is landed on, not navigated to. If the popup has been
-    // closed and reopened since the view was pushed, nothing has ever
-    // rendered it in this page load and its template is still blank, so it
-    // has to be rendered here rather than merely unhidden.
-    if (_renderBack && _renderBack(target)) return;
+    if (target === "main" && _renderMain) {
+        _renderMain();
+    }
     showView(target);
 }
 
@@ -484,7 +470,7 @@ module.exports = {
     showView,
     onViewLeave,
     updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
     pushCurrentView,
     goBack,
     clearViewStack,

tests/backNavigation.test.js

@@ -1,329 +0,0 @@
-// Back after reopening the popup (#268).
-//
-// A reopened popup renders the wallet list and the one view it restores
-// onto; every other view is still the blank static template from
-// index.html. goBack() used to only unhide its target, so Back landed on
-// that blank template for any view the popup had not rendered in this page
-// load. These tests drive the real goBack() with the real router wired to
-// recording view modules, so what is asserted is which view render ran —
-// the thing that was missing.
-//
-// The rendering itself is asserted against the real popup in a real
-// browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
-// only needs showView() to work.
-
-const els = new Map();
-
-function fakeEl() {
-    return {
-        textContent: "",
-        innerHTML: "",
-        classList: {
-            toggle() {},
-            add() {},
-            remove() {},
-            contains: () => false,
-        },
-        remove() {},
-    };
-}
-
-globalThis.document = {
-    getElementById(id) {
-        if (!els.has(id)) els.set(id, fakeEl());
-        return els.get(id);
-    },
-};
-
-// helpers.js pulls in state.js, which reads chrome.storage.local at load.
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const {
-    showView,
-    goBack,
-    setBackRenderer,
-    pushCurrentView,
-} = require("../src/popup/views/helpers");
-const {
-    makeBackRenderer,
-    markViewRendered,
-    resetRenderedViews,
-} = require("../src/popup/viewRouter");
-const { state } = require("../src/shared/state");
-
-const ADDRESS = "0x1111111111111111111111111111111111111111";
-const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
-
-let calls;
-
-// Stand-ins for the view modules. Each records itself and then shows its
-// view, which is what every real view render ends with — so the assertions
-// can tell "rendered and shown" apart from "merely unhidden".
-function recorder(name, view) {
-    return () => {
-        calls.push(name);
-        showView(view);
-    };
-}
-
-function makeViews() {
-    return {
-        main: { show: recorder("main", "main") },
-        addressDetail: { show: recorder("addressDetail", "address") },
-        addressToken: { show: recorder("addressToken", "address-token") },
-        receive: { show: recorder("receive", "receive") },
-        settings: { show: recorder("settings", "settings") },
-        settingsAddToken: {
-            show: recorder("settingsAddToken", "settings-addtoken"),
-        },
-        confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
-        transactionDetail: {
-            render: recorder("transactionDetail", "transaction"),
-        },
-        txStatus: {
-            restoreWait: () => {
-                calls.push("waitTx");
-                showView("wait-tx");
-                return true;
-            },
-            renderSuccess: recorder("successTx", "success-tx"),
-            renderError: recorder("errorTx", "error-tx"),
-        },
-    };
-}
-
-// The popup as it stands just after a reopen: one wallet with one address,
-// the view the popup restored onto, and the stack behind it.
-//
-// A reopen is a fresh page load, so the record of what has been rendered
-// starts empty — that emptiness is what makes the Back path render at all.
-// Returns the view modules so a test can drive forward navigation through
-// the same recorders the router renders through.
-function reopenedOn(view, stack, extra) {
-    calls = [];
-    resetRenderedViews();
-    state.wallets = [
-        {
-            name: "Wallet 1",
-            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
-        },
-    ];
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    state.selectedToken = null;
-    state.viewData = null;
-    state.currentView = view;
-    state.viewStack = stack.slice();
-    Object.assign(state, extra || {});
-    // Restoring onto a view renders it, so the reopened popup has that one
-    // view on the page and nothing else.
-    markViewRendered(view);
-    const views = makeViews();
-    setBackRenderer(makeBackRenderer(state, views));
-    return views;
-}
-
-// The reproduction from the issue, step for step.
-describe("Back onto a view the reopened popup never rendered", () => {
-    test("Back from settings renders the address detail underneath", () => {
-        reopenedOn("settings", ["main", "address"]);
-        goBack();
-        expect(calls).toEqual(["addressDetail"]);
-        expect(state.currentView).toBe("address");
-        expect(state.viewStack).toEqual(["main"]);
-    });
-
-    test("Back onto the token detail renders it", () => {
-        reopenedOn("settings", ["main", "address", "address-token"], {
-            selectedToken: TOKEN,
-        });
-        goBack();
-        expect(calls).toEqual(["addressToken"]);
-        expect(state.currentView).toBe("address-token");
-    });
-
-    test("Back onto Receive renders it", () => {
-        reopenedOn("settings", ["main", "address", "receive"]);
-        goBack();
-        expect(calls).toEqual(["receive"]);
-        expect(state.currentView).toBe("receive");
-    });
-
-    test("Back onto the transaction detail renders it", () => {
-        reopenedOn("settings", ["main", "transaction"], {
-            viewData: { tx: { hash: "0xdead" } },
-        });
-        goBack();
-        expect(calls).toEqual(["transactionDetail"]);
-        expect(state.currentView).toBe("transaction");
-    });
-
-    test("Back onto the transaction confirmation restores it", () => {
-        reopenedOn("settings", ["main", "confirm-tx"], {
-            viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
-        });
-        goBack();
-        expect(calls).toEqual(["confirmTx"]);
-        expect(state.currentView).toBe("confirm-tx");
-    });
-
-    test("Back onto the success screen renders it", () => {
-        reopenedOn("settings", ["main", "success-tx"], {
-            viewData: { hash: "0xdead" },
-        });
-        goBack();
-        expect(calls).toEqual(["successTx"]);
-        expect(state.currentView).toBe("success-tx");
-    });
-
-    test("Back onto the failure screen renders it", () => {
-        reopenedOn("settings", ["main", "error-tx"], {
-            viewData: { message: "execution reverted" },
-        });
-        goBack();
-        expect(calls).toEqual(["errorTx"]);
-        expect(state.currentView).toBe("error-tx");
-    });
-
-    test("Back onto Home renders the wallet list", () => {
-        reopenedOn("settings", ["main"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("Back with an empty stack renders Home", () => {
-        reopenedOn("settings", []);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-});
-
-// The guards are restoreView()'s, so a popped view whose backing data is
-// gone lands on Home rather than on an empty template.
-describe("Back onto a view whose backing data is gone", () => {
-    test("the token detail with no token selected falls back to Home", () => {
-        reopenedOn("settings", ["main", "address-token"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("the transaction detail with no transaction falls back to Home", () => {
-        reopenedOn("settings", ["main", "transaction"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("the confirmation with no pending transaction falls back to Home", () => {
-        reopenedOn("settings", ["main", "confirm-tx"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("an address view with no address selected falls back to Home", () => {
-        reopenedOn("settings", ["main", "receive"], {
-            selectedAddress: null,
-        });
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("the success screen with no transaction hash falls back to Home", () => {
-        reopenedOn("settings", ["main", "success-tx"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("the failure screen with no message falls back to Home", () => {
-        reopenedOn("settings", ["main", "error-tx"]);
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-
-    test("a wait that can no longer be resumed falls back to Home", () => {
-        reopenedOn("settings", ["main", "wait-tx"]);
-        const views = makeViews();
-        views.txStatus.restoreWait = () => false;
-        setBackRenderer(makeBackRenderer(state, views));
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-});
-
-// Forward navigation renders as it goes, and a second render would re-fetch
-// and clobber whatever the view holds — an unsaved edit, a request in
-// flight. So the Back path renders only a view this page load has never
-// rendered, and merely unhides every other one: the views it does not
-// render from persisted state, and the views already on the page.
-describe("what the Back path leaves alone", () => {
-    test("forward navigation renders nothing by itself", () => {
-        reopenedOn("address", ["main"]);
-        pushCurrentView();
-        showView("send");
-        expect(calls).toEqual([]);
-        expect(state.viewStack).toEqual(["main", "address"]);
-    });
-
-    test("Back onto a live-session view only unhides it", () => {
-        reopenedOn("confirm-tx", ["main", "address", "send"]);
-        goBack();
-        expect(calls).toEqual([]);
-        expect(state.currentView).toBe("send");
-    });
-
-    test("Back renders its target exactly once", () => {
-        reopenedOn("settings", ["main", "address"]);
-        goBack();
-        expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
-    });
-
-    test("Back onto a view this page load already rendered only unhides it", () => {
-        const views = reopenedOn("main", []);
-        pushCurrentView();
-        views.addressDetail.show();
-        pushCurrentView();
-        views.settings.show();
-        calls = [];
-        goBack();
-        expect(calls).toEqual([]);
-        expect(state.currentView).toBe("address");
-    });
-
-    // The unit mirror of the regression the browser suite pins: Settings
-    // reassigns its fields from persisted state on every render, so a
-    // re-render on the way back discards an edit the user has not saved.
-    test("Back onto Settings visited earlier in this page load does not re-render it", () => {
-        const views = reopenedOn("main", []);
-        pushCurrentView();
-        views.settings.show();
-        pushCurrentView();
-        views.settingsAddToken.show();
-        calls = [];
-        goBack();
-        expect(calls).toEqual([]);
-        expect(state.currentView).toBe("settings");
-    });
-
-    // Home is the deliberate exception, unchanged from the popup's
-    // behaviour before the router existed: it re-renders on every Back so
-    // the wallet list reflects what changed while the user was away.
-    test("Back onto Home renders it again even when it is already on the page", () => {
-        const views = reopenedOn("main", []);
-        pushCurrentView();
-        views.addressDetail.show();
-        calls = [];
-        goBack();
-        expect(calls).toEqual(["main"]);
-        expect(state.currentView).toBe("main");
-    });
-});

tests/backgroundApproval.test.js

@@ -32,21 +32,6 @@ const ORIGIN = "https://dapp.example";
 const HOSTNAME = "dapp.example";
 const EXT_URL = "chrome-extension://autistmask/";
 
-// An origin the persisted state has never allowed, so asking to connect from
-// it raises a prompt rather than being answered from allowedSites.
-const FRESH_ORIGIN = "https://fresh.example";
-
-// The approval id in the most recent popup URL of a list, or null when none
-// of them carries one. Takes both shapes: the absolute URL windows.create()
-// is given and the extension-relative one action.setPopup() is given.
-function approvalIdIn(urls) {
-    for (let i = urls.length - 1; i >= 0; i--) {
-        if (!urls[i] || !urls[i].includes("?approval=")) continue;
-        return new URL(urls[i], EXT_URL).searchParams.get("approval");
-    }
-    return null;
-}
-
 // What the dApp asks for: no nonce, no gas, no fees. This is the shape that
 // makes a duplicate broadcast possible at all.
 const TX_PARAMS = {
@@ -148,6 +133,14 @@ function loadBackground(options) {
         ensureRecurringAlarms: jest.fn(async () => {}),
         registerAlarmHandlers: jest.fn(),
     }));
+    // The real verification module, except where a test replaces one export
+    // with a throw to drive the handler's own error handling into failing.
+    if (opts.approvalVerify) {
+        jest.doMock("../src/shared/approvalVerify", () => ({
+            ...jest.requireActual("../src/shared/approvalVerify"),
+            ...opts.approvalVerify,
+        }));
+    }
 
     const persisted = {
         wallets: [
@@ -161,18 +154,16 @@ function loadBackground(options) {
 
     let messageListener = null;
     let windowRemovedListener = null;
-    let connectListener = null;
     const created = [];
     const removed = [];
-    // Every URL the background put on the browser action. A site approval
-    // raised through action.openPopup() opens no window at all, so this is
-    // the only place its id appears.
-    const actionPopups = [];
 
     global.chrome = {
         storage: {
             local: {
-                get: jest.fn(async () => ({ autistmask: persisted })),
+                get: jest.fn(
+                    opts.storageGet ||
+                        (async () => ({ autistmask: persisted })),
+                ),
                 set: jest.fn(async () => {}),
             },
         },
@@ -183,14 +174,7 @@ function loadBackground(options) {
                     messageListener = fn;
                 },
             },
-            // Captured, not swallowed: the approval port is what carries a
-            // site connection's decision and the popup teardown that races
-            // it, so a no-op stub here hides the whole subject of #275.
-            onConnect: {
-                addListener: (fn) => {
-                    connectListener = fn;
-                },
-            },
+            onConnect: { addListener: () => {} },
             lastError: null,
         },
         windows: {
@@ -216,17 +200,7 @@ function loadBackground(options) {
             query: (q, cb) => cb([]),
             sendMessage: () => {},
         },
-        action: {
-            setPopup: (o) => {
-                actionPopups.push(o.popup);
-            },
-            // The production route for a site connection. Present only when
-            // a test asks for it, because with it the prompt is the toolbar
-            // popup: no window is created, so windows.onRemoved can never
-            // fire for it and the port disconnect is the only close signal
-            // that exists.
-            ...(opts.actionPopup ? { openPopup: () => Promise.resolve() } : {}),
-        },
+        action: { setPopup: () => {} },
     };
 
     require("../src/background/index");
@@ -285,70 +259,6 @@ function loadBackground(options) {
         };
     }
 
-    // A dApp asking to connect. The origin defaults to one the persisted
-    // state has never allowed, so the request really does raise a prompt
-    // instead of being answered from allowedSites.
-    function requestSite(origin) {
-        let rpcResult = null;
-        messageListener(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "eth_requestAccounts",
-                params: [],
-            },
-            { origin: origin || FRESH_ORIGIN },
-            (r) => {
-                rpcResult = r;
-            },
-        );
-        return {
-            // Wherever the prompt went: the toolbar popup URL when
-            // action.openPopup() carried it, the created window otherwise.
-            id: () =>
-                approvalIdIn(actionPopups) ||
-                approvalIdIn(created.map((c) => c.url)),
-            result: () => rpcResult,
-        };
-    }
-
-    // The popup's approval port, as the browser delivers it. Messages posted
-    // on a port and that port's disconnect travel one channel in FIFO order,
-    // which is exactly the property the fix rests on, so this stub delivers
-    // them in the order the caller emits them and never reorders them.
-    function connectApproval(id, senderUrl) {
-        const onMessage = [];
-        const onDisconnect = [];
-        const port = {
-            name: "approval:" + id,
-            sender: {
-                url:
-                    senderUrl === undefined
-                        ? EXT_URL + "src/popup/index.html?approval=" + id
-                        : senderUrl,
-            },
-            onMessage: { addListener: (fn) => onMessage.push(fn) },
-            onDisconnect: { addListener: (fn) => onDisconnect.push(fn) },
-        };
-        connectListener(port);
-        return {
-            decide: (approved, remember) => {
-                for (const fn of onMessage) {
-                    fn(
-                        {
-                            type: "AUTISTMASK_APPROVAL_DECISION",
-                            approved,
-                            remember: !!remember,
-                        },
-                        port,
-                    );
-                }
-            },
-            disconnect: () => {
-                for (const fn of onDisconnect) fn(port);
-            },
-        };
-    }
-
     // The user closes the approval popup. `created` is index-aligned with the
     // ids the window stub hands back, so window 1 is the first popup opened.
     function closeWindow(windowId) {
@@ -359,8 +269,6 @@ function loadBackground(options) {
         send,
         requestTx,
         requestSign,
-        requestSite,
-        connectApproval,
         closeWindow,
         broadcastTransaction,
         loadState,
@@ -383,6 +291,25 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// Node aborts the worker process on an unhandled rejection; an extension
+// service worker does not — the promise is simply never settled, nothing is
+// sent back, and the page's window.ethereum.request() waits forever. Recording
+// them instead of dying on them keeps that difference visible: the assertion
+// that the page WAS answered is what reports the failure, and the recording is
+// asserted empty alongside it.
+const unhandledRejections = [];
+process.on("unhandledRejection", (reason) => {
+    unhandledRejections.push(reason);
+});
+
+// Node reports an unhandled rejection on the macrotask turn after the promise
+// was left unhandled, which is past everything settle() waits for.
+async function settleIncludingRejections() {
+    await settle();
+    await new Promise((resolve) => setImmediate(resolve));
+    await new Promise((resolve) => setImmediate(resolve));
+}
+
 afterEach(() => {
     delete global.chrome;
     jest.resetModules();
@@ -1137,6 +1064,147 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 });
 
+// A handler that throws must still answer. `sendResponse` is the only thing
+// that settles the page's window.ethereum.request() promise, so a throw that
+// escapes a handler leaves that promise pending forever — no error, no
+// timeout, indistinguishable from a slow wallet. Each case below drives a real
+// throw out of a handler rather than asserting the catch block exists.
+describe("a handler that throws still settles the page", () => {
+    const INTERNAL_ERROR = {
+        code: -32603,
+        message:
+            "AutistMask could not complete this request because of an internal error.",
+    };
+
+    let errorLog;
+    beforeEach(() => {
+        errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
+        unhandledRejections.length = 0;
+    });
+    afterEach(() => {
+        errorLog.mockRestore();
+    });
+
+    // getState() awaits extension storage unguarded, and every read path in
+    // handleRpc goes through it. A storage read that rejects is the whole
+    // failure — no hook in the handler itself.
+    test("a rejected handleRpc rejects the page instead of hanging it", async () => {
+        const bg = loadBackground({
+            storageGet: async () => {
+                throw new Error("storage unavailable");
+            },
+        });
+
+        const answer = bg.send(
+            { type: "AUTISTMASK_RPC", method: "eth_accounts", params: [] },
+            { origin: ORIGIN },
+        );
+        await settleIncludingRejections();
+
+        // The channel is held open for the async answer, and the answer
+        // arrives.
+        expect(answer.kept).toBe(true);
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR,
+        });
+        expect(unhandledRejections).toEqual([]);
+        // Not swallowed: the throw is on the background console, which is how
+        // this class gets caught in future.
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "RPC request failed:",
+            "eth_accounts",
+            expect.objectContaining({ message: "storage unavailable" }),
+        );
+    });
+
+    // The transaction response handler wraps every statement in a try, so what
+    // escapes it is a throw from inside one of its catch blocks. Here the
+    // failure classifier itself throws while classifying a real verification
+    // failure — the approval is left claimed, so nothing else can settle it.
+    test("a throw while handling a failed transaction settles both the page and the popup", async () => {
+        const bg = loadBackground({
+            approvalVerify: {
+                describeTxFailure: () => {
+                    throw new Error("classifier broke");
+                },
+            },
+        });
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        // A real verification failure: the artifact is signed at a nonce the
+        // approval never displayed.
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE + 1),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settleIncludingRejections();
+
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR.message,
+            retryable: false,
+            // The handler cannot tell whether the transaction reached the
+            // network, so the popup must not say "start again from the site".
+            stage: "broadcast",
+        });
+        expect(unhandledRejections).toEqual([]);
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "transaction approval response failed:",
+            expect.objectContaining({ message: "classifier broke" }),
+        );
+    });
+
+    test("a throw while handling a failed signature settles both the page and the popup", async () => {
+        const bg = loadBackground({
+            approvalVerify: {
+                failureIsRetryable: () => {
+                    throw new Error("classifier broke");
+                },
+            },
+        });
+        const pending = bg.requestSign();
+        await settle();
+
+        // A real verification failure: the active address moved after the
+        // approval was raised.
+        bg.setActiveAddress(other.address);
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_SIGN_RESPONSE",
+                id: pending.id(),
+                approved: true,
+                signature: await signer.signMessage(
+                    Buffer.from(MESSAGE.slice(2), "hex"),
+                ),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settleIncludingRejections();
+
+        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR.message,
+            retryable: false,
+        });
+        expect(unhandledRejections).toEqual([]);
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "sign approval response failed:",
+            expect.objectContaining({ message: "classifier broke" }),
+        );
+    });
+});
+
 describe("popup-only messages", () => {
     test("a page sender cannot answer an approval", async () => {
         const bg = loadBackground();
@@ -1161,136 +1229,3 @@ describe("popup-only messages", () => {
         });
     });
 });
-
-// A site connection decided in a popup that closes on the next line.
-//
-// The decision and the teardown are two events the popup emits back to back,
-// and the background must not be able to reach different outcomes depending on
-// which of them it processes first. It cannot, because they are now one
-// channel: the decision is posted on the approval port that the close then
-// disconnects, so it is delivered first. Every test here therefore emits the
-// close IMMEDIATELY after the decision, with nothing awaited in between —
-// which is what the popup does, and what used to report a user who approved as
-// having refused (#275).
-describe("a site connection decided as the popup closes", () => {
-    // The production route: chrome.action.openPopup() put the prompt in the
-    // toolbar popup, which is not a window, so nothing but the port
-    // disconnect can tell the background this prompt is gone.
-    test("approving in the toolbar popup connects the site", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-        const id = pending.id();
-        expect(id).toBeTruthy();
-        expect(bg.created).toHaveLength(0);
-
-        const port = bg.connectApproval(id);
-        port.decide(true, false);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({ result: [signer.address] });
-    });
-
-    test("closing the toolbar popup without deciding is a rejection", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    test("rejecting is a rejection, and the close that follows adds nothing", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        port.decide(false, false);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The port carries a decision now, so it carries the sender check the
-    // one-off message used to carry. A content script that guessed an
-    // approval id must not be able to connect the site it is running on.
-    test("a decision from a page sender is ignored, and the close rejects", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id(), FRESH_ORIGIN + "/x.html");
-        port.decide(true, true);
-        await settle();
-        expect(pending.result()).toBeNull();
-
-        port.disconnect();
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The fallback shape, where openPopup() is unavailable and the prompt is
-    // a window the extension opened. Closing it fires windows.onRemoved as
-    // well, on a channel of its own that is ordered against nothing — so the
-    // window event must not be allowed to decide a site approval either.
-    test("approving in the fallback window survives the window event too", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-        expect(bg.created).toHaveLength(1);
-
-        const port = bg.connectApproval(pending.id());
-        port.decide(true, false);
-        bg.closeWindow(1);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({ result: [signer.address] });
-    });
-
-    // Same shape, and the same window event arriving before the popup has
-    // said anything at all — which is a user closing the window rather than
-    // deciding, and still has to reach the dApp as a rejection.
-    test("closing the fallback window without deciding is a rejection", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        bg.closeWindow(1);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The net under the paragraph above: a prompt whose page never got as far
-    // as connecting the port has no disconnect to reject it, so the window
-    // event has to. Otherwise the dApp waits forever on a window that is gone.
-    test("a window that closes before its popup ever connected still rejects", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-});

tests/e2e/run.js

@@ -419,172 +419,6 @@ test("reopening the popup never lands on the phrase screen (#161)", async (env)
     assertWiped(st, env.phrase, "after reopening the popup");
 });
 
-// ------------------------------- Back after reopening the popup (#268)
-
-// A reopened popup renders the wallet list and the view it restores onto,
-// and nothing else: every other screen is still the blank static template
-// from index.html. Back used to only unhide its target, which is why these
-// have to run against the real popup — the template is present and
-// well-formed, so only its emptiness distinguishes the defect, and only a
-// real reopen produces it.
-
-// Everything the address screen must have on it, read out of the DOM.
-function addressScreenState(page) {
-    return page.evaluate(() => {
-        const line = document.getElementById("address-line");
-        const balances = document.getElementById("address-balances");
-        return {
-            hidden: document
-                .getElementById("view-address")
-                .classList.contains("hidden"),
-            line: line ? line.innerText.trim() : "",
-            balances: balances ? balances.innerText.trim() : "",
-        };
-    });
-}
-
-// Close and reopen the page rather than reload it: that is what the toolbar
-// popup does, and it is the only thing that produces the unrendered views.
-async function reopenPopup(env, restoredView) {
-    await env.page.close();
-    env.page = await openPopup(env.ctx, env.popupUrl);
-    await visible(env.page, restoredView);
-}
-
-// The reproduction from the issue, step for step.
-test("Back after reopening the popup renders the address screen (#268)", async (env) => {
-    await openAddressDetail(env.page);
-    const before = await addressScreenState(env.page);
-    assert(
-        before.line.length > 0,
-        "the address screen was blank to begin with",
-    );
-
-    await env.page.click("#btn-settings");
-    await visible(env.page, "#view-settings");
-
-    await reopenPopup(env, "#view-settings");
-
-    await env.page.click("#btn-settings-back");
-    await visible(env.page, "#view-address");
-
-    const after = await addressScreenState(env.page);
-    assert(
-        after.line === before.line,
-        "the address line reads " +
-            JSON.stringify(after.line) +
-            ", expected " +
-            JSON.stringify(before.line),
-    );
-    assert(
-        after.balances.includes("ETH"),
-        "the balances read " + JSON.stringify(after.balances),
-    );
-});
-
-// The same defect one screen further in. Receive holds the address twice
-// over — as text and as the QR code the sender scans — and a blank one is
-// worse than a missing screen.
-// Everything the Receive screen must have on it. The QR code is read as
-// pixels, not as an element: the blank template carries the canvas too, a
-// default 300x150 one with nothing drawn on it and every pixel fully
-// transparent. A drawn QR paints an opaque background across the whole
-// canvas, so a single opaque pixel is the whole question.
-function receiveScreenState(page) {
-    return page.evaluate(() => {
-        const block = document.getElementById("receive-address-block");
-        const canvas = document.getElementById("receive-qr");
-        const px = canvas
-            .getContext("2d")
-            .getImageData(0, 0, canvas.width, canvas.height).data;
-        let opaque = 0;
-        for (let i = 3; i < px.length; i += 4) {
-            if (px[i] > 0) opaque += 1;
-        }
-        return {
-            address: block.dataset.full || "",
-            text: block.innerText.trim(),
-            qrOpaquePixels: opaque,
-        };
-    });
-}
-
-test("Back after reopening the popup renders the Receive screen (#268)", async (env) => {
-    await openAddressDetail(env.page);
-    await env.page.click("#btn-receive");
-    await visible(env.page, "#view-receive");
-    const before = await receiveScreenState(env.page);
-    assert(
-        /^0x[0-9a-fA-F]{40}$/.test(before.address),
-        "Receive showed no address to begin with: " +
-            JSON.stringify(before.address),
-    );
-
-    await env.page.click("#btn-settings");
-    await visible(env.page, "#view-settings");
-
-    await reopenPopup(env, "#view-settings");
-
-    await env.page.click("#btn-settings-back");
-    await visible(env.page, "#view-receive");
-
-    const shown = await receiveScreenState(env.page);
-    assert(
-        shown.address === before.address,
-        "Receive shows " +
-            JSON.stringify(shown.address) +
-            ", expected " +
-            JSON.stringify(before.address),
-    );
-    assert(
-        shown.text.includes(before.address),
-        "the Receive address is not on screen: " + JSON.stringify(shown.text),
-    );
-    assert(shown.qrOpaquePixels > 0, "Receive shows an unpainted QR code");
-
-    // Leave the suite where it found it.
-    await env.page.click("#btn-receive-back");
-    await visible(env.page, "#view-address");
-    await env.page.click("#btn-address-back");
-    await visible(env.page, "#view-main");
-});
-
-// The other half of the requirement: Back renders a screen this page load
-// never rendered, and must NOT re-render one it already has on screen.
-// settings.show() reassigns #settings-rpc from persisted state, so
-// re-rendering Settings on the way back would silently revert whatever the
-// user typed and had not saved yet — and they could then press Save and
-// store the value they believed they had replaced. No reopen here: this is
-// an ordinary in-session forward-and-back, which is exactly why the render
-// must not happen.
-test("Back onto Settings keeps unsaved input (#268)", async (env) => {
-    await visible(env.page, "#view-main");
-    await env.page.click("#btn-settings");
-    await visible(env.page, "#view-settings");
-
-    const typed = "https://rpc.example.invalid/unsaved";
-    await env.page.fill("#settings-rpc", typed);
-
-    await env.page.click("#btn-settings-add-token");
-    await visible(env.page, "#view-settings-addtoken");
-    await env.page.click("#btn-settings-addtoken-back");
-    await visible(env.page, "#view-settings");
-
-    const kept = await env.page.inputValue("#settings-rpc");
-    assert(
-        kept === typed,
-        "the unsaved RPC URL reads " +
-            JSON.stringify(kept) +
-            ", expected " +
-            JSON.stringify(typed),
-    );
-
-    // Leave the suite where it found it. The typed value was never saved,
-    // and Settings reloads the field from state next time it renders.
-    await env.page.click("#btn-settings-back");
-    await visible(env.page, "#view-main");
-});
-
 // -------------------------------------------- address removal (#162)
 
 // Number of address rows across every wallet in the list, counted in the DOM
@@ -1596,13 +1430,32 @@ async function reserveApprovalTab(env) {
     // one down with it.
     env.approvalTab = await env.ctx.newPage();
 
-    // This tab runs the shipped popup with nothing patched. The site
-    // approval buttons decide and then close on the next line, and the two
-    // site-approval tests below are therefore the real-browser
-    // approve-then-immediate-close and reject-then-immediate-close cases: the
-    // decision rides the approval port, which also carries the disconnect the
-    // close causes, so it is delivered ahead of it and the outcome does not
-    // depend on the teardown timing (#275).
+    // The one accommodation this section makes to the shipped code, and the
+    // reason for it.
+    //
+    // Both approval buttons call runtime.sendMessage() and then window.close()
+    // on the next line. Closing this page disconnects the approval port, and
+    // the disconnect handler in src/background/index.js settles a pending
+    // site approval as a rejection. In a tab those two race and the teardown
+    // wins: the approve message is never acted on, and the page is told the
+    // user rejected. Measured — with the close left in place the approval
+    // resolves as a rejection every time; with it deferred it resolves as an
+    // approval every time.
+    //
+    // It is deferred, not removed: the harness closes the page itself once
+    // the outcome has been observed, which is what window.close() would have
+    // done, only after the message it was racing has been processed.
+    //
+    // This affects the site-connection prompt only. The sign and transaction
+    // prompts run in windows the extension opens itself, with window.close()
+    // untouched, and their disconnect handler deliberately keeps a tx or sign
+    // approval pending rather than rejecting it — so there is no race there
+    // to accommodate. Whether the same ordering holds in a real toolbar popup
+    // is not observable from a headless harness and is reported rather than
+    // assumed either way.
+    await env.approvalTab.addInitScript(() => {
+        window.close = function () {};
+    });
     await env.approvalTab.goto("about:blank");
     await sleep(APPROVAL_TAB_SETTLE_MS);
     return env.approvalTab;
@@ -1651,28 +1504,6 @@ async function closeApprovalPages(ctx) {
     }
 }
 
-// Click a button whose own handler closes the window it lives in — every
-// Reject, and Allow on the site prompt.
-//
-// page.click() dispatches the click and then waits for the renderer to
-// acknowledge it, and a page torn down by the handler never gets to. The
-// dispatch is what the test needs and the log shows it happening ("performing
-// click action") immediately before the failure; the page going away is the
-// button working, not the click failing. Observed on #btn-reject-sign and
-// #btn-reject-tx, whose windows have always closed themselves.
-//
-// This swallows nothing that matters: a click that did not land leaves the
-// dApp promise unsettled and the assertion after the call still fails. A
-// button that is missing or unclickable raises a different error, which is
-// rethrown.
-async function clickAndClose(page, selector) {
-    try {
-        await page.click(selector);
-    } catch (e) {
-        if (!String((e && e.message) || e).includes("has been closed")) throw e;
-    }
-}
-
 // Record every message the approval window sends to the background worker.
 //
 // This is the direct observation the password check needs. It is installed
@@ -1893,7 +1724,7 @@ test("eth_requestAccounts rejected at the prompt returns a rejection (#183)", as
         // origin in deniedSites and every later test in this section is
         // auto-rejected with no prompt at all, which would look like a pass.
         await popup.uncheck("#approve-remember");
-        await clickAndClose(popup, "#btn-reject");
+        await popup.click("#btn-reject");
 
         await assertUserRejection(
             env.dapp,
@@ -1924,7 +1755,7 @@ test("eth_requestAccounts approved returns the selected address (#183)", async (
         // does not, and the sign and transaction tests below all require the
         // origin to still be authorized.
         await popup.check("#approve-remember");
-        await clickAndClose(popup, "#btn-approve");
+        await popup.click("#btn-approve");
 
         outcome = await settleRequest(env.dapp, "accounts");
     } finally {
@@ -2032,7 +1863,7 @@ test("personal_sign rejected returns a rejection to the page (#183)", async (env
     ]);
     const popup = await waitForApprovalWindow(env.ctx);
     await visible(popup, "#view-approve-sign");
-    await clickAndClose(popup, "#btn-reject-sign");
+    await popup.click("#btn-reject-sign");
 
     await assertUserRejection(
         env.dapp,
@@ -2135,7 +1966,7 @@ test("eth_signTypedData_v4 rejected returns a rejection to the page (#183)", asy
     ]);
     const popup = await waitForApprovalWindow(env.ctx);
     await visible(popup, "#view-approve-sign");
-    await clickAndClose(popup, "#btn-reject-sign");
+    await popup.click("#btn-reject-sign");
 
     await assertUserRejection(
         env.dapp,
@@ -2293,7 +2124,7 @@ test("eth_sendTransaction rejected broadcasts nothing (#183)", async (env) => {
     ]);
     const popup = await waitForApprovalWindow(env.ctx);
     await visible(popup, "#view-approve-tx");
-    await clickAndClose(popup, "#btn-reject-tx");
+    await popup.click("#btn-reject-tx");
 
     await assertUserRejection(
         env.dapp,