refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)

Every call site that touched `browser.*` or `chrome.*` now goes through
`src/shared/browserApi.js`, the only file in the tree that names either.
It exposes lazily-resolved namespace handles for events and synchronous
methods, and promise-returning wrappers for everything that is
callback-shaped on Chrome. Callers await; `runtime.lastError` is gone,
folded into the rejection the wrapper produces on the Chrome path.

`storageGet()` and `storageSet()` reject where `storage.local` is
absent. They carry the wallet: resolving `{}` would make an existing
wallet read back as no wallet, and a no-op write would discard the
user's state with nothing logged. The one caller that genuinely
degrades, `src/shared/phishingDomains.js`, takes `storageLocal()`
directly and keeps its own null check.

The Firefox suite gains the four dApp round trips the issue's definition
of done asks for — `eth_requestAccounts`, `personal_sign`,
`eth_sendTransaction`, and a closed approval window rejecting with
EIP-1193 4001 — driven through the real content script, background page
and approval windows. `--network none` was thought to rule that out
because it leaves no `http://` origin to inject into; loopback survives
it, so the page and a JSON-RPC node are served from 127.0.0.1 inside the
container and the run still reaches nothing but itself.

That harness refutes the premise it was built to verify. On Firefox
153.0.3, `browser.*` honours a trailing Chrome-style callback and does
populate `runtime.lastError`, both measured directly, and all four flows
pass against the unconverted code. So this is a uniformity and coverage
change, not a repair of a broken target; the PR records the measurement
in full, and the comments in `browserApi.js` and the Firefox suite say
that rather than the refuted claim.

An unhandled promise rejection fails a run on both harnesses, measured
by throwing past the first await of the unawaited `approval.show()`:
Firefox reports it from the console-service drain and Chrome as a
`pageerror`. README.md records the demonstration.

One real defect is fixed on the way past: the window id written back
into a pending approval after `windows.create()` was unguarded, so an
approval settled during the open — an address switch will do it —
dereferenced a deleted entry.

.gitea/workflows/e2e.yml

@@ -1,49 +0,0 @@
-name: e2e
-on: [push]
-
-# The browser end-to-end suites, one job per browser, deliberately kept out
-# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
-# script/cibuild is a plain `docker build .` whose Dockerfile runs
-# make check, so folding a browser suite into either would blow that cap
-# and slow the local fast path. Before this workflow every browser-level
-# guarantee in this repo held only when a human remembered to run it.
-#
-# One job per browser rather than two steps in one job, so a Chrome failure
-# does not hide the Firefox result.
-#
-# Each job is one script and nothing else. Both scripts need docker and
-# nothing else — they deliver the repo to the daemon as a build context and
-# build the extension inside the pinned image — which is what makes them
-# runnable here at all: the runner executes the job in a container against
-# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
-# by the host daemon and mounts an empty directory, and the runner image's
-# node is too old to install this repo's dependencies.
-#
-# These jobs REPORT, they do not gate. Whether a check blocks a merge is
-# Gitea branch protection, which this repo does not configure, so a failure
-# here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked on the measured
-# flake in the dApp signing wait -- two of six runs of unmutated code on a
-# loaded machine -- tracked as
-# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
-# random teaches people to merge past red.
-#
-# Nothing here may pass vacuously. There is no continue-on-error and no
-# `|| true`. Both scripts exit non-zero when docker is missing, when the
-# image build fails, and when the browser fails to start; the Chrome
-# harness aborts the suite outright if its network interception is not in
-# effect.
-jobs:
-    e2e-chrome:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e
-
-    e2e-firefox:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e-firefox

Dockerfile

@@ -1,21 +1,8 @@
 # node:22-slim (22.x LTS), 2026-02-24
-FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 
 WORKDIR /app
 
-# Marks "already inside the lint container" for script/lint, which otherwise
-# shells out to docker to build the lint stage below. Nothing outside this
-# image sets it.
-ENV AUTISTMASK_LINT_NATIVE=1
-
-# script/test's default 30s bound is the host figure, against a suite that
-# runs in about 8s there. In here the same suite starts on a cold jest cache
-# and shares the runner with the rest of the build, so 30s is marginal rather
-# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
-# still catches a hang in three minutes and cannot be tripped by a suite that
-# is merely running on contended hardware.
-ENV AUTISTMASK_TEST_TIMEOUT=180
-
 # script/bootstrap installs all prerequisites (make via apt here; node
 # is already in the base image, yarn comes via corepack) and runs
 # yarn install --frozen-lockfile. Dependency manifests are copied first
@@ -26,17 +13,5 @@ RUN script/bootstrap
 
 COPY . .
 
-# Lint stage — fail fast on static analysis and formatting, before the tests
-# and the build. This is also the stage script/lint builds from a host, which
-# is how linting stays on the pinned ESLint rather than the host's.
-FROM base AS lint
-RUN make lint
-
-# Full check and build. The COPY --from is a no-op file copy whose only job is
-# to make BuildKit finish the lint stage before this one starts; without it the
-# stages run in parallel and a lint failure would not fail the build early.
-FROM base AS check
-COPY --from=lint /app/package.json /dev/null
-
 RUN make check
 RUN make build

LICENSE

@@ -682,14 +682,7 @@ under their own licenses. They are NOT covered by the GPL-3.0 license above.
 
 ---------------------------------------------------------------------------
 File: src/shared/phishingBlocklist.json
-Source: the eth-phishing-detect community blocklist (src/config.json).
-        The file here is derived from it, not a copy of it: only the
-        blacklist is carried over, and each entry is stored as a truncated
-        digest rather than a domain name. script/vendor-blocklist records
-        the exact upstream URL, the commit it is pinned to and the hash of
-        the bytes that commit serves, and is what regenerates this file.
-        The URL previously cited here, under a different organisation,
-        returns 404: that repository is gone.
+Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
 Copyright: Copyright (c) 2018 kumavis
 License: Don't Be a Dick Public License (DBAD), Version 1.2
 ---------------------------------------------------------------------------

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug verify-build vendor-blocklist clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -35,12 +35,6 @@ fmt-check:
 check:
 	@script/check
 
-# Assert that the competitor name appears nowhere but its documented
-# exceptions. Part of check, and re-run against dist/ at the end of a build;
-# separate target for re-running it alone.
-check-censored:
-	@script/check-censored
-
 docker:
 	@script/docker
 
@@ -51,7 +45,6 @@ build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
 	@script/verify-build
-	@script/check-censored --require-dist
 
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
@@ -60,19 +53,12 @@ build-debug:
 	@echo "Building extension (DEBUG)..."
 	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
 	@AUTISTMASK_DEBUG=1 script/verify-build
-	@script/check-censored --require-dist
 
 # Assert the compiled DEBUG state of the bundles already in dist/. Runs at
 # the end of build and build-debug; separate target for re-running it alone.
 verify-build:
 	@script/verify-build
 
-# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
-# Run deliberately, land the diff: the extension does no runtime fetching, so
-# the shipped list is as fresh as the last vendoring run that was released.
-vendor-blocklist:
-	@script/vendor-blocklist
-
 clean:
 	@rm -rf dist/
 

README.md

@@ -18,10 +18,9 @@ don't implement any crypto, and don't send user-specific data anywhere but a
 extension contacts three user-configurable services: the configured RPC node for
 blockchain interactions, a public CoinDesk API (no API key) for realtime price
 information, and a Blockscout block-explorer API for transaction history and
-token balances. It also performs best-effort Etherscan address label lookups
-during transaction confirmation. A community-maintained phishing domain
-blocklist is built into the extension at build time and checked locally; nothing
-is fetched for it at runtime.
+token balances. It also fetches a community-maintained phishing domain blocklist
+periodically and performs best-effort Etherscan address label lookups during
+transaction confirmation.
 
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -84,36 +83,15 @@ provide:
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
-- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
-  only prerequisite: it builds a pinned image that carries the repo and a fresh
-  extension build, see [End-to-End Tests](#end-to-end-tests))
-- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
-  against an image with a pinned Firefox and geckodriver, see
+- `script/test-e2e` — run the Chrome browser end-to-end suite (docker required;
+  see [End-to-End Tests](#end-to-end-tests))
+- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (docker
+  required; builds its own pinned image, see
   [End-to-End Tests](#end-to-end-tests))
-- `script/lint` — run ESLint (`eslint.config.js`) and then `prettier --check`,
-  failing on either. It never writes: `--fix` is not in this path, so
-  `make check` stays non-mutating. Linting runs in the container — the script
-  builds the Dockerfile's `lint` stage — because an ESLint result that depends
-  on whichever ESLint the host happens to have is not a result. Docker is
-  therefore required to lint; inside that image `AUTISTMASK_LINT_NATIVE=1` makes
-  the same script lint in place instead of recursing.
+- `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
-- `script/check` — run test, test-verify-build, check-censored, lint, and
-  fmt-check
-- `script/check-censored` — assert the competitor name RULES.md bars appears
-  nowhere in the working tree or under `dist/` outside its documented
-  exceptions: the pinned source reference in `script/vendor-blocklist`, the two
-  provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
-  on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
-  fails anywhere else. Part of `make check`, which inspects `dist/` when there
-  is one and says loudly when there is not; `make build` re-runs it with
-  `--require-dist`, so a build artifact is always covered
-- `script/vendor-blocklist` — refresh `src/shared/phishingBlocklist.json` from
-  its upstream, pinned to a commit and to the sha256 of the bytes that commit
-  serves. Run deliberately, never as part of a build: the output is committed
-  and there is no runtime fetch, so the shipped list is as fresh as the last
-  vendoring run that was released
+- `script/check` — run test, test-verify-build, lint, and fmt-check
 - `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
   `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
   off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
@@ -158,12 +136,11 @@ are outside `make check`.
 
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
-`mcr.microsoft.com/playwright` container (pinned by digest in
-`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
-required and the suite fails loudly rather than skipping if it is unavailable).
-The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
-version must stay matched to the container's Playwright version — the browsers
-ship inside the image.
+`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
+docker is required and the suite fails loudly rather than skipping if it is
+unavailable). The suite lives in `tests/e2e/` and is driven by
+`playwright-core`, whose version must stay matched to the container's Playwright
+version — the browsers ship inside the image.
 
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
@@ -180,23 +157,6 @@ fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
 offline; unrecognised outbound requests are reported as failures rather than
 silently allowed.
 
-It also covers the **Settings screen**, which holds the densest run of element
-id lookups in the codebase and where one wrong id leaves the whole popup blank
-rather than only degrading Settings: that the screen renders populated — the
-About well and the wallet list are read back, so a `show()` that stopped early
-is caught rather than merely a view that failed to appear — that the four Token
-Spam Protection controls are real checkboxes defaulted on, and that the theme
-and network selectors offer exactly the choices `src/shared/networks.js` and
-`index.html` define. What the selectors persist is then driven through the UI to
-`dark` and `sepolia` and reasserted after a popup reopen before being restored
-the same way; neither value is its selector's first `<option>`, so neither can
-be read back from the markup with no JavaScript having run. One spam filter is
-likewise toggled off and back on across a reopen each way, which exercises the
-change handler, `saveState()`, `loadState()` and the assignment `init()` makes.
-Each group of these assertions records a coverage key and a final case demands
-the exact set, so a section that silently stopped running reddens the suite
-instead of quietly shrinking it.
-
 It also covers the confirmation screen, for both a native ETH send and an ERC-20
 send: Send disabled while the fee estimate is in flight, enabled once it lands,
 the fee block quoting the expected cost and the reserve separately, the distinct
@@ -253,16 +213,16 @@ That interception covers the MV3 background service worker as well as the popup
 page, which it does not by default — `script/test-e2e` sets
 `PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
 experimental, the harness does not take it on trust. At launch it waits for the
-background worker to exist, asks it for one throwaway `fetch()` of its own, and
-requires that request to arrive in the route handler within 30 seconds or aborts
-the entire suite (`tests/e2e/harness.js`). The anchor used to be the worker's
-own startup traffic — the phishing blocklist fetch — and there is no longer any:
-the blocklist is vendored at build time and the extension contacts nobody when
-it starts. An earlier synthetic probe was rejected because evaluating in an
-extension service worker immediately after launch killed the worker outright;
-waiting for the worker to be handed over first, and issuing a `fetch()` that is
-not awaited, does not. Failing the probe fails closed — the suite refuses to run
-rather than passing quietly.
+background worker's **own** startup request — the phishing blocklist fetch that
+`src/background/index.js` issues on startup, which on the suite's throwaway
+profile always happens because no previous fetch timestamp is persisted — to
+arrive in the route handler, and aborts the entire suite if none does within 30
+seconds (`tests/e2e/harness.js`). The check is passive on purpose: a synthetic
+probe fetched from inside the worker via `worker.evaluate()` was tried first and
+rejected, because evaluating in an extension service worker that early kills the
+worker outright, destroying the thing being measured. Observing traffic the
+extension already generates perturbs nothing. Losing the race fails closed — the
+suite refuses to run rather than passing quietly.
 
 As defence in depth, Chrome is also started with
 `--host-resolver-rules=MAP * ~NOTFOUND`, so a request that ever did slip past
@@ -272,12 +232,9 @@ being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
 printed, tagged `[sw]` or `[page]`.
 
 **Any uncaught page error or `console.error` fails the run.** That is the point:
-this suite exists because a `ReferenceError` from a used-but-not-imported
-identifier shipped twice, fatal in a browser and invisible to a `make check`
-that was `prettier --check` only. ESLint's `no-undef` now catches that exact
-class before a browser is involved, so this suite is no longer the only thing
-standing between it and a release — but a static rule only sees identifiers, and
-the runtime errors this suite catches are broader than one rule.
+a `ReferenceError` from a used-but-not-imported identifier is invisible to
+`make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
+and this suite exists because exactly that class of bug shipped twice.
 
 ### Firefox (`make test-e2e-firefox`)
 
@@ -296,13 +253,11 @@ runner rather than believed from the extension, and the stub node has to answer
 `eth_sendRawTransaction` with the hash `ethers` computes for the artifact it
 sent, or `provider.broadcastTransaction()` refuses the answer.
 
-Both suites build their own image, each with the repo and a fresh extension
-build baked in; what differs is the base. The Chrome image layers those on top
-of a published Playwright image, whereas this one is assembled from a `node`
-base, because no published image carries both a pinned Firefox and a matching
-geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external artifacts by
-digest — the `node` base image, the Firefox 153.0.3 tarball, and geckodriver
-0.36.0 — and the Firefox version in particular must not float:
+Unlike the Chrome suite it builds its own container image rather than pulling a
+published one, because no published image carries both a pinned Firefox and a
+matching geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external
+artifacts by digest — the `node` base image, the Firefox 153.0.3 tarball, and
+geckodriver 0.36.0 — and the Firefox version in particular must not float:
 `-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
 Without that flag, both navigating to `moz-extension://` and running
 chrome-context script fail with `unsupported operation`. The flag grants the
@@ -391,64 +346,9 @@ Two limits are worth knowing, both real differences from the Chrome suite:
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
-pick it up either. Run them locally before changing anything under
-`src/popup/views/`.
-
-### In CI
-
-`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
-`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
-20-second `make test` cap and the local fast path are untouched. Each job is a
-checkout and the matching `script/` entrypoint, nothing else.
-
-Docker is the only thing either job needs from the runner, and that is not an
-accident. The runner executes a job inside a container against the **host's**
-docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
-host and mounts an empty directory, and the runner image's node is too old to
-install this repo's dependencies. Both suites therefore ship the repo to the
-daemon as a build context and build the extension inside the image, which works
-identically on a laptop.
-
-The jobs **report, they do not gate.** A failure is a red mark against the
-commit that a reviewer has to account for, not a hard block: whether a check
-blocks a merge is Gitea branch protection, which this repo does not configure.
-
-That is not only a statement about configuration. The Chrome suite is
-**measurably flaky under load** — two of six runs of unmutated code on a busy
-machine lost the approval popup out from under the dApp signing wait, always in
-the `#183` section, tracked as
-[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
-has to be read before it is believed, and that flake is the blocker to ever
-making this a required check. Do not answer it with a retry wrapper: a suite
-that reruns until it is green stops being evidence.
-
-Nothing in either job can pass vacuously. There is no `continue-on-error` and no
-`|| true`; both scripts exit non-zero when docker is missing, when the image
-build fails, and when the browser fails to start; the Chrome harness aborts the
-suite outright if its network interception is not in effect.
-
-Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
-the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
-once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
-Firefox and geckodriver downloads the same way.
-
-### Element id guard (part of `make check`)
-
-`tests/popupElementIds.test.js` asserts statically that every element id the
-popup looks up — `$("...")`, `document.getElementById("...")`,
-`showError()`/`hideError()`, and the `view-<name>` a literal `showView("...")`
-resolves to — exists in `src/popup/index.html`, and that `index.html` defines no
-id twice. A wrong id is valid JavaScript naming a defined function, so neither
-jest (node environment, no DOM) nor a linter objects to it; at runtime `$()`
-returns `null` and the next property access throws, which inside a view's
-`init()` aborts the rest of `src/popup/index.js` `init()` and leaves the popup
-blank.
-
-It runs with no browser, so unlike the e2e suites it fits inside `make check`,
-and it covers every view rather than the ones some test happens to open. It only
-sees literal arguments: a call like `$(containerId)` is invisible to it, and a
-lookup naming the wrong existing element is valid by construction. Both of those
-are the browser suites' job.
+pick it up either. Neither is wired into the Gitea workflow yet —
+docker-in-docker in CI is a separate question. Run them locally before changing
+anything under `src/popup/views/`.
 
 ## Rationale
 
@@ -511,46 +411,60 @@ on the next event. Two consequences shape every recurring job in the background:
 
 - `setInterval` and `setTimeout` are useless. They are destroyed with the
   worker, so a job scheduled that way runs until the first idle period and never
-  again. The one recurring job — the 60-second balance refresh — is scheduled
-  through the extension alarms API (`src/shared/alarms.js`) instead. The browser
-  holds the schedule and wakes the worker to deliver it. Alarm periods are
-  clamped to a one-minute minimum, so the balance refresh is expressed as
-  exactly one minute and nothing is silently slowed down.
+  again. Both recurring jobs — the 60-second balance refresh and the 24-hour
+  phishing blocklist refresh — are scheduled through the extension alarms API
+  (`src/shared/alarms.js`) instead. The browser holds the schedule and wakes the
+  worker to deliver it. Alarm periods are clamped to a one-minute minimum, so
+  the balance refresh is expressed as exactly one minute and nothing is silently
+  slowed down.
 - Module-level variables do not survive either. Anything that must be remembered
-  across a restart goes in extension storage. `localStorage` does not exist in a
-  service worker at all — the one remaining user of it, `src/shared/ens.js`,
-  runs only in the popup and is marked as such.
+  across a restart goes in extension storage, including the timestamp of the
+  last phishing list fetch: without it a revived worker would either re-fetch on
+  every wake or, with a naive in-memory guard, never notice that an update is
+  due. `localStorage` does not exist in a service worker at all — the one
+  remaining user of it, `src/shared/ens.js`, runs only in the popup and is
+  marked as such.
 
-The job also carries a freshness guard, and a guard must never be timed to the
-alarm period it gates. The guard is measured from the moment the last run
+Both jobs also carry a freshness guard, and a guard must never be timed to the
+alarm period it gates. Each guard is measured from the moment the last run
 finished, which is one run-duration after the alarm that started it, so a guard
 of exactly one period vetoes the very next tick and the real cadence becomes two
-periods. The balance refresh guard exists to skip work an open popup has already
-done — the popup refreshes every 10 seconds and stamps the same field — and that
-has to keep applying on the scheduled tick, so the guard is shortened to half
-the alarm period rather than bypassed: comfortably above the popup's 10 seconds,
-so an open popup still suppresses the background job, and comfortably below the
-60-second period, so the schedule always wins.
+periods. The two jobs solve this differently, because their guards exist for
+different reasons:
 
-Retiring a job means clearing its alarm, not just deleting its handler. The
-browser keeps an alarm until something removes it, so an install that once ran
-the version which created it goes on being woken on that schedule forever. Names
-that are no longer handled are listed in `OBSOLETE_ALARMS` and cleared on every
-start; the 24-hour phishing blocklist refresh is there, retired when the runtime
-fetch was removed.
+- The phishing refresh has a 24-hour cache TTL whose job is to keep the worker
+  off the network on the wakes between scheduled refreshes — Chrome revives the
+  worker every ~30 seconds while the browser is busy, and every revival runs the
+  startup path. The scheduled alarm tick is not one of those wakes, so it
+  bypasses the TTL and fetches unconditionally. Shortening the TTL instead would
+  not work: the startup path re-checks it on every wake, so a shorter TTL simply
+  becomes the real refresh rate.
+- The balance refresh guard exists to skip work an open popup has already done —
+  the popup refreshes every 10 seconds and stamps the same field. That has to
+  keep applying on the scheduled tick, so the guard is shortened to half the
+  alarm period instead of bypassed: comfortably above the popup's 10 seconds, so
+  an open popup still suppresses the background job, and comfortably below the
+  60-second period, so the schedule always wins.
 
-The startup path (`ensureRecurringAlarms()`) runs on `onInstalled`, on
-`onStartup`, and at the top level of the worker, so every way the background
-context can start re-establishes the schedule. On a fresh install more than one
-of those fires, so they share a single in-flight run rather than racing. It is
-idempotent: an alarm that already exists with the period the code asks for is
-left alone, because re-creating one restarts its schedule and a busy extension
-would push the next fire out indefinitely. An alarm carrying a different period
-— one created by an earlier version — is re-created once, or a period changed in
-a new release would never reach an existing install.
+Two timestamps are persisted for the phishing list, not one. `lastFetchTime`
+records a fetch that produced a usable delta and drives the TTL.
+`lastAttemptTime` records that the network was contacted at all, and is written
+even when the result is unusable — a failed request, or a delta over the 256 KiB
+cap. Without it those cases leave no freshness mark and the worker re-downloads
+the full blocklist on every wake, indefinitely; with it, unscheduled retries are
+floored at one hour. Both are discarded on load if they are in the future, since
+a stamp from a skewed clock or a restored backup would otherwise suppress
+updates until that time arrives, permanently and with no way out.
 
-Nothing is fetched when the worker starts. A wake costs no network traffic at
-all, which is what the phishing blocklist being vendored at build time bought.
+The startup path (`ensureRecurringAlarms()` plus the phishing list init) runs on
+`onInstalled`, on `onStartup`, and at the top level of the worker, so every way
+the background context can start re-establishes the schedule. On a fresh install
+more than one of those fires, so they share a single in-flight run rather than
+racing. It is idempotent: an alarm that already exists with the period the code
+asks for is left alone, because re-creating one restarts its schedule and a busy
+extension would push the next fire out indefinitely. An alarm carrying a
+different period — one created by an earlier version — is re-created once, or a
+period changed in a new release would never reach an existing install.
 
 Firefox uses Manifest V2 with a persistent background page, where timers would
 survive. Both browsers are built from one bundle and both take the alarm path,
@@ -992,13 +906,6 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
 - **Transitions**:
     - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
     - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
-    - "Sign & Send" on an ERC-20 whose contract answers `decimals()` with a
-      different number than the amount above was displayed with → nothing is
-      signed → **ErrorTx** naming both numbers. The transfer is encoded from the
-      decimals the screen rendered, carried forward on the pending transaction;
-      the contract's own answer is read at signing time only to be compared with
-      it, and a disagreement is a refusal rather than a preference for either
-      value (`src/shared/transferAmount.js`)
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Back" → **Send**
@@ -1420,6 +1327,17 @@ What the extension does NOT do:
 In addition to the three user-configurable services above (RPC endpoint,
 CoinDesk price API, and Blockscout API), AutistMask also contacts:
 
+- **Phishing domain blocklist**: A community-maintained phishing domain
+  blocklist is vendored into the extension at build time. At runtime, the
+  extension fetches the live list once every 24 hours to detect newly added
+  domains, plus once on a start where the list is more than 24 hours old. Only
+  the delta (domains not already in the vendored list) is kept in memory,
+  keeping runtime memory usage small. The delta and the timestamp of the fetch
+  that produced it are persisted to extension storage if the record is under 256
+  KiB; an oversized delta is dropped along with its timestamp, so a later start
+  fetches again rather than claiming freshness for data it no longer holds. A
+  fetch that fails, or one whose delta was too large to store, is not retried
+  more than once an hour outside the 24-hour schedule.
 - **Etherscan address labels**: When confirming a transaction, the extension
   performs a best-effort lookup of the recipient address on Etherscan to check
   for phishing/scam labels. This is a direct page fetch with no API key; the
@@ -1464,44 +1382,10 @@ policy, but as of now there are none.
 
 ### Content Security Policy
 
-Both manifests declare the same policy for extension pages, as an object under
+Both manifests declare the same policy for extension pages —
+`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
 `content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
-a bare string in `manifest/firefox.json` (MV2):
-
-```
-default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
-style-src 'self' 'unsafe-inline'; img-src 'self' data:;
-connect-src 'self' https: http:; frame-src 'none'; form-action 'none';
-base-uri 'none'
-```
-
-`default-src 'self'` is the floor. Without it the policy governed script and
-plugins only, and everything else — frames above all — was unrestricted, which
-is what let an unescaped token symbol paint a cross-origin iframe over the
-wallet's own UI. Escaping is the primary fix for that (see
-`src/shared/html.js`); this is the second line, so an escape that does slip
-cannot reach the network.
-
-Four directives are looser than `'self'`, each for a reason that does not
-generalise:
-
-- `style-src 'unsafe-inline'` — `src/popup/index.html` and the view helpers set
-  presentation through `style="..."` attributes, which CSP blocks without this.
-  Chrome enforces `style-src` on attributes, not only on `<style>` blocks, and
-  Firefox has never implemented `style-src-attr`, so there is no narrower
-  spelling that works on both targets. It permits inline **style**; script stays
-  under `script-src`, which does not allow `'unsafe-inline'`.
-- `img-src data:` — identicons are generated in the popup by
-  `ethereum-blockies-base64` and assigned to `img.src` as `data:` PNGs.
-- `connect-src https: http:` — the RPC endpoint is user-configurable and a local
-  node over `http://127.0.0.1` is a supported configuration, which the Firefox
-  end-to-end suite depends on. The wallet's outbound traffic is constrained by
-  what it is written to contact (see External Communication), not by this
-  directive.
-- `frame-src 'none'`, `form-action 'none'`, `base-uri 'none'` — named rather
-  than inherited. `form-action` and `base-uri` do not fall back to `default-src`
-  at all, so they would have stayed unrestricted; `frame-src 'none'` is what
-  refuses the framed-overlay attack outright.
+a bare string in `manifest/firefox.json` (MV2).
 
 `'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
 build and a `wasm2js` translation of it in one file, tries WASM first, and
@@ -1519,10 +1403,9 @@ strings, not inline script, not remote script. Using it requires already
 executing script in an extension page, which is complete compromise on its own.
 `'unsafe-eval'` is a different proposition and is not granted.
 
-The policy is pinned in both directions. `tests/manifest.test.js` asserts the
-exact directive set and the exact token set of each directive in both manifests,
-so dropping `'wasm-unsafe-eval'` (a silent 20x regression on the key
-derivation), dropping `default-src`, and adding anything anywhere all fail
+The grant is pinned in both directions. `tests/manifest.test.js` asserts the
+exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
+20x regression on the key derivation) and adding anything beyond it both fail
 `make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
 backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
 under the real manifest.
@@ -1725,25 +1608,17 @@ indexes it as a real token transfer.
 
 AutistMask protects users from known phishing sites when they connect their
 wallet or approve transactions/signatures. A community-maintained domain
-blocklist is vendored into the extension at build time and checked entirely
-locally: no network request is made for it, ever, so nobody learns which sites
-the user connects to and no third party decides what this wallet warns about.
+blocklist is vendored into the extension at build time, providing immediate
+protection without any network requests. At runtime, the extension fetches the
+live list once every 24 hours and keeps only the delta (newly added domains not
+in the vendored list) in memory. This architecture keeps runtime memory usage
+small while ensuring fresh coverage of new phishing domains.
 
-The trade is freshness. The shipped list is exactly as current as the last
-vendoring run that was released, so a domain added upstream reaches users in the
-next release rather than within a day. Refreshing it is `make vendor-blocklist`,
-which fetches a hash-pinned upstream commit, verifies the sha256 of the bytes it
-was served, and rewrites `src/shared/phishingBlocklist.json`; the diff is
-committed and ships with the next version.
-
-The artifact holds digests, not domain names: sha256 truncated to 64 bits, one
-entry per 16 hex characters, concatenated in sorted order into a single string
-(`src/shared/domainHash.js`). A lookup hashes the hostname and its parent
-domains and binary-searches that string, so nothing is built at module load —
-which matters on MV3, where the worker re-evaluates the module on every wake —
-and the file is 1.7 MB rather than 8.7 MB. Storing digests is also what makes a
-list assembled elsewhere shippable here at all: the extension carries no
-plaintext list of anyone's domain names.
+The 24-hour cadence is an alarm, not a timer; the alarm tick fetches
+unconditionally rather than re-checking the 24-hour cache TTL that gates the
+startup path; and the fetch timestamps live in extension storage rather than in
+module variables — see [Background scheduling](#background-scheduling) for why
+all three are required.
 
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
@@ -1839,24 +1714,18 @@ This repository includes data files from third-party projects that are not
 covered by the GPL-3.0 license above. These files, their copyright holders, and
 their licenses are:
 
-| File                                                       | Source                                                                                                   | Copyright                         | License                                                        |
-| ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
-| `src/shared/phishingBlocklist.json`                        | `eth-phishing-detect` community-maintained phishing domain blocklist, derived from its `src/config.json` | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
-| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`              | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
-| `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                        | Copyright (c) 2018 Luit Hollander | MIT                                                            |
+| File                                                       | Source                                                                                                    | Copyright                         | License                                                        |
+| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
+| `src/shared/phishingBlocklist.json`                        | `eth-phishing-detect` community-maintained phishing domain blocklist, vendored from its `src/config.json` | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
+| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`               | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
+| `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                         | Copyright (c) 2018 Luit Hollander | MIT                                                            |
 
 The full license texts for these third-party files are included in the
 [LICENSE](LICENSE) file. The `eth-phishing-detect` row carries no repository
 link because the upstream is hosted under a competitor's organization name,
-which project policy keeps out of code and documentation.
-`script/vendor-blocklist` is the single definition and the only file that spells
-the name in prose: it is build-time tooling, never shipped, and it records the
-exact URL, the commit it is pinned to and the sha256 of the bytes that commit
-serves, because a source reference nobody can verify is not a source reference.
-`script/check-censored` reads the name back out of that one file and fails the
-build wherever else it appears, save for three shipped-code literals it cannot
-avoid — each permitted only at the one path that carries it, and listed in that
-script's header.
+which project policy keeps out of code and documentation; the vendored copy and
+the runtime refresh both come from that upstream, whose URL is the
+`BLOCKLIST_URL` constant in `src/shared/phishingDomains.js`.
 
 ## Author
 

TODO.md

@@ -32,179 +32,19 @@ The backlog lives on the
 [Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
 authoritative; this file does not duplicate it. Full policy file set present.
 Real-browser end-to-end suites (`make test-e2e` for Chrome,
-`make test-e2e-firefox` for Firefox) sit alongside `make check`, which now does
-static analysis as well as formatting, and `.gitea/workflows/e2e.yml` runs both
-of them on every push.
+`make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
+cannot see a runtime `ReferenceError` in a popup view.
 
 # Next Step
 
-Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-input validation) before any 1.0rc tag. Individual filed issues are parts of it,
-but the review is broader than any of them.
+Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
+`script/lint`. `make check` is `prettier --check` only today and cannot catch
+undefined identifiers, which is how
+[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
+[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
 
 # Completed Steps
 
-- 2026-08-20: A hostile ERC-20 symbol no longer renders as live HTML in the
-  popup ([#307](https://git.eeqj.de/sneak/AutistMask/issues/307)). A token
-  symbol is whatever the contract's `symbol()` returns, the block explorer
-  passes it through unfiltered, and `balanceLine()` interpolated it into an
-  `innerHTML` string — so a token with the 1,000 holders the spam filter asks
-  for, airdropped to the victim, could paint a full-viewport cross-origin iframe
-  over the wallet's own UI, on the screens where the user types their password.
-  `escapeHtml` moved to `src/shared/html.js` as a pure string replace over `&`,
-  `<`, `>`, `"` and `'`: the old implementation round-tripped through a detached
-  element's `textContent`, which does not escape quotes, and it was already
-  being used inside `data-copy="..."`. Every interpolation into an `innerHTML`
-  string across `src/popup/views/` was audited, not just the reported one — the
-  transaction lists' direction label, the wallet name and ENS name in the Home
-  list, the `href` in the explorer link, and the confirmation screen's warning
-  line were all unescaped as well. Both manifests now declare
-  `default-src 'self'` with `frame-src 'none'`; the four directives that had to
-  stay looser than `'self'` are named and justified in the Content Security
-  Policy section of README.md, and `tests/manifest.test.js` pins the whole set
-  exactly. A display cap of 12 characters bounds the symbol, matching the bound
-  `lookupTokenInfo()` already applied on the contract-read path. Not repurposed
-  for any of this: `isSpoofedSymbol()`, which answers a different question and
-  would have been the wrong control.
-- 2026-08-20: A page asking which chain the wallet is on is told the chain the
-  user is actually on ([#317](https://git.eeqj.de/sneak/AutistMask/issues/317)).
-  `eth_chainId` and `net_version` answered from `currentNetwork()`, which reads
-  the module-level `state` singleton that nothing populates at module scope, so
-  a service worker revived by the page's own message answered out of
-  `DEFAULT_STATE` and reported mainnet `0x1`/`1` to a user on Sepolia — a dApp
-  building its interaction for the wrong chain. Both now answer from
-  `getState()`, the per-call detached storage read the other read handlers use,
-  rather than from the singleton: these two are reachable by any page on every
-  provider init, and mutating the shared singleton on that path would detach the
-  wallet objects an in-flight `backgroundRefresh()` is mutating. The read side
-  of the background was audited with it: the remaining singleton reads are the
-  chain switch, the transaction verification path and `backgroundRefresh`, which
-  each already load, and everything else answers from storage per call through
-  `getState()`. One stale read is left named but unfixed, outside this issue's
-  scope: `handleSendTransaction` builds its provider with no network name, so
-  `getProvider()` falls back to the same unloaded singleton for ethers' static
-  network hint.
-- 2026-08-20: The dApp approval screen no longer shows a token transfer it
-  cannot scale as `0.0000`
-  ([#306](https://git.eeqj.de/sneak/AutistMask/issues/306)). `decodeCalldata`
-  read decimals from the 512-entry bundled token list alone and fell back to 18,
-  so every token outside it — most of them, including anything the user added by
-  contract address — was displayed at the wrong scale: a `transfer` of 5,000
-  units of a 6-decimal token read as `0.0000`, and a user who reads zero
-  confirms the drain. The new `src/shared/approvalAmount.js` resolves the scale
-  from the bundled list, then `state.trackedTokens`, then the decimals the block
-  explorer already reported in `addr.tokenBalances`, and refuses one the
-  explorer's own entries disagree about. Where no source knows it, the amount
-  line is not formatted at all: it shows the base-unit integer and states that
-  the scale is unknown, for `approve` as well as `transfer`. An unbounded
-  allowance still reads `Unlimited`, which needs no scale.
-- 2026-08-20: A web page can no longer switch the wallet's chain, and switching
-  no longer destroys the user's endpoints
-  ([#308](https://git.eeqj.de/sneak/AutistMask/issues/308)).
-  `wallet_switchEthereumChain` was answered for any origin at all, with no
-  connection check and no prompt: any page could clear the `[TESTNET]` banner
-  under a user who believed they were on Sepolia. It now takes the same
-  `allowedSites`/`connectedSites` gate the signing methods take, ahead of the
-  same-chain and unsupported-chain answers, and refuses an unconnected origin
-  with `4100`. The switch itself also overwrote `state.rpcUrl` and
-  `state.blockscoutUrl` with the network defaults, so a user running their own
-  node lost that url permanently and silently to a public endpoint that then
-  sees every address they hold. Endpoints are now remembered per network in
-  `state.networkEndpoints`, snapshotted from the network being left and restored
-  for the network being entered; `state.rpcUrl` stays the live value for the
-  active network, so no reader changed. A profile written before the map existed
-  has its stored pair adopted for the network it was stored under, and loses
-  nothing. The handler now loads state before it switches
-  ([#316](https://git.eeqj.de/sneak/AutistMask/issues/316)): the service worker
-  populates nothing at module scope, so a worker revived by the page's own
-  message held `DEFAULT_STATE`, and the switch persisted every field of it —
-  wiping every wallet, every site approval and every tracked token from storage
-  along with the endpoint.
-- 2026-08-20: The wallet's own ERC-20 send signs the amount it displayed
-  ([#305](https://git.eeqj.de/sneak/AutistMask/issues/305)). The confirmation
-  screen renders from the block explorer's cached decimals; the transfer was
-  encoded from `decimals()` read off the contract at signing time, and nothing
-  compared the two, so a token whose on-chain scale disagreed — an upgradeable
-  or proxy token, a stale explorer entry, a compromised Blockscout — signed an
-  amount that was never on screen, off by a power of ten per decimal place of
-  disagreement. The scale is now carried forward on the pending transaction from
-  the same balance entry the screen's amount, balance and symbol come from, and
-  the contract's answer is read at signing time only to be compared with it: a
-  disagreement is a refusal naming both numbers, never a preference for either
-  (`src/shared/transferAmount.js`, the `confirmTx` counterpart to
-  `approvalVerify.js`). The gas estimate encodes from the same carried value and
-  no longer reads `decimals()` at all. Nothing in the e2e suite had ever clicked
-  `#btn-confirm-send`, which is how this shipped: the popup's own Send →
-  ConfirmTx → Sign & Send → WaitTx path now runs end to end to a broadcast, with
-  the `transfer()` amount decoded out of the raw signed bytes and asserted
-  against what the screen displayed, and a companion case where the contract
-  starts answering a different scale after the screen was built and nothing
-  reaches the RPC. Reverting only the signing-side comparison turns that second
-  case red and leaves the other 53 green.
-- 2026-08-17: The Settings screen is driven in a browser, and every element id
-  the popup looks up is checked statically. Nothing exercised Settings in the
-  e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups
-  in the codebase was unverified at runtime. Seven new cases in
-  `tests/e2e/run.js` reach Settings, assert the About well and the wallet list
-  were actually written, assert the four Token Spam Protection checkboxes are
-  real checkboxes defaulted on, and assert the theme and network selectors offer
-  the choices `src/shared/networks.js` and `index.html` define. The selectors
-  are then driven to `dark` and `sepolia` — neither is the first `<option>`, so
-  neither can be read back from the markup with no JavaScript involved — and
-  reasserted after a popup reopen before being restored the same way, and one
-  spam filter is toggled off and back on across a reopen each way. Those round
-  trips run the change handler, `saveState()`, `loadState()` and the
-  `init()`/`show()` assignments rather than just looking at the screen. `show()`
-  no longer guards its `settings-network` lookup with `if (networkSelect)`: a
-  missing element must fail loudly, which is the whole failure mode this unit
-  exists to catch. Each group records a coverage key and a final case demands
-  the exact set, so a shortened or skipped section reddens the run instead of
-  shrinking it. `tests/popupElementIds.test.js` is the general half and runs in
-  `make check` with no browser: every literal id reached through `$()`,
-  `document.getElementById()`, `showError()`/`hideError()` and `showView()` must
-  exist in `src/popup/index.html`, which no id in `index.html` may define twice.
-  Demonstrated on four deliberate breaks — a typo'd id (both halves red), a
-  handler bound to the wrong but existing element (only the functional e2e case
-  red), a typo in a view no browser suite opens (only the static guard red), and
-  the deletion of both persisted-value assignments in `settings.js` (only the
-  selector round-trip case red)
-  ([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
-- 2026-08-17: The phishing blocklist is vendored at build time and censored, and
-  the runtime fetch is gone
-  ([#219](https://git.eeqj.de/sneak/AutistMask/issues/219)).
-  `script/vendor-blocklist` fetches upstream at a pinned commit, verifies the
-  sha256 of the bytes it was served, and writes
-  `src/shared/phishingBlocklist.json` as truncated sha256 digests rather than
-  domain names — which is what removes the competitor's name from a list that
-  carried it 6,475 times, without dropping a single one of those domains.
-  `script/check-censored` runs in `make check` and again against `dist/` at the
-  end of every build, each permitted occurrence scoped to the one path allowed
-  to carry it; the name now appears only in the vendoring script, which defines
-  it once, in the provider-shim identifiers in `src/content/inpage.js`, and in
-  one ERC-20's on-chain name in `src/shared/tokenList.js`. Removing the fetch
-  retired the delta, the persistence and the 24-hour alarm from
-  [#158](https://git.eeqj.de/sneak/AutistMask/issues/158), and retired alarms
-  are now cleared rather than left running on existing installs. Two
-  consequences, both deliberate: the list no longer self-updates, so it is as
-  fresh as the last vendoring run that was released; and re-vendoring from
-  current upstream took it from 231,357 stale entries to 105,721 current ones,
-  because upstream prunes and the vendored snapshot never did. `dist/` fell from
-  18.9 MB to 8.9 MB. The e2e suite now drives the warning end to end from a real
-  blocklisted origin, and its service-worker interception canary has a new
-  anchor, because the startup fetch it used to watch for no longer exists.
-- 2026-08-17: One wording for an empty password field on every screen that asks
-  for one. The private key export screen said "Password is required." where the
-  other five say "Please enter your password.", the same one-condition-two-
-  wordings split that [#172](https://git.eeqj.de/sneak/AutistMask/issues/172)
-  closed for a rejected password. Strings only, no behaviour change.
-  `tests/passwordMessages.test.js` now pins the empty-field guard per call site
-  as well as the decrypt handler, anchored on the `decryptWithPassword` sites so
-  the wallet-creation screen — where an empty field means a password being
-  chosen, a different condition — stays out of the set. Every error container
-  measured at a 360px viewport in the pinned Playwright container: the export
-  screen's container holds at 20px with the following section at the same offset
-  for the old string, the new string and the empty reserved state
-  ([#265](https://git.eeqj.de/sneak/AutistMask/issues/265)).
 - 2026-08-17: One shared extension-API module,
   [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
   the tree that names `browser` or `chrome`. Every call site returns a promise;
@@ -220,10 +60,9 @@ but the review is broader than any of them.
   and coverage change, not a repair of a broken target. `storageGet()` and
   `storageSet()` **reject** where `storage.local` is absent rather than
   resolving `{}` and a no-op write — they carry the wallet, and defaulting would
-  read an existing wallet back as none. The one caller that genuinely degraded,
-  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), took
-  `storageLocal()` directly and kept its own null check; it stores nothing at
-  all as of [#219](https://git.eeqj.de/sneak/AutistMask/issues/219) above.
+  read an existing wallet back as none. The one caller that genuinely degrades,
+  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), takes
+  `storageLocal()` directly and keeps its own null check.
 - 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
   price. Prices exist for the top 25 tokens only, so the priced-only sum was
   printed as the total and an address holding nothing but unpriced ERC-20s was
@@ -290,74 +129,6 @@ but the review is broader than any of them.
   on the real clipboard, read back after a sentinel write. Each of the four was
   demonstrated failing against a deliberately broken build
   ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
-- 2026-08-14: `make check` does static analysis. `script/lint` ran
-  `prettier --check .`, byte-identical to `script/fmt-check`, so a wallet with
-  two shipped used-but-not-imported crashes behind it was green. ESLint is now
-  pinned in `package.json` with `@eslint/js` recommended as the base, flat
-  config in `eslint.config.js`, `no-undef` and `no-unused-vars` error-level, and
-  globals declared per tree — browser for the popup and content scripts, service
-  worker for `src/background/` and `src/shared/`, jest for `tests/`, node for
-  `build.js`. It found 41 unused bindings and 53 undefined identifiers; all are
-  fixed, and dropping a call to an unimported `foo()` into any `src/` file fails
-  `make lint`. Linting is also containerized now: `script/lint` builds the
-  Dockerfile's new `lint` stage, so the ESLint that decides whether this repo is
-  green is the pinned one and not the host's. The lint stage roughly doubles the
-  image build, so `script/test`'s hard timeout is now a bound on a hung suite
-  rather than a wall-clock budget: 30s on the host, where the suite runs in
-  about 8s, and `AUTISTMASK_TEST_TIMEOUT` raises it inside the image, where a
-  cold build pays install and contention costs the policy budget never described
-  ([#152](https://git.eeqj.de/sneak/AutistMask/issues/152)).
-- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
-  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
-  push, separate from `check`, so `make check` and its 20-second `make test` cap
-  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
-  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
-  gate, the dApp approval round trips — was enforced only when a human
-  remembered to run it by hand. The suites could not run on the runner as they
-  stood: the runner executes a job in a container against the host's docker
-  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
-  and the runner image's node cannot install this repo's dependencies. Both
-  suites now ship the repo to the daemon as a build context and build the
-  extension inside the pinned image, so docker is the only prerequisite on a
-  runner or a laptop, and both run the image by ID rather than by tag so
-  concurrent clones cannot swap it. The jobs report rather than gate — this repo
-  configures no branch protection, and the Chrome suite is measurably flaky
-  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
-  rather than papered over
-  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
-- 2026-08-14: A background message handler that throws now rejects the page
-  instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
-  and `sendResponse` is the only thing that settles the dApp's
-  `window.ethereum.request()` promise — so any throw inside `handleRpc` left
-  that promise pending forever, with no error and no timeout, indistinguishable
-  from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
-  internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
-  describes "the wallet broke" and none was invented) and logs the method and
-  the throw to the background console rather than swallowing them. The two async
-  IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
-  same shape one level down — every statement inside a `try`, but a throw out of
-  a `catch` block escaping unhandled — and each got a last-resort `.catch()`
-  settling the approval through `settleApproval()` and answering the popup. The
-  transaction one tracks which phase it escaped from and reports that, so an
-  escape before `broadcastTransaction()` says the request is gone rather than
-  that it may still have reached the network. Every other handler on the path is
-  synchronous. All four are driven by real failures — a rejecting storage read,
-  and a failure classifier that throws while classifying a genuine verification
-  or broadcast failure — and were demonstrated failing first, the RPC one with
-  `sendResponse` at zero calls
-  ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
-- 2026-08-14: Approving a site connection is no longer a race against the popup
-  closing. The decision now rides the approval port the popup already holds,
-  which is the same channel the close disconnects, so it is delivered ahead of
-  that disconnect however fast the teardown is; `windows.onRemoved` no longer
-  decides a site approval whose port is connected, since that event is ordered
-  against nothing either. Rejecting and closing without deciding both still
-  report a rejection, and the popup delays its own close by nothing. The e2e
-  harness's deferred-`window.close()` accommodation is gone with it, so the two
-  site-prompt tests now drive the shipped decide-then-close in a real Chromium;
-  against the unfixed code the approval came back to the page as
-  `{"settled":"rejected","code":4001}`
-  ([#275](https://git.eeqj.de/sneak/AutistMask/issues/275)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the
@@ -678,5 +449,12 @@ but the review is broader than any of them.
 Only work that has no issue of its own belongs here; everything else is on the
 tracker.
 
+- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
+  input validation) before any 1.0rc tag. Individual filed issues are parts of
+  it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` and
+  `make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
+  suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.

build.js

@@ -63,7 +63,7 @@ function getBuildInfo() {
         commitHash = execSync("git rev-parse --short HEAD", {
             encoding: "utf8",
         }).trim();
-    } catch {
+    } catch (_) {
         // not a git repo or git not available
     }
     let commitHashFull = "unknown";
@@ -71,7 +71,7 @@ function getBuildInfo() {
         commitHashFull = execSync("git rev-parse HEAD", {
             encoding: "utf8",
         }).trim();
-    } catch {
+    } catch (_) {
         // not a git repo or git not available
     }
     return {

docs/README.md

@@ -120,6 +120,25 @@ What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
 balances, no identifying information. As with any request, CoinDesk sees your IP
 address.
 
+**Phishing domain blocklist** (`raw.githubusercontent.com`)
+
+A community-maintained list of phishing domains, used to warn you when a site
+that asks to connect, or to have a transaction or signature approved, is a known
+scam. A copy is bundled into the extension at build time, so the protection
+works before any network request happens. At runtime the extension fetches the
+live list to pick up newly added domains, keeping only the entries not already
+in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
+user-configurable.
+
+When it is contacted: when the background script starts, if the last fetch was
+more than 24 hours ago, and every 24 hours after that. The time of the last
+fetch is remembered across browser and background restarts, so restarting does
+not cause a re-download. If a fetch fails, or the list is too large to keep, the
+extension waits an hour before trying again outside that 24-hour schedule rather
+than retrying on every restart. It is a plain download of a public file —
+nothing about you is sent, but the host sees your IP address. If the fetch
+fails, the bundled copy is still used.
+
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
 When you review a send, AutistMask fetches the recipient's public Etherscan
@@ -348,12 +367,8 @@ confirmation screen. It contains only addresses involved in fraud -- it is not a
 sanctions list.
 
 **Phishing domain warnings.** Sites asking to connect or to have something
-approved are checked against a community-maintained list of known phishing
-domains, and flagged with a red banner if they match. The list is built into the
-extension: the check is entirely local, so nobody is told which sites you visit,
-and it works offline. It is also only as current as the release you are running
-— a domain added to the list upstream reaches you in the next version of the
-extension, not the same day.
+approved are checked against the phishing domain blocklist described under
+External Services, and flagged with a red banner if they match.
 
 The first four filters can be individually disabled in Settings if you prefer to
 see everything unfiltered.

eslint.config.js

@@ -1,162 +0,0 @@
-// ESLint flat config. Static analysis for make check; formatting stays with
-// prettier (script/fmt-check), so nothing here touches style.
-//
-// The sources are CommonJS and are bundled per entrypoint by build.js, so the
-// globals differ by tree and are declared per tree below. Getting that wrong in
-// either direction defeats the point: too few globals buries a real no-undef in
-// false positives, too many hides the next unimported identifier.
-
-const js = require("@eslint/js");
-const globals = require("globals");
-
-// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
-// the code feature-detects between them.
-const extensionGlobals = {
-    chrome: "readonly",
-    browser: "readonly",
-};
-
-const commonjs = {
-    ecmaVersion: 2024,
-    sourceType: "commonjs",
-};
-
-module.exports = [
-    {
-        ignores: ["dist/", "node_modules/"],
-    },
-
-    js.configs.recommended,
-
-    {
-        rules: {
-            // The two rules this config exists for. Both are already
-            // error-level in the recommended set; restated so a future
-            // recommended-set change cannot silently downgrade them.
-            "no-undef": "error",
-            // `_`-prefixed arguments are the deliberate "present for the
-            // interface, unused here" marker: the popup views share one
-            // init(ctx) signature and three of the eight do not read ctx.
-            // An unused catch binding is written `catch {`, which the repo
-            // already does, so caught errors stay checked.
-            "no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
-
-            // Off tree-wide: it requires every rethrow to carry `{ cause }`,
-            // at 3 sites today (src/shared/balances.js 207 and 215,
-            // tests/e2e/firefox/run.js 131). That is a change to what the
-            // wallet's error paths actually throw, and it is a decision of its
-            // own rather than a side effect of turning a linter on — so it is
-            // off everywhere, including for new code, until that decision is
-            // made. Unlike no-useless-assignment below, this is not an
-            // accommodation of particular sites and must not be scoped to
-            // them.
-            "preserve-caught-error": "off",
-        },
-    },
-
-    // no-useless-assignment stays on everywhere except the two files that
-    // wipe decrypted key material: the `password = null` and
-    // `decryptedSecret = null` assignments after use are dead by construction
-    // — that is what a best-effort wipe is — and the rule's fix is to delete
-    // the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
-    // and confirmTx.js 459. Everything else in the tree is still checked, so
-    // an ordinary dead store elsewhere is still an error.
-    {
-        files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
-        rules: {
-            "no-useless-assignment": "off",
-        },
-    },
-
-    // Popup and content scripts: page/window context.
-    {
-        files: ["src/popup/**/*.js", "src/content/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.browser, ...extensionGlobals },
-        },
-    },
-
-    // MV3 background: a service worker, with no window and no document.
-    {
-        files: ["src/background/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.serviceworker, ...extensionGlobals },
-        },
-    },
-
-    // src/shared is bundled into both, so it may only use what both provide:
-    // the service worker globals are the intersection, plus the extension APIs.
-    {
-        files: ["src/shared/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.serviceworker, ...extensionGlobals },
-        },
-    },
-
-    // src/shared/ens.js is the documented exception to the line above: its own
-    // header says POPUP ONLY, it caches in localStorage, and only popup views
-    // require it. Linting it as a service worker would be wrong about the file.
-    {
-        files: ["src/shared/ens.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.browser, ...extensionGlobals },
-        },
-    },
-
-    // Unit tests: jest on node.
-    {
-        files: ["tests/**/*.test.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node, ...globals.jest },
-        },
-    },
-
-    // The build script is a plain node program.
-    {
-        files: ["build.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-
-    // The helpers the script/ entrypoints call: plain node programs too, run
-    // from a shell script rather than from yarn, and never bundled.
-    {
-        files: ["script/lib/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-
-    // The e2e harnesses are node programs that also carry, inline, the
-    // callbacks they ship into the browser via page.evaluate — so both
-    // contexts really are present in the same file and both sets of globals
-    // are in scope somewhere in it.
-    {
-        files: ["tests/e2e/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: {
-                ...globals.node,
-                ...globals.browser,
-                ...extensionGlobals,
-            },
-        },
-    },
-
-    // This config file itself.
-    {
-        files: ["eslint.config.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-];

manifest/chrome.json

@@ -6,7 +6,7 @@
     "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
     "content_security_policy": {
-        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
     },
     "action": {
         "default_popup": "src/popup/index.html"

manifest/firefox.json

@@ -4,7 +4,7 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

package.json

@@ -9,16 +9,13 @@
         "test": "jest --forceExit",
         "test:verbose": "jest --forceExit --verbose",
         "build": "node build.js",
-        "lint": "eslint . && prettier --check .",
+        "lint": "prettier --check .",
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
     "devDependencies": {
-        "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "^4.2.1",
         "esbuild": "^0.27.3",
-        "eslint": "10.8.1",
-        "globals": "17.11.0",
         "jest": "^30.2.0",
         "playwright-core": "1.56.0",
         "prettier": "^3.8.1",

script/check

@@ -8,7 +8,6 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
     "$SCRIPT_DIR/test"
     "$SCRIPT_DIR/test-verify-build"
-    "$SCRIPT_DIR/check-censored"
     "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
 }

script/check-censored

@@ -1,301 +0,0 @@
-#!/bin/sh
-# script/check-censored: assert that the competitor name RULES.md bars appears
-# nowhere in this repo, and nowhere in the built extension, except where it is
-# deliberate. Our own extension to scripts-to-rule-them-all, run from
-# script/check and from make build.
-#
-# Where the name is allowed, and why each one is not negotiable away:
-#
-#   - script/vendor-blocklist. Build-time tooling, never shipped. A pinned
-#     source reference that does not say what the source is cannot be verified
-#     by anyone, so it names it. Whole-file exemption.
-#   - the two provider-shim identifiers in src/content/inpage.js. Protocol
-#     identifiers dApps feature-detect on; renaming them does not rename them in
-#     their code, it only stops this wallet working on their sites.
-#   - the on-chain name of the MUSD ERC-20 in src/shared/tokenList.js. It is not
-#     what backs symbol-spoof detection — that reads symbol and address — but
-#     the wallet already surfaces the on-chain name of any token the user holds
-#     (src/shared/balances.js), and this contract's on-chain name is that
-#     string, so censoring the repo cannot stop the wallet displaying it.
-#     Dropping the entry instead would cost the user MUSD spoof detection.
-#
-# Everything else fails, in the working tree and under dist/. The last two are
-# literals rather than whole files, so they are enforced by counting, and each
-# literal is scoped to the path allowed to carry it: a file may contain the name
-# only as many times as it contains the literals permitted *there*, and zero
-# times anywhere else. The emitted bundles carry them too, so a plain "the name
-# must not appear in dist/" could never have passed.
-#
-# The name itself is not written in this file. script/vendor-blocklist is the
-# one place in this repo that defines it, and this reads it back out of there —
-# so the repo-wide grep this check exists to enforce keeps returning exactly the
-# files named above, and this file is not one of them.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Absolute path to this script, resolved before anything cd's anywhere: the
-# scan half runs in a re-invocation through xargs, so that the paths it works on
-# arrive as arguments and cannot be reshaped by field splitting on the way in.
-SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
-
-# Internal re-entry flag. Not part of the command-line interface.
-SCAN_FLAG="--scan-paths"
-
-VENDOR_SCRIPT="$ROOT/script/vendor-blocklist"
-
-# Set by extract_name / make_literals_file.
-NAME=""
-ALLOWED_LITERALS_FILE=""
-
-FAILED=0
-
-cleanup() {
-    [ -z "$ALLOWED_LITERALS_FILE" ] || rm -f "$ALLOWED_LITERALS_FILE"
-}
-trap cleanup EXIT INT TERM
-
-fail() {
-    echo "check-censored: FAIL: $*" >&2
-    exit 1
-}
-
-# The name, taken from the single place that defines it. A check scanning for a
-# pattern it failed to read would pass against anything, so this refuses to
-# continue unless it got something that looks like the definition.
-extract_name() {
-    [ -f "$VENDOR_SCRIPT" ] ||
-        fail "$VENDOR_SCRIPT is missing, and it is where the name being
-    checked for is defined. Nothing was scanned."
-
-    NAME="$(grep -m1 '^UPSTREAM_ORG=' "$VENDOR_SCRIPT" | cut -d'"' -f2)" ||
-        fail "could not read UPSTREAM_ORG from $VENDOR_SCRIPT. Nothing was
-    scanned."
-
-    case "$NAME" in
-    "" | *[!A-Za-z0-9]*)
-        fail "UPSTREAM_ORG in $VENDOR_SCRIPT did not yield a plain name
-    (got: '$NAME'). Scanning for that would prove nothing. Nothing was
-    scanned."
-        ;;
-    esac
-}
-
-make_literals_file() {
-    ALLOWED_LITERALS_FILE="$(mktemp \
-        "${TMPDIR:-/tmp}/autistmask-censored.XXXXXX")" ||
-        fail "could not create a temporary file, so nothing was scanned."
-}
-
-# The literals $1 may carry, and nothing else may. Each contains the name
-# exactly once, which is what makes counting them sound; each is scoped to its
-# path, so a file with no business carrying the name fails even when it spells
-# it the way shipped code has to. Scoping is the point: permitting these
-# literals in any file is what once let this check pass its own prose.
-#
-# The emitted paths are listed next to the sources they come from. If the
-# bundler moves one, this goes red and the new path gets added deliberately,
-# rather than a wildcard over dist/ covering whatever lands there.
-allowed_literals_for() {
-    : >"$ALLOWED_LITERALS_FILE"
-    case "$1" in
-    src/content/inpage.js | dist/*/src/content/inpage.js)
-        printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
-        ;;
-    src/shared/tokenList.js | dist/*/src/background/index.js | \
-        dist/*/src/popup/index.js)
-        printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
-        ;;
-    esac
-}
-
-# How many times does $1 contain the name (TOTAL), and how many of those are one
-# of the allowed literals (ALLOWED)? Same discipline the rest of this repo's
-# shell checks apply to grep: exit 0 and 1 are answers about the file, anything
-# else means the file was not searched and is not an answer at all.
-count_matches() {
-    _cm_status=0
-    _cm_out="$(grep -a -o -i -F -e "$NAME" -- "$1")" || _cm_status=$?
-    case "$_cm_status" in
-    0) TOTAL="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
-    1) TOTAL=0 ;;
-    *)
-        fail "grep exited $_cm_status reading $1, so the file was never
-    searched and nothing was established about it. That is a permissions or I/O
-    fault, not a clean file. Refusing to report success."
-        ;;
-    esac
-
-    if [ "$TOTAL" -eq 0 ]; then
-        ALLOWED=0
-        return 0
-    fi
-
-    # No literal is permitted at this path, so every occurrence is a violation.
-    # Handled here rather than by grep, which is not required to say anything
-    # useful about an empty pattern file.
-    if [ ! -s "$ALLOWED_LITERALS_FILE" ]; then
-        ALLOWED=0
-        return 0
-    fi
-
-    _cm_status=0
-    _cm_out="$(grep -a -o -i -F -f "$ALLOWED_LITERALS_FILE" -- "$1")" ||
-        _cm_status=$?
-    case "$_cm_status" in
-    0) ALLOWED="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
-    1) ALLOWED=0 ;;
-    *)
-        fail "grep exited $_cm_status matching the allowed literals in $1.
-    Refusing to report success."
-        ;;
-    esac
-}
-
-# The per-path half, run in a re-invocation of this script so it uses the same
-# counting as everything else rather than a second copy of it.
-scan_paths() {
-    for _file in "$@"; do
-        # dist/ arrives absolute (find) and the worktree relative (git
-        # ls-files). The allowlist is keyed on repo-relative paths, so both
-        # forms are reduced to one before anything is decided about them.
-        _rel="$_file"
-        case "$_rel" in
-        "$ROOT"/*) _rel="${_rel#"$ROOT"/}" ;;
-        esac
-
-        case "$_rel" in
-        script/vendor-blocklist) continue ;;
-        esac
-        [ -f "$_file" ] || continue
-
-        allowed_literals_for "$_rel"
-        count_matches "$_file"
-        [ "$TOTAL" -gt "$ALLOWED" ] || continue
-
-        FAILED=$((FAILED + 1))
-        echo "check-censored: $_rel: $TOTAL occurrence(s) of the name," \
-            "$ALLOWED of them allowed at this path" >&2
-        grep -a -n -i -F -e "$NAME" -- "$_file" | cut -c1-140 | head -5 >&2
-    done
-    [ "$FAILED" -eq 0 ]
-}
-
-# Hand a NUL-delimited listing to the scan half. Returns non-zero if any path
-# failed, or if the scan could not be run at all.
-scan_listing() {
-    xargs -0 "$SELF" "$SCAN_FLAG" <"$1"
-}
-
-# Every file git tracks, plus everything untracked and not ignored: the working
-# tree as a reviewer would see it, and never node_modules or dist/ (both are
-# ignored; dist/ is walked separately below).
-check_worktree() {
-    _list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-tree.XXXXXX")" ||
-        fail "could not create a temporary file, so nothing was scanned."
-    _status=0
-    git ls-files -z --cached --others --exclude-standard >"$_list" ||
-        _status=$?
-    [ "$_status" -eq 0 ] || {
-        rm -f "$_list"
-        fail "git ls-files exited $_status, so the working tree was never
-    enumerated and nothing was established about it."
-    }
-
-    # Repo-relative paths. The scan half cd's to the repo root before it opens
-    # anything, so they reach it intact and unjoined.
-    WORKTREE_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
-
-    _status=0
-    scan_listing "$_list" || _status=$?
-    rm -f "$_list"
-    return "$_status"
-}
-
-check_dist() {
-    _list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-dist.XXXXXX")" ||
-        fail "could not create a temporary file, so dist/ was not scanned."
-    _status=0
-    find "$ROOT/dist" -type f -print0 >"$_list" || _status=$?
-    [ "$_status" -eq 0 ] || {
-        rm -f "$_list"
-        fail "find exited $_status enumerating dist/, so part of the emitted
-    tree was never walked and an unchecked file there went unchecked. Refusing
-    to report success."
-    }
-
-    DIST_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
-
-    _status=0
-    scan_listing "$_list" || _status=$?
-    rm -f "$_list"
-    return "$_status"
-}
-
-usage() {
-    echo "usage: script/check-censored [--require-dist]" >&2
-    exit 2
-}
-
-main() {
-    cd "$ROOT"
-
-    # Internal re-entry from scan_listing's xargs.
-    if [ "${1-}" = "$SCAN_FLAG" ]; then
-        shift
-        extract_name
-        make_literals_file
-        scan_paths "$@"
-        return $?
-    fi
-
-    require_dist=no
-    case "${1-}" in
-    "") ;;
-    --require-dist) require_dist=yes ;;
-    *) usage ;;
-    esac
-
-    extract_name
-    make_literals_file
-
-    echo "Checking for censored names..."
-
-    tree_status=0
-    check_worktree || tree_status=$?
-
-    dist_status=0
-    dist_inspected=no
-    DIST_COUNT=0
-    if [ -d "$ROOT/dist" ]; then
-        dist_inspected=yes
-        check_dist || dist_status=$?
-    fi
-
-    if [ "$tree_status" -ne 0 ] || [ "$dist_status" -ne 0 ]; then
-        fail "the name appears outside the deliberate exceptions (reported
-    above). See the header of script/check-censored for what is allowed and
-    why."
-    fi
-
-    if [ "$dist_inspected" = no ]; then
-        if [ "$require_dist" = yes ]; then
-            fail "there is no dist/ to inspect and this run was asked to
-    require one. Run make build."
-        fi
-        cat <<EOF
-################################################################################
-## WARNING: dist/ WAS NOT INSPECTED BY THIS RUN AND IS NOT PROVEN CLEAN BY IT.
-## There is no dist/ in this tree. The working tree is clean, but a build can
-## carry text no source file does — a dependency's, or a bundler's. Every
-## make build runs this check again with dist/ required, so a release artifact
-## is always covered; this run simply had none to look at.
-################################################################################
-EOF
-    fi
-
-    echo "check-censored: $WORKTREE_COUNT tracked file(s) inspected," \
-        "$DIST_COUNT file(s) under dist/"
-}
-
-main "$@"

script/lib/build-blocklist.js

@@ -1,147 +0,0 @@
-// The transform half of script/vendor-blocklist: upstream's config.json in,
-// src/shared/phishingBlocklist.json out. Build-time repo tooling; nothing here
-// is shipped to users.
-//
-// Usage: node script/lib/build-blocklist.js <source.json> <output.json>
-//
-// What it does, and why each step is here:
-//
-//   - only the blacklist is carried over. The extension matches a hostname and
-//     its parent domains against that one list; upstream's whitelist, fuzzylist
-//     and version metadata are read by nothing here, so shipping them would add
-//     megabytes of dead weight to every install.
-//   - entries are lowercased and de-duplicated, because that is the form
-//     isPhishingDomain() compares against.
-//   - entries that cannot be a hostname are dropped and counted. Upstream
-//     carries the odd URL-shaped entry (a path, a scheme); hostname matching can
-//     never match one, and once the artifact is hashes nobody can see that it is
-//     in there, so it is reported at vendoring time instead.
-//   - entries are hashed (see src/shared/domainHash.js) and sorted, and the
-//     digests are concatenated into one fixed-width string. Sorted is what makes
-//     the runtime lookup a binary search over that string, with no set to build
-//     on every service-worker wake; one string rather than an array of 100k+ is
-//     what keeps the file, the bundle and the JSON parse small.
-//
-// Deterministic by construction: same input bytes, same output bytes.
-
-"use strict";
-
-const fs = require("fs");
-
-const {
-    HASH_ALGORITHM,
-    HASH_HEX_CHARS,
-    hashDomain,
-} = require("../../src/shared/domainHash");
-
-// A blocklist that has collapsed to a handful of entries is a broken fetch or a
-// changed upstream shape, not a quiet day in phishing. Vendoring it would
-// disarm the feature, so it fails instead and a human decides.
-const MIN_ENTRIES = 10000;
-
-function fail(message) {
-    process.stderr.write("build-blocklist: " + message + "\n");
-    process.exit(1);
-}
-
-// A hostname, as the matcher understands one: dot-separated labels of letters,
-// digits, hyphens and underscores. Anything else — a path, a scheme, a space,
-// an empty string, a non-ASCII label a browser would have punycoded before it
-// ever reached isPhishingDomain() — cannot be produced by the hostname variants
-// the extension looks up, so it could only ever sit in the artifact unused.
-//
-// Underscores are deliberate. They are not legal in a hostname per RFC 1123,
-// but DNS carries them and browsers resolve them, and upstream lists 141 entries
-// that use one — real phishing sites on shared subdomain hosts. A stricter
-// pattern silently drops every one of them.
-const HOSTNAME_RE =
-    /^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)+$/;
-
-function main(argv) {
-    const [source, output] = argv;
-    if (!source || !output) {
-        fail("usage: build-blocklist.js <source.json> <output.json>");
-    }
-
-    let config;
-    try {
-        config = JSON.parse(fs.readFileSync(source, "utf8"));
-    } catch (e) {
-        fail("could not read " + source + " as JSON: " + e.message);
-    }
-
-    if (!Array.isArray(config.blacklist)) {
-        fail(
-            "the source has no blacklist array, so its shape is not the one " +
-                "this transform understands. Refusing to write an artifact.",
-        );
-    }
-
-    const seen = new Set();
-    let dropped = 0;
-    for (const raw of config.blacklist) {
-        if (typeof raw !== "string") {
-            dropped++;
-            continue;
-        }
-        const domain = raw.trim().toLowerCase();
-        if (!HOSTNAME_RE.test(domain)) {
-            dropped++;
-            continue;
-        }
-        seen.add(domain);
-    }
-
-    if (seen.size < MIN_ENTRIES) {
-        fail(
-            "the source yielded " +
-                seen.size +
-                " usable entries, below the " +
-                MIN_ENTRIES +
-                " floor. That is a broken source or a changed upstream " +
-                "shape, and vendoring it would disarm phishing detection. " +
-                "Refusing to write an artifact.",
-        );
-    }
-
-    const hashes = [];
-    for (const domain of seen) hashes.push(hashDomain(domain));
-    hashes.sort();
-
-    // Truncation makes collisions possible; they are harmless (both entries are
-    // blocked either way) but they must not inflate the count the artifact
-    // claims, which the runtime cross-checks against the string length.
-    const unique = [];
-    for (const hash of hashes) {
-        if (unique.length === 0 || unique[unique.length - 1] !== hash) {
-            unique.push(hash);
-        }
-    }
-
-    const artifact = {
-        algorithm: HASH_ALGORITHM,
-        hashHexChars: HASH_HEX_CHARS,
-        count: unique.length,
-        hashes: unique.join(""),
-    };
-
-    // Four-space JSON with a trailing newline: what prettier emits for this
-    // shape, so a vendored artifact passes make fmt-check untouched.
-    fs.writeFileSync(output, JSON.stringify(artifact, null, 4) + "\n");
-
-    process.stdout.write(
-        "build-blocklist: " +
-            config.blacklist.length +
-            " source entries -> " +
-            seen.size +
-            " usable domains -> " +
-            unique.length +
-            " digests (" +
-            dropped +
-            " not hostnames, " +
-            (seen.size - unique.length) +
-            " digest collisions)\n",
-    );
-}
-
-main(process.argv.slice(2));

script/lint

@@ -1,51 +1,13 @@
 #!/bin/sh
-# script/lint: run the linter (eslint, then prettier --check).
-#
-# Linting is containerized. ESLint results depend on the ESLint version, and
-# the pinned one is the one in the image; a host's own install must not be
-# able to decide whether this repo is green. From a host this therefore builds
-# the Dockerfile's `lint` stage, which runs this same script inside the image.
-#
-# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
-# what stops the recursion, so `make check` inside the CI build lints in place
-# instead of trying to reach a docker daemon it does not have.
+# script/lint: run the linter.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-
-    case "${AUTISTMASK_LINT_NATIVE:-}" in
-    1)
-        echo "Linting..."
-        yarn run lint 2>&1
-        return 0
-        ;;
-    "") ;;
-    *)
-        # Set but not recognized: say so rather than silently taking the
-        # docker path, which would look like the variable had no effect.
-        echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
-            "'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
-        exit 1
-        ;;
-    esac
-
-    if ! command -v docker >/dev/null 2>&1; then
-        echo "lint: docker is required; linting does not run on the host" >&2
-        exit 1
-    fi
-
-    echo "Linting in the pinned container..."
-    # --progress=plain: the default progress renderer collapses the lint
-    # output on success, and a lint run whose output cannot be seen is not
-    # evidence that it ran.
-    #
-    # --output=type=cacheonly: the exit status is the whole result; exporting
-    # an image afterwards costs about ten times the lint itself.
-    docker build --progress=plain --target lint \
-        --output=type=cacheonly . 2>&1
+    echo "Linting..."
+    yarn run lint 2>&1
 }
 
 main "$@"

script/test

@@ -1,49 +1,19 @@
 #!/bin/sh
 # script/test: run the test suite.
-#
-# The timeout bounds a hung suite; it is not a performance budget. On a
-# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
-# the bound. Inside the image the same suite also pays a cold jest cache and
-# shares the runner with the rest of the build, which is not what that budget
-# describes, so the Dockerfile raises the bound through
-# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
-# produces a red that means nothing, and teaches "just run it again".
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
 
 main() {
     cd "$ROOT"
-    echo "Running tests (timeout ${TIMEOUT}s)..."
-
-    status=0
-    timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
-    [ "$status" -eq 0 ] && return 0
-
-    # 124 is timeout(1) killing the suite. Say so: a kill is not a failed
-    # assertion, and the verbose rerun would only spend the same wall clock
-    # to be killed again.
-    if [ "$status" -eq 124 ]; then
-        echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
-        echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
+    echo "Running tests..."
+    timeout 30 yarn run test 2>&1 || {
+        echo "--- Rerunning with --verbose for details ---"
+        timeout 30 yarn run test:verbose 2>&1 || true
+        # Always fail: the first run already proved the tests are broken, so a
+        # flaky pass on the rerun must not turn the build green.
         exit 1
-    fi
-
-    # 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
-    # is not a duration it accepts. The suite never ran, so it neither timed out
-    # nor failed, and the verbose rerun would only reprint the same complaint.
-    if [ "$status" -eq 125 ]; then
-        echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
-        echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
-        exit 1
-    fi
-
-    echo "--- Rerunning with --verbose for details ---"
-    timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
-    # Always fail: the first run already proved the tests are broken, so a
-    # flaky pass on the rerun must not turn the build green.
-    exit 1
+    }
 }
 
 main "$@"

script/test-e2e

@@ -5,32 +5,19 @@
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
-# yourself before touching popup views. ESLint's no-undef now catches a
-# used-but-not-imported identifier in make check, but only this suite sees
-# what a view actually does when it runs.
-# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
-# from check so that cap and the local fast path both stay intact.
-#
-# Docker is the only prerequisite. The repo reaches the container as a
-# build context and the extension is built inside it (see
-# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
-# on the machine that starts the run. That is not a convenience: a bind
-# mount cannot work under Gitea Actions, and the runner image's node is too
-# old to install this repo's dependencies.
+# yourself before touching popup views; it is the only check that can see
+# a used-but-not-imported identifier blow up at runtime.
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
-
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
 
 main() {
     cd "$ROOT"
@@ -40,31 +27,22 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
-    trap cleanup EXIT
-    trap 'cleanup; exit 130' INT TERM
-
-    echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
 
     echo "Running e2e suite in the pinned Playwright container..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # HOME=/tmp: the image's root home is not a reliable place for the
-    #   browser profile.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
-    #   the MV3 background service worker — the JSON-RPC calls behind
-    #   every approval the suite drives among them — goes to the real
-    #   internet. The flag is experimental and Playwright may drop or
-    #   rename it. It cannot break silently: the harness asks the worker
-    #   for one request of its own at launch and aborts the whole suite
-    #   if it does not reach the route handler (see the interception
+    #   the MV3 background service worker — including the phishing
+    #   blocklist fetch that src/background/index.js issues at worker
+    #   startup — goes to the real internet. The flag is experimental and
+    #   Playwright may drop or rename it. It cannot break silently: the
+    #   harness probes service-worker interception at launch and aborts
+    #   the whole suite if it is not in effect (see the interception
     #   canary in tests/e2e/harness.js). If a future Playwright removes
     #   the flag, that probe is what will fail, and the fix is either a
     #   replacement mechanism or an honest downgrade of the isolation
@@ -73,10 +51,13 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/run.js
 }
 

script/test-e2e-firefox

@@ -5,17 +5,12 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
-# on every push, in a job separate from check.
+# and a browser suite does not fit.
 #
-# Unlike script/test-e2e this builds its base image locally, because no
+# Unlike script/test-e2e this builds its image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
 # All three external artifacts are pinned by digest inside the Dockerfile;
-# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
-# the extension build are baked into the image rather than mounted.
-#
-# Docker is the only prerequisite: nothing here depends on the node, yarn
-# or make on the machine that starts the run.
+# see tests/e2e/firefox/Dockerfile.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -23,14 +18,6 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
 
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -39,20 +26,16 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
-    trap cleanup EXIT
-    trap 'cleanup; exit 130' INT TERM
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
 
-    echo "Building the pinned Firefox e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
-        -f tests/e2e/firefox/Dockerfile .
+    # The build context is tests/e2e/firefox/ and holds nothing but the
+    # Dockerfile: the harness itself arrives over the bind mount below, so
+    # editing it never invalidates an image layer.
+    echo "Building the pinned Firefox e2e image..."
+    docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
 
     echo "Running the Firefox e2e suite..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
     # --network none: the suite stubs nothing, so this is what keeps the
     #   run offline and deterministic. The extension swallows its own
@@ -60,8 +43,8 @@ main() {
     #   network note in README.md. Weaker than the Chrome suite's
     #   fixture interception, and honestly so — it proves no request
     #   escaped, but it cannot report which ones were attempted.
-    # HOME=/tmp: the image's root home is not a reliable place for the
-    #   browser profile.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     #
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
@@ -69,8 +52,11 @@ main() {
     docker run --rm \
         --shm-size=1g \
         --network none \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/firefox/run.js dist/firefox
 }
 

script/vendor-blocklist

@@ -1,105 +0,0 @@
-#!/bin/sh
-# script/vendor-blocklist: refresh the vendored phishing blocklist at
-# src/shared/phishingBlocklist.json from its upstream source. Our own extension
-# to scripts-to-rule-them-all.
-#
-# This is build-time repo tooling and is not shipped. It is the one place in
-# this repo that names the upstream project, because a source reference that
-# does not say what the source is cannot be verified by anyone; the artifact it
-# writes carries no names at all (see src/shared/domainHash.js).
-# script/check-censored reads the name back out of this file rather than
-# repeating it, so it stays defined exactly once.
-#
-# Run it deliberately, not on every build: the output is committed, and the
-# extension does no runtime fetching, so the shipped list is exactly as fresh as
-# the last time someone ran this and landed the result. Re-run it, land the
-# diff, cut a release; that is the whole refresh path.
-#
-# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
-# below is an immutable ref — the upstream default branch moves several times a
-# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
-# commit serves. A mismatch is a hard failure: a vendoring step that accepts
-# whatever it is handed is a supply-chain hole, and this one feeds a security
-# warning shown to users.
-#
-# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
-# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
-# actually got. Verify that hash against the source independently before
-# recording it. Never copy the "actual" line in on trust.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Upstream, pinned 2026-08-17.
-UPSTREAM_ORG="MetaMask"
-UPSTREAM_REPO="eth-phishing-detect"
-UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
-UPSTREAM_FILE="src/config.json"
-UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
-
-OUTPUT="src/shared/phishingBlocklist.json"
-
-WORK=""
-
-cleanup() {
-    [ -z "$WORK" ] || rm -rf "$WORK"
-}
-trap cleanup EXIT INT TERM
-
-fail() {
-    echo "vendor-blocklist: $*" >&2
-    exit 1
-}
-
-sha256_of() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$1" | cut -d' ' -f1
-    elif command -v shasum >/dev/null 2>&1; then
-        shasum -a 256 "$1" | cut -d' ' -f1
-    else
-        fail "neither sha256sum nor shasum is available, so the fetched
-    source cannot be verified. Refusing to vendor unverified content."
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    command -v curl >/dev/null 2>&1 ||
-        fail "curl is required to fetch the upstream list"
-    command -v node >/dev/null 2>&1 ||
-        fail "node is required to build the artifact; run script/bootstrap"
-
-    WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
-        fail "could not create a working directory"
-
-    url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
-    echo "Fetching $url"
-    curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
-        fail "the fetch failed, so nothing was vendored"
-
-    actual="$(sha256_of "$WORK/source.json")"
-    if [ "$actual" != "$UPSTREAM_SHA256" ]; then
-        fail "sha256 mismatch on the fetched source.
-    expected: $UPSTREAM_SHA256
-    actual:   $actual
-    The pinned commit is immutable, so the same commit serving different bytes
-    means the content was substituted somewhere between upstream and here.
-    Nothing was written. Do not update the expectation to match unless you have
-    verified the new bytes independently."
-    fi
-    echo "Verified sha256 $actual"
-
-    node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
-        fail "the transform failed, so nothing was written"
-
-    if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
-        echo "vendor-blocklist: $OUTPUT is already up to date"
-        return 0
-    fi
-
-    cp "$WORK/out.json" "$OUTPUT"
-    echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
-}
-
-main "$@"

src/background/index.js

@@ -3,11 +3,7 @@
 // non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
 
 const { DEFAULT_RPC_URL } = require("../shared/constants");
-const {
-    SUPPORTED_CHAIN_IDS,
-    networkById,
-    networkByChainId,
-} = require("../shared/networks");
+const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
 const { onChainSwitch } = require("../shared/chainSwitch");
 const {
     state,
@@ -31,9 +27,14 @@ const {
     TX_STAGE_NONCE,
 } = require("../shared/approvalVerify");
 const { prepareApprovalTx } = require("../shared/approvalTx");
-const { isPhishingDomain } = require("../shared/phishingDomains");
+const {
+    isPhishingDomain,
+    refreshPhishingListOnSchedule,
+    initPhishingList,
+} = require("../shared/phishingDomains");
 const {
     BALANCE_REFRESH_ALARM,
+    PHISHING_REFRESH_ALARM,
     BALANCE_REFRESH_PERIOD_MINUTES,
     ensureRecurringAlarms,
     registerAlarmHandlers,
@@ -169,16 +170,6 @@ function approvedNonce(approvedTx) {
     }
 }
 
-// What the page is told when a request failed in a way the wallet has no
-// specific answer for. -32603 is the JSON-RPC internal error EIP-1474 defines
-// and EIP-1193 defers to for RPC-layer failures; no EIP-1193 4xxx code
-// describes "the wallet broke", and one is not invented here. The cause is
-// logged rather than put in the message: the page gets a stable sentence, the
-// background console gets the throw.
-const INTERNAL_ERROR_CODE = -32603;
-const INTERNAL_ERROR_MESSAGE =
-    "AutistMask could not complete this request because of an internal error.";
-
 async function getState() {
     const result = await storageGet("autistmask");
     return (
@@ -493,53 +484,13 @@ function requestSignApproval(origin, hostname, signParams, approvedFrom) {
     });
 }
 
-// Anything only the extension's own pages may say. A content script speaks
-// with the page's URL, so this is what separates the popup from the site the
-// popup is being asked about.
-function isExtensionSender(sender) {
-    const extUrl = runtime.getURL("");
-    return !!(sender && sender.url && sender.url.startsWith(extUrl));
-}
-
-// The approval popup's port: it carries the user's decision on a
-// site-connection approval, and its disconnect is how that approval learns the
-// popup closed without one.
-//
-// The decision travels this port rather than a one-off runtime.sendMessage()
-// for exactly one reason: the port is also what the popup's window.close()
-// disconnects. A message posted on a port is delivered before that port's
-// disconnect, so approve-then-close settles as an approval no matter how fast
-// the teardown is. Sent as a one-off message the two crossed on independent
-// channels with nothing ordering them, and the teardown won every time when
-// the prompt was driven in a tab: the user approved and the dApp was told they
-// had refused.
-//
-// TX and sign approvals do not decide here. They stay pending across a
-// disconnect — the user can reopen the toolbar popup — and are rejected by the
-// windows.onRemoved listener below.
+// Detect when an approval popup (browser-action) closes without a response.
+// TX and sign approvals now use windows.create() and are handled by the
+// windows.onRemoved listener below, but we still handle site-connection
+// approval disconnects here.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
-        if (pendingApprovals[id] && isExtensionSender(port.sender)) {
-            // The extension's own popup is on the other end, so its disconnect
-            // is a trustworthy "closed" and onRemoved below stands down. The
-            // sender check is what keeps that from being an off switch: a
-            // content script that guessed the id and held its port open would
-            // otherwise disable the only settlement path a prompt whose popup
-            // never connected has left, and the dApp would wait forever.
-            pendingApprovals[id].portConnected = true;
-        }
-        port.onMessage.addListener((msg) => {
-            if (!msg || msg.type !== "AUTISTMASK_APPROVAL_DECISION") return;
-            if (!isExtensionSender(port.sender)) return;
-            const approval = pendingApprovals[id];
-            if (!approval || approval.type === "tx" || approval.type === "sign")
-                return;
-            settleApproval(id, {
-                approved: !!msg.approved,
-                remember: !!msg.remember,
-            });
-        });
         port.onDisconnect.addListener(() => {
             const approval = pendingApprovals[id];
             if (approval) {
@@ -549,6 +500,7 @@ runtime.onConnect.addListener((port) => {
                 }
                 settleApproval(id, { approved: false, remember: false });
             }
+            resetPopupUrl();
         });
     }
 });
@@ -667,59 +619,15 @@ async function handleRpc(method, params, origin) {
         return { result: [] };
     }
 
-    // Both answered from currentNetwork(), which reads the module-level state
-    // singleton, and nothing populates that at module scope. A worker revived
-    // by the page's own message therefore held DEFAULT_STATE and told a page
-    // it was on mainnet while the user was on Sepolia
-    // (https://git.eeqj.de/sneak/AutistMask/issues/317).
-    //
-    // Answered from getState() rather than by loading the singleton. Any page
-    // reaches these two — neither is gated on a connection, and the injected
-    // provider sends eth_chainId on every page load — and loadState() replaces
-    // state.wallets wholesale, which would detach the address objects an
-    // in-flight backgroundRefresh() is mutating across its network round trip,
-    // so its saveState() would persist the pre-refresh balances while still
-    // stamping lastBalanceRefresh. getState() is the detached per-call storage
-    // read the other read handlers here already use.
-    // networkById(undefined) falls back to mainnet, matching the default for a
-    // profile with no stored networkId.
-    if (method === "eth_chainId" || method === "net_version") {
-        const s = await getState();
-        const net = networkById(s.networkId);
-        return {
-            result: method === "eth_chainId" ? net.chainId : net.networkVersion,
-        };
+    if (method === "eth_chainId") {
+        return { result: currentNetwork().chainId };
+    }
+
+    if (method === "net_version") {
+        return { result: currentNetwork().networkVersion };
     }
 
     if (method === "wallet_switchEthereumChain") {
-        // Gated exactly like the signing methods, and gated before the
-        // same-chain early return. Switching the chain is wallet-wide: it
-        // moves the network the popup shows and the endpoints every other
-        // tab is served from, so a page the user never connected to must
-        // not be able to do it. Ungated, any page could clear the
-        // [TESTNET] banner under a user who believed they were on Sepolia.
-        const s = await getState();
-        const activeAddress = await getActiveAddress();
-        const hostname = extractHostname(origin);
-        const allowed = s.allowedSites[activeAddress] || [];
-        if (
-            !allowed.includes(hostname) &&
-            !connectedSites[origin + ":" + activeAddress]
-        ) {
-            return { error: { code: 4100, message: "Unauthorized" } };
-        }
-
-        // onChainSwitch() mutates the module-level state singleton and then
-        // saves every field of it, and currentNetwork() reads the same
-        // singleton. This worker may have been started by this very message:
-        // nothing loads state at module scope, so without this the singleton
-        // is DEFAULT_STATE, the same-chain check compares against the wrong
-        // network, and the save writes empty wallets, empty allowedSites and
-        // the default endpoints over the user's stored profile
-        // (https://git.eeqj.de/sneak/AutistMask/issues/316). Same precedent
-        // as the transaction path below.
-        await loadState();
-
         const chainId = params?.[0]?.chainId;
         if (chainId === currentNetwork().chainId) {
             return { result: null };
@@ -1095,20 +1003,26 @@ async function backgroundRefresh() {
     await saveState();
 }
 
-// The recurring job runs off an alarm, not a timer. On Chrome MV3 this file is
+// Both recurring jobs run off alarms, not timers. On Chrome MV3 this file is
 // a service worker that the browser terminates after about 30 seconds idle,
 // so a setInterval would only ever survive until the first idle period and
 // module-level state does not outlive it. Alarms are held by the browser and
 // wake the worker to deliver them.
 registerAlarmHandlers({
     [BALANCE_REFRESH_ALARM]: backgroundRefresh,
+    // The scheduled refresh, which restores persisted state on a freshly
+    // revived worker and then fetches unconditionally. The freshness guards
+    // belong to the startup path; applying them here would make the tick skip
+    // itself.
+    [PHISHING_REFRESH_ALARM]: refreshPhishingListOnSchedule,
 });
 
 // Everything the background context needs re-established on start. This runs
 // on a fresh install, on browser startup, and on every revival of a
 // terminated worker, so it must be idempotent: ensureRecurringAlarms() only
-// creates alarms that are missing or carrying a stale period, and only clears
-// retired ones that are still registered.
+// creates alarms that are missing or carrying a stale period, and
+// initPhishingList() fetches only when the persisted timestamps say the list
+// is stale.
 //
 // On a fresh install the top-level call and the onInstalled listener both run,
 // close enough together that both could see an alarm missing and create it.
@@ -1119,7 +1033,10 @@ let backgroundJobsRun = null;
 
 function startBackgroundJobs() {
     if (backgroundJobsRun) return backgroundJobsRun;
-    backgroundJobsRun = ensureRecurringAlarms()
+    backgroundJobsRun = Promise.all([
+        ensureRecurringAlarms(),
+        initPhishingList(),
+    ])
         .catch((err) => {
             // An alarm that failed to schedule means a recurring job silently
             // never runs again; it must not be an unhandled rejection.
@@ -1147,21 +1064,10 @@ startBackgroundJobs();
 // outcome to the page — and the window is recorded as gone, so that an attempt
 // which then fails retryably settles instead of waiting in a window that no
 // longer exists.
-//
-// A site-connection approval whose popup connected its port is not decided
-// here. That popup approves and closes in the same breath, and this event
-// races the decision on a channel of its own — the same race the port exists
-// to end. Its port disconnect says the same thing this event does, in an order
-// that is defined, so the disconnect is left to say it. The window closing
-// before any port connected is the one case with nothing else to speak for it,
-// and is rejected here so the dApp is not left waiting on a window that is
-// gone.
 if (windowsNs && windowsNs.onRemoved) {
     windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const isSite = approval.type !== "tx" && approval.type !== "sign";
-            if (isSite && approval.portConnected) continue;
             const rejection = abandonedResult(
                 approval,
                 APPROVAL_REJECTED_CODE,
@@ -1187,40 +1093,25 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // keep fallback
             }
         }
-        handleRpc(msg.method, msg.params, trustedOrigin)
-            .then((response) => {
-                sendResponse(response);
-            })
-            .catch((err) => {
-                // Without this the page's window.ethereum.request() promise
-                // stays pending forever: no response is sent, the content
-                // script posts nothing back, and the dApp cannot tell the
-                // failure from a slow wallet. handleRpc does real work —
-                // state loads, provider calls, transaction population — so
-                // "it does not throw today" is not a property anyone is
-                // maintaining.
-                log.errorf("RPC request failed:", msg.method, err);
-                sendResponse({
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                });
-            });
+        handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
+            sendResponse(response);
+        });
         return true;
     }
 
     // Validate that popup-only messages originate from the extension itself.
-    // The site-connection decision is not here: it is a port message, and it
-    // is checked the same way where the port is served.
     const POPUP_ONLY_TYPES = [
         "AUTISTMASK_GET_APPROVAL",
+        "AUTISTMASK_APPROVAL_RESPONSE",
         "AUTISTMASK_TX_RESPONSE",
         "AUTISTMASK_SIGN_RESPONSE",
     ];
-    if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
-        sendResponse({ error: "Unauthorized sender" });
-        return false;
+    if (POPUP_ONLY_TYPES.includes(msg.type)) {
+        const extUrl = runtime.getURL("");
+        if (!sender.url || !sender.url.startsWith(extUrl)) {
+            sendResponse({ error: "Unauthorized sender" });
+            return false;
+        }
     }
 
     if (msg.type === "AUTISTMASK_GET_APPROVAL") {
@@ -1252,6 +1143,15 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         return false;
     }
 
+    if (msg.type === "AUTISTMASK_APPROVAL_RESPONSE") {
+        settleApproval(msg.id, {
+            approved: msg.approved,
+            remember: msg.remember,
+        });
+        resetPopupUrl();
+        return false;
+    }
+
     if (msg.type === "AUTISTMASK_TX_RESPONSE") {
         const approval = pendingApprovals[msg.id];
         if (!approval) return false;
@@ -1302,10 +1202,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
             return false;
         }
 
-        // Which phase the last-resort .catch() below reports. Everything up to
-        // the broadcastTransaction() call provably never reached the network,
-        // so an escape from there must not tell the user it might have.
-        let lastResortStage = TX_STAGE_VERIFY;
         (async () => {
             // The chain this attempt is on, read once. Verification below
             // refuses an artifact signed for any other chain, and the nonce
@@ -1389,7 +1285,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
 
             try {
                 const provider = getProvider(state.rpcUrl);
-                lastResortStage = TX_STAGE_BROADCAST;
                 const tx = await provider.broadcastTransaction(msg.rawSignedTx);
                 if (nonce !== null) spent.add(nonce);
                 settleApproval(
@@ -1421,28 +1316,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     stage: outcome.stage,
                 });
             }
-        })().catch((e) => {
-            // Every statement above is inside a try, but a throw from one of
-            // the catch blocks escapes as an unhandled rejection and neither
-            // the popup nor the page is ever answered. Settle both, through
-            // the same chokepoint as every other retirement.
-            log.errorf("transaction approval response failed:", e);
-            settleApproval(
-                msg.id,
-                {
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                },
-                { holdsClaim: true },
-            );
-            sendResponse({
-                error: INTERNAL_ERROR_MESSAGE,
-                retryable: false,
-                stage: lastResortStage,
-            });
-        });
+        })();
         return true;
     }
 
@@ -1526,25 +1400,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 }
                 sendResponse({ error: errMsg, retryable });
             }
-        })().catch((e) => {
-            // Same shape as the transaction path: a throw out of the catch
-            // block above would leave the popup and the page both waiting.
-            log.errorf("sign approval response failed:", e);
-            settleApproval(
-                msg.id,
-                {
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                },
-                { holdsClaim: true },
-            );
-            sendResponse({
-                error: INTERNAL_ERROR_MESSAGE,
-                retryable: false,
-            });
-        });
+        })();
         return true;
     }
 

src/content/inpage.js

@@ -79,7 +79,7 @@
         for (const cb of cbs) {
             try {
                 cb(data);
-            } catch {
+            } catch (e) {
                 // ignore listener errors
             }
         }
@@ -179,8 +179,7 @@
             return this;
         },
 
-        // Some dApps (wagmi) probe this object to decide whether the provider
-        // supports the de-facto standard extras. The name is theirs, not ours.
+        // Some dApps (wagmi) check this to confirm MetaMask-like behavior
         _metamask: {
             isUnlocked() {
                 return Promise.resolve(provider.selectedAddress !== null);

src/popup/index.js

@@ -12,6 +12,7 @@ const {
     setBackRenderer,
     pushCurrentView,
     goBack,
+    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 // Renders a view the popup lands on without having navigated to it forward:

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -13,7 +13,7 @@ function show() {
     list.innerHTML = getTopTokens(25)
         .map(
             (t) =>
-                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${escapeHtml(t.address)}" data-symbol="${escapeHtml(t.symbol)}" data-decimals="${escapeHtml(t.decimals)}">${escapeHtml(t.symbol)}</button>`,
+                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${t.address}" data-symbol="${t.symbol}" data-decimals="${t.decimals}">${t.symbol}</button>`,
         )
         .join("");
     list.querySelectorAll(".common-token").forEach((btn) => {

src/popup/views/addWallet.js

@@ -194,7 +194,7 @@ async function importPrivateKey(ctx) {
     let addr;
     try {
         addr = addressFromPrivateKey(key);
-    } catch {
+    } catch (e) {
         showFlash("Invalid private key.");
         return;
     }
@@ -246,7 +246,7 @@ async function importXprvKey(ctx) {
     let result;
     try {
         result = hdWalletFromXprv(xprv);
-    } catch {
+    } catch (e) {
         showFlash(
             "That extended private key is not valid. Please check it and try again.",
         );

src/popup/views/addressDetail.js

@@ -6,14 +6,13 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
+const { state, currentAddress, saveState } = require("../../shared/state");
 const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -45,6 +44,7 @@ function show() {
     state.selectedToken = null;
     const wallet = state.wallets[state.selectedWallet];
     const addr = wallet.addresses[state.selectedAddress];
+    const wi = state.selectedWallet;
     const ai = state.selectedAddress;
     $("address-title").textContent =
         wallet.name + " \u2014 Address " + (ai + 1);
@@ -222,12 +222,10 @@ function renderTransactions(txs) {
                   : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);
@@ -248,6 +246,7 @@ function renderTransactions(txs) {
         row.addEventListener("click", () => {
             const idx = parseInt(row.dataset.tx, 10);
             const tx = loadedTxs[idx];
+            const counterparty = tx.direction === "sent" ? tx.to : tx.from;
             tx.fromEns = ensNameMap.get(tx.from) || null;
             tx.toEns = ensNameMap.get(tx.to) || null;
             ctx.showTransactionDetail(tx);

src/popup/views/addressToken.js

@@ -9,7 +9,6 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     balanceLine,
     renderAddressHtml,
@@ -17,7 +16,7 @@ const {
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
+const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const {
@@ -125,11 +124,7 @@ function show() {
     currentSymbol = symbol;
 
     $("address-token-title").textContent =
-        wallet.name +
-        " \u2014 Address " +
-        (ai + 1) +
-        " \u2014 " +
-        displaySymbol(symbol);
+        wallet.name + " \u2014 Address " + (ai + 1) + " \u2014 " + symbol;
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -179,9 +174,7 @@ function show() {
             (knownToken && knownToken.symbol) ||
             null;
         const tokenName = rawName ? escapeHtml(rawName) : null;
-        const tokenSymbol = rawSymbol
-            ? escapeHtml(displaySymbol(rawSymbol))
-            : null;
+        const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
         const tokenDecimals =
             tb && tb.decimals != null
                 ? tb.decimals
@@ -295,12 +288,10 @@ function renderTransactions(txs) {
         const counterparty = tx.direction === "sent" ? tx.to : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);
@@ -370,7 +361,7 @@ function init(_ctx) {
         }
         // Hide dropdown, show static token display
         $("send-token").classList.add("hidden");
-        let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
+        let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
         if (tokenId !== "ETH") {
             staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
         }

src/popup/views/approval.js

@@ -9,7 +9,7 @@ const {
     attachCopyHandlers,
     onViewLeave,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const { networkByChainId } = require("../../shared/networks");
 const {
     formatEther,
@@ -21,10 +21,6 @@ const {
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../../shared/approvalAmount");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
@@ -47,23 +43,6 @@ function formatTxValue(val) {
     return parts[0] + "." + dec;
 }
 
-// The amount line for a decoded ERC-20 call. With a known scale it is the
-// token quantity; with `decimals` null it is the base-unit integer with the
-// unknown scale stated, because formatting it with an assumed scale is what
-// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
-// carry, `display` is what the approval screen shows.
-function tokenAmountText(rawAmount, decimals, symbol) {
-    if (decimals === null) {
-        const unknown = unknownDecimalsAmount(rawAmount);
-        return { raw: unknown, display: unknown };
-    }
-    const formatted = formatTxValue(formatUnits(rawAmount, decimals));
-    return {
-        raw: formatted,
-        display: formatted + (symbol ? " " + symbol : ""),
-    };
-}
-
 function tokenLabel(address) {
     const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
     return t ? t.symbol : null;
@@ -80,15 +59,7 @@ function decodeCalldata(data, toAddress) {
         if (parsed) {
             const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
             const tokenSymbol = token ? token.symbol : null;
-            // null when no source knows this token's scale. It is not
-            // defaulted to 18: an amount formatted with a guessed scale is
-            // the wrong number, and for a token with fewer decimals than the
-            // guess it is the wrong number in the direction that reads as
-            // zero. See tokenAmountText().
-            const tokenDecimals = resolveTokenDecimals(toAddress, {
-                trackedTokens: state.trackedTokens,
-                wallets: state.wallets,
-            });
+            const tokenDecimals = token ? token.decimals : 18;
             const contractLabel = tokenSymbol
                 ? tokenSymbol + " (" + toAddress + ")"
                 : toAddress;
@@ -100,11 +71,12 @@ function decodeCalldata(data, toAddress) {
                     "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                 );
                 const isUnlimited = rawAmount === maxUint;
-                // An unbounded allowance needs no scale to describe, so it is
-                // still named rather than refused.
-                const amount = isUnlimited
-                    ? { raw: "Unlimited", display: "Unlimited" }
-                    : tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
+                const amountRaw = isUnlimited
+                    ? "Unlimited"
+                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
+                const amountStr = isUnlimited
+                    ? "Unlimited"
+                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Approval",
@@ -125,8 +97,8 @@ function decodeCalldata(data, toAddress) {
                         },
                         {
                             label: "Amount",
-                            value: amount.display,
-                            rawValue: amount.raw,
+                            value: amountStr,
+                            rawValue: amountRaw,
                         },
                     ],
                 };
@@ -135,11 +107,11 @@ function decodeCalldata(data, toAddress) {
             if (parsed.name === "transfer") {
                 const to = parsed.args[0];
                 const rawAmount = parsed.args[1];
-                const amount = tokenAmountText(
-                    rawAmount,
-                    tokenDecimals,
-                    tokenSymbol,
+                const amountRaw = formatTxValue(
+                    formatUnits(rawAmount, tokenDecimals),
                 );
+                const amountStr =
+                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Transfer",
@@ -156,8 +128,8 @@ function decodeCalldata(data, toAddress) {
                         { label: "Recipient", value: to, address: to },
                         {
                             label: "Amount",
-                            value: amount.display,
-                            rawValue: amount.raw,
+                            value: amountStr,
+                            rawValue: amountRaw,
                         },
                     ],
                 };
@@ -471,7 +443,7 @@ function showSignApproval(details) {
 // describe the approval is the same outcome as an approval that is gone.
 async function show(id) {
     approvalId = id;
-    approvalPort = runtimeApi().connect({ name: "approval:" + id });
+    runtimeApi().connect({ name: "approval:" + id });
 
     let details = null;
     try {
@@ -504,14 +476,6 @@ async function show(id) {
 }
 
 let approvalId = null;
-// The port this approval was opened on. Closing this window disconnects it,
-// and the background treats that disconnect as "closed without deciding" for a
-// site connection — so the decision goes out on this same port and not as a
-// one-off message. One channel is ordered: a message posted on it is delivered
-// before its own disconnect, however immediately the close follows. Two
-// channels were not, and the close won, reporting a user who approved as
-// having refused.
-let approvalPort = null;
 let pendingTxDetails = null;
 // The exact objects shown to the user, kept so the popup signs what it
 // displayed rather than re-fetching or re-populating anything at approval
@@ -579,29 +543,7 @@ function clearSignPassword() {
     hideError("approve-sign-error");
 }
 
-// Answer a site-connection approval and close. The decision goes out on the
-// approval port — see approvalPort above for why — and carries no approval id,
-// because the port name already names the approval the background will settle.
-// The post is guarded because a throw must not cost the close: posting on a
-// port whose background worker has been torn down throws, and the approval it
-// would have settled died with that worker, so the only thing left to do is
-// what the user asked for — go away.
-function decideSite(approved) {
-    if (approvalPort) {
-        try {
-            approvalPort.postMessage({
-                type: "AUTISTMASK_APPROVAL_DECISION",
-                approved,
-                remember: $("approve-remember").checked,
-            });
-        } catch {
-            // Nothing to report it to; the window closes either way.
-        }
-    }
-    window.close();
-}
-
-function init(_ctx) {
+function init(ctx) {
     onViewLeave("approve-tx", clearTxPassword);
     onViewLeave("approve-sign", clearSignPassword);
 
@@ -611,11 +553,25 @@ function init(_ctx) {
     });
 
     $("btn-approve").addEventListener("click", () => {
-        decideSite(true);
+        const remember = $("approve-remember").checked;
+        notify({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: true,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-reject").addEventListener("click", () => {
-        decideSite(false);
+        const remember = $("approve-remember").checked;
+        notify({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: false,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-approve-tx").addEventListener("click", async () => {

src/popup/views/confirmTx.js

@@ -2,21 +2,28 @@
 // Shows transaction details, warnings, errors. On Sign & Send,
 // reads inline password, decrypts secret, signs and broadcasts.
 
-const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
+const {
+    parseEther,
+    parseUnits,
+    formatEther,
+    formatUnits,
+    Contract,
+} = require("ethers");
 const {
     $,
     showError,
     hideError,
     showView,
+    showFlash,
+    flashCopyFeedback,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
     onViewLeave,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -26,10 +33,6 @@ const {
     getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
-const {
-    displayedDecimals,
-    transferAmountUnits,
-} = require("../../shared/transferAmount");
 const {
     CODES,
     FEE_PENDING,
@@ -58,7 +61,7 @@ function restore() {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function confirmAddressHtml(address, ensName, title) {
@@ -82,11 +85,7 @@ function show(txInfo) {
     feeWei = null;
 
     const isErc20 = txInfo.token !== "ETH";
-    // The raw symbol is the price-table key; the capped one is what the
-    // screen says. Truncating before the lookup would silently drop the
-    // price of any token whose symbol is long enough to be capped.
-    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
-    const symbol = displaySymbol(rawSymbol);
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
 
     // Transaction type
     if (isErc20) {
@@ -128,7 +127,7 @@ function show(txInfo) {
 
     // Amount (with inline USD)
     const ethPrice = getPrice("ETH");
-    const tokenPrice = getPrice(rawSymbol);
+    const tokenPrice = getPrice(symbol);
     const amountNum = parseFloat(txInfo.amount);
     const price = isErc20 ? tokenPrice : ethPrice;
     const amountUsd = price ? amountNum * price : null;
@@ -161,12 +160,7 @@ function show(txInfo) {
         warningsEl.innerHTML = localWarnings
             .map(
                 (w) =>
-                    // Only the three hardcoded strings in
-                    // src/shared/addressWarnings.js reach this today, but
-                    // src/shared/etherscanLabels.js already builds a
-                    // `warning` out of scraped explorer markup, so this is
-                    // one wiring change away from carrying remote text.
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
             )
             .join("");
         warningsEl.style.visibility = "visible";
@@ -216,7 +210,7 @@ function show(txInfo) {
 // touches already occupies its space, so re-running it never moves anything.
 function renderValidation(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-    const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
 
     const { canSend, codes } = validateTransfer({
         isErc20,
@@ -316,17 +310,8 @@ async function estimateGas(txInfo) {
             });
         } else {
             const contract = new Contract(txInfo.token, ERC20_ABI, provider);
-            // The scale the screen is rendering with, not the contract's own
-            // answer: the estimate has to be for the transfer that would be
-            // signed, and that one is encoded from what was displayed. See
-            // transferAmount.js. A pending transaction that carries no usable
-            // scale throws here, which reports the fee as unknown and leaves
-            // Send blocked — an amount that cannot be checked against the
-            // screen is never estimated for, let alone sent.
-            const amount = parseUnits(
-                txInfo.amount,
-                displayedDecimals(txInfo.tokenDecimals),
-            );
+            const decimals = await contract.decimals();
+            const amount = parseUnits(txInfo.amount, decimals);
             gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
                 from: txInfo.from,
             });
@@ -414,7 +399,7 @@ function clearPassword() {
     hideError("confirm-tx-password-error");
 }
 
-function init(_ctx) {
+function init(ctx) {
     onViewLeave("confirm-tx", clearPassword);
 
     $("btn-confirm-send").addEventListener("click", async () => {
@@ -436,7 +421,7 @@ function init(_ctx) {
                 wallet.encryptedSecret,
                 password,
             );
-        } catch {
+        } catch (e) {
             showError(
                 "confirm-tx-password-error",
                 "That password is incorrect. Please try again.",
@@ -468,16 +453,8 @@ function init(_ctx) {
                     ERC20_ABI,
                     connectedSigner,
                 );
-                // The contract's decimals() is read to be COMPARED with the
-                // scale the screen rendered this amount at, not to encode with:
-                // encoding from it signs whatever the contract answers now,
-                // which is not what the user read. A disagreement throws and is
-                // reported on the error screen. See transferAmount.js.
-                const amount = transferAmountUnits(
-                    pendingTx.amount,
-                    pendingTx.tokenDecimals,
-                    await contract.decimals(),
-                );
+                const decimals = await contract.decimals();
+                const amount = parseUnits(pendingTx.amount, decimals);
                 tx = await contract.transfer(pendingTx.to, amount);
             }
 

src/popup/views/deleteAddress.js

@@ -11,7 +11,6 @@ const {
     $,
     showView,
     showFlash,
-    escapeHtml,
     goBack,
     renderAddressHtml,
     attachCopyHandlers,
@@ -93,7 +92,7 @@ function balanceWarningHtml(addr) {
     if (!addressHoldsFunds(addr)) return " ";
     const line = formatAddressTotal(getAddressValue(addr));
     const total = line
-        ? `<div class="text-xs text-muted mt-1">${escapeHtml(line)}</div>`
+        ? `<div class="text-xs text-muted mt-1">${line}</div>`
         : "";
     return (
         `<p class="mb-1">This address holds a balance. Removing it does not ` +

src/popup/views/deleteWallet.js

@@ -73,7 +73,7 @@ function init(_ctx) {
         // Verify password against the wallet's encrypted data
         try {
             await decryptWithPassword(wallet.encryptedSecret, pw);
-        } catch {
+        } catch (_e) {
             $("delete-wallet-flash").textContent =
                 "That password is incorrect. Please try again.";
             $("delete-wallet-flash").style.visibility = "visible";

src/popup/views/exportPrivkey.js

@@ -112,7 +112,7 @@ function show(walletIdx, addrIdx) {
 async function reveal() {
     const password = $("export-privkey-password").value;
     if (!password) {
-        fail("Please enter your password.");
+        fail("Password is required.");
         return;
     }
     if (walletIndex === null) {

src/popup/views/helpers.js

@@ -1,22 +1,8 @@
 // Shared DOM helpers used by all views.
-//
-// Escaping rule for every view in this directory, since they all build
-// markup by concatenation: any VALUE interpolated into an innerHTML string
-// goes through escapeHtml(), whatever its provenance looks like today. The
-// only interpolations left bare are markup FRAGMENTS this code just built
-// (a rendered dot, an icon, a composed row), which escaping would turn into
-// visible angle brackets, and locally computed numbers and loop indices.
-// The distinction is meant to be greppable: an unescaped `${` next to a
-// name that reads like data is a defect.
 
-// escapeHtml lives in src/shared/html.js, where the escape and the
-// reasoning behind it are; it is re-exported below so views keep importing
-// it from here.
-const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { displaySymbol } = require("../../shared/symbolDisplay");
 const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
@@ -191,26 +177,17 @@ function showFlash(msg, duration = 2000) {
     }, duration);
 }
 
-// One row of the balance list: symbol, quantity, fiat value.
-//
-// `symbol` is the ERC-20's own symbol() as the block explorer reported it,
-// so it is attacker-chosen markup until it has been through escapeHtml, and
-// attacker-chosen length until it has been through displaySymbol. This is
-// the row that issue #307 was reported against: every screen that lists a
-// holding renders through here.
 function balanceLine(symbol, amount, price, tokenId) {
     const qty = amount.toFixed(4);
     const usd = price ? formatUsd(amount * price) || " " : " ";
-    // tokenId is a contract address out of the same explorer JSON, and it
-    // lands inside a quoted attribute.
-    const tokenAttr = tokenId ? ` data-token="${escapeHtml(tokenId)}"` : "";
+    const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
     const clickClass = tokenId
         ? " cursor-pointer hover:bg-hover balance-row"
         : "";
     return (
         `<div class="flex text-xs${clickClass}"${tokenAttr}>` +
         `<span class="flex justify-between" style="width:42ch;max-width:100%">` +
-        `<span>${escapeHtml(displaySymbol(symbol))}</span>` +
+        `<span>${symbol}</span>` +
         `<span>${qty}</span>` +
         `</span>` +
         `<span class="text-right text-muted flex-1">${usd}</span>` +
@@ -312,6 +289,12 @@ function addressDotHtml(address) {
     return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
 }
 
+function escapeHtml(s) {
+    const div = document.createElement("div");
+    div.textContent = s;
+    return div.innerHTML;
+}
+
 // Look up an address across all wallets and return its title
 // (e.g. "Address 1.2") or null if it's not one of ours.
 function addressTitle(address, wallets) {
@@ -399,26 +382,13 @@ const EXT_ICON =
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
     `</svg></span>`;
 
-// Block-explorer URLs. The origin is a per-network constant from
-// src/shared/networks.js; only the path segment is data, and it comes out
-// of explorer JSON (a transaction's from/to, a token's address_hash), which
-// nothing upstream validates as hex. percent-encoding it keeps a segment
-// that contains a slash, a query or a fragment from re-pointing the link
-// somewhere else in the explorer.
-function explorerUrl(kind, value) {
-    return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
-}
-
 function etherscanAddressUrl(address) {
-    return explorerUrl("address", address);
+    return `${currentNetwork().explorerUrl}/address/${address}`;
 }
 
-// The URL still has to be escaped on the way into href="...": encoding
-// governs what the URL means, escaping governs whether it stays inside the
-// attribute.
 function etherscanLinkHtml(url) {
     return (
-        `<a href="${escapeHtml(url)}" target="_blank" rel="noopener" ` +
+        `<a href="${url}" target="_blank" rel="noopener" ` +
         `class="inline-flex items-center">${EXT_ICON}</a>`
     );
 }
@@ -522,7 +492,6 @@ module.exports = {
     addressColor,
     addressDotHtml,
     escapeHtml,
-    displaySymbol,
     addressTitle,
     formatAddressHtml,
     renderAddressHtml,
@@ -530,7 +499,6 @@ module.exports = {
     attachCopyHandlers,
     etherscanAddressUrl,
     etherscanLinkHtml,
-    explorerUrl,
     EXT_ICON,
     truncateMiddle,
     isoDate,

src/popup/views/home.js

@@ -2,13 +2,13 @@ const {
     $,
     showView,
     showFlash,
+    flashCopyFeedback,
     balanceLinesForAddress,
     isoDate,
     timeAgo,
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
@@ -110,13 +110,10 @@ function renderHomeTxList(ctx) {
                 : tx.direction === "sent" || tx.direction === "contract"
                   ? tx.to
                   : tx.from;
-        // directionLabel is the explorer's own method name for a contract
-        // call, title-cased — attacker-chosen for an attacker's contract.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const title = addressTitle(counterparty, state.wallets);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr = title || truncateMiddle(counterparty, maxAddr);
@@ -230,7 +227,7 @@ function walletListHtml() {
         const defect = walletDefect(wallet);
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
-        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
+        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
         // No "+" on a defective wallet: deriving another address from that
         // xpub would only add one more address the key does not produce
         // under the standard path.
@@ -254,13 +251,10 @@ function walletListHtml() {
             const titleBold = isActive ? "font-bold" : "";
             html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
             if (addr.ensName) {
-                // An ENS reverse record is whatever the name owner set it
-                // to; renderAddressHtml() escapes its own copy of this and
-                // this list was the one that did not.
-                html += `<div class="text-xs font-bold flex items-center">${dot}${escapeHtml(addr.ensName)}</div>`;
+                html += `<div class="text-xs font-bold flex items-center">${dot}${addr.ensName}</div>`;
             }
             html += `<div class="flex text-xs items-center justify-between">`;
-            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${escapeHtml(addr.address)}</span>`;
+            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
             html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
             html += `</div>`;
             const addrTotal = formatAddressTotal(getAddressValue(addr));

src/popup/views/receive.js

@@ -5,7 +5,6 @@ const {
     flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
-    displaySymbol,
     attachCopyHandlers,
     goBack,
 } = require("./helpers");
@@ -45,7 +44,7 @@ function show() {
         }
         warningEl.textContent =
             "This is an ERC-20 token. Only send " +
-            displaySymbol(symbol) +
+            symbol +
             " on " +
             currentNetwork().name +
             " to this address. Sending tokens on other networks will result in permanent loss.";
@@ -58,7 +57,7 @@ function show() {
     attachCopyHandlers("view-receive");
 }
 
-function init(_ctx) {
+function init(ctx) {
     $("btn-receive-copy").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {

src/popup/views/send.js

@@ -4,7 +4,7 @@ const {
     $,
     showFlash,
     addressTitle,
-    displaySymbol,
+    escapeHtml,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
@@ -132,7 +132,7 @@ function renderSendTokenSelect(addr) {
         if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
         const opt = document.createElement("option");
         opt.value = t.address;
-        opt.textContent = displaySymbol(t.symbol);
+        opt.textContent = t.symbol;
         sel.appendChild(opt);
     }
 }
@@ -210,7 +210,7 @@ function init(_ctx) {
                 }
                 resolvedTo = resolved;
                 ensName = to;
-            } catch {
+            } catch (e) {
                 showFlash("Failed to resolve ENS name.");
                 return;
             }
@@ -221,11 +221,6 @@ function init(_ctx) {
 
         let tokenSymbol = null;
         let tokenBalance = null;
-        // The scale the amount and the balance below are rendered at, carried
-        // forward so the transfer is encoded with the number the user read
-        // rather than with whatever the contract answers at signing time. See
-        // src/shared/transferAmount.js.
-        let tokenDecimals = null;
         if (token !== "ETH") {
             const tb = (addr.tokenBalances || []).find(
                 (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -236,7 +231,6 @@ function init(_ctx) {
                 state.trackedTokens,
             );
             tokenBalance = tb ? tb.balance || "0" : "0";
-            tokenDecimals = tb ? tb.decimals : null;
         }
 
         ctx.showConfirmTx({
@@ -248,7 +242,6 @@ function init(_ctx) {
             balance: addr.balance,
             tokenSymbol: tokenSymbol,
             tokenBalance: tokenBalance,
-            tokenDecimals: tokenDecimals,
         });
     });
 

src/popup/views/settings.js

@@ -4,7 +4,6 @@ const {
     updateDebugBanner,
     showFlash,
     escapeHtml,
-    displaySymbol,
     flashCopyFeedback,
     goBack,
     pushCurrentView,
@@ -15,6 +14,7 @@ const {
     parseDustThresholdGwei,
 } = require("../dustThreshold");
 const { state, saveState, currentNetwork } = require("../../shared/state");
+const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
@@ -44,11 +44,8 @@ function renderSiteList(containerId, siteMap, stateKey) {
     let html = "";
     hostnames.forEach((hostname) => {
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
-        // A hostname the URL parser produced cannot carry a delimiter, so
-        // this is escaped for the rule rather than for a known hole — the
-        // rule being that nothing reaches innerHTML unescaped.
-        html += `<span>${escapeHtml(hostname)}</span>`;
-        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
+        html += `<span>${hostname}</span>`;
+        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -77,10 +74,9 @@ function renderTrackedTokens() {
     }
     let html = "";
     state.trackedTokens.forEach((token, idx) => {
-        const sym = escapeHtml(displaySymbol(token.symbol));
         const label = token.name
-            ? escapeHtml(token.name) + " (" + sym + ")"
-            : sym;
+            ? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
+            : escapeHtml(token.symbol);
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span>${label}</span>`;
         html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
@@ -172,7 +168,10 @@ function renderWalletListSettings() {
 function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
-    $("settings-network").value = state.networkId;
+    const networkSelect = $("settings-network");
+    if (networkSelect) {
+        networkSelect.value = state.networkId;
+    }
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -284,13 +283,15 @@ function init(ctx) {
     });
 
     const networkSelect = $("settings-network");
-    networkSelect.addEventListener("change", async () => {
-        const newId = networkSelect.value;
-        const net = await onChainSwitch(newId);
-        $("settings-rpc").value = state.rpcUrl;
-        $("settings-blockscout").value = state.blockscoutUrl;
-        showFlash("Switched to " + net.name + ".");
-    });
+    if (networkSelect) {
+        networkSelect.addEventListener("change", async () => {
+            const newId = networkSelect.value;
+            const net = await onChainSwitch(newId);
+            $("settings-rpc").value = state.rpcUrl;
+            $("settings-blockscout").value = state.blockscoutUrl;
+            showFlash("Switched to " + net.name + ".");
+        });
+    }
 
     $("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
     $("settings-show-zero-balances").addEventListener("change", async () => {

src/popup/views/settingsAddToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -26,11 +26,11 @@ function renderTop10() {
                 : "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
             return (
                 `<button class="settings-addtoken-quick ${cls}"` +
-                ` data-address="${escapeHtml(t.address)}"` +
-                ` data-symbol="${escapeHtml(t.symbol)}"` +
-                ` data-decimals="${escapeHtml(t.decimals)}"` +
-                ` data-name="${escapeHtml(t.name || "")}"` +
-                `${tracked ? " disabled" : ""}>${escapeHtml(t.symbol)}</button>`
+                ` data-address="${t.address}"` +
+                ` data-symbol="${t.symbol}"` +
+                ` data-decimals="${t.decimals}"` +
+                ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
+                `${tracked ? " disabled" : ""}>${t.symbol}</button>`
             );
         })
         .join("");
@@ -62,11 +62,11 @@ function renderDropdown() {
         const tracked = isTracked(t.address);
         const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
         html +=
-            `<option value="${escapeHtml(t.address)}"` +
-            ` data-symbol="${escapeHtml(t.symbol)}"` +
-            ` data-decimals="${escapeHtml(t.decimals)}"` +
-            ` data-name="${escapeHtml(t.name || "")}"` +
-            `${tracked ? " disabled" : ""}>${escapeHtml(label)}</option>`;
+            `<option value="${t.address}"` +
+            ` data-symbol="${t.symbol}"` +
+            ` data-decimals="${t.decimals}"` +
+            ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
+            `${tracked ? " disabled" : ""}>${label}</option>`;
     }
     sel.innerHTML = html;
 }

src/popup/views/transactionDetail.js

@@ -15,16 +15,16 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     goBack,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
 const { decodeCalldata } = require("./approval");
 
+let ctx;
+
 /**
  * Determine a human-readable transaction type string from tx fields.
  */
@@ -46,7 +46,7 @@ function getTransactionType(tx) {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function txAddressHtml(address, ensName, title) {
@@ -58,7 +58,7 @@ function txAddressHtml(address, ensName, title) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -103,10 +103,9 @@ function render() {
     $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
 
     // Exact amount (full precision, copyable)
-    const detailSym = displaySymbol(tx.symbol);
     const exactStr = tx.exactValue
-        ? tx.exactValue + " " + detailSym
-        : tx.directionLabel + " " + detailSym;
+        ? tx.exactValue + " " + tx.symbol
+        : tx.directionLabel + " " + tx.symbol;
     $("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
 
     // Native quantity (raw integer, copyable)
@@ -136,7 +135,7 @@ function render() {
     if (tokenContractSection && tokenContractEl) {
         if (tx.contractAddress) {
             const dot = addressDotHtml(tx.contractAddress);
-            const link = explorerUrl("token", tx.contractAddress);
+            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
             tokenContractEl.innerHTML =
                 `<div class="flex items-center">${dot}` +
                 copyableHtml(tx.contractAddress, "break-all") +
@@ -167,7 +166,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.to);
+    loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
 
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
@@ -188,7 +187,7 @@ function showDetailField(sectionId, contentId, value) {
 function populateOnChainDetails(txData) {
     // Block number
     if (txData.block_number != null) {
-        const blockLink = explorerUrl("block", String(txData.block_number));
+        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
         const blockSection = $("tx-detail-block-section");
         const blockEl = $("tx-detail-block");
         if (blockSection && blockEl) {
@@ -275,7 +274,7 @@ function populateOnChainDetails(txData) {
     }
 }
 
-async function loadFullTxDetails(txHash, toAddress) {
+async function loadFullTxDetails(txHash, toAddress, isContractCall) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -312,7 +311,7 @@ async function loadFullTxDetails(txHash, toAddress) {
                     // Token entry: show symbol on its own line, then address via shared renderer
                     const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                     if (tokenSymbol) {
-                        detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
+                        detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                     }
                     detailsHtml += renderAddressHtml(d.address);
                 } else if (d.address) {
@@ -350,9 +349,8 @@ async function loadFullTxDetails(txHash, toAddress) {
     }
 }
 
-// The ctx this view is initialized with is unused: this module is the leaf of
-// the navigation, and the other views reach it through their own ctx.
 function init(_ctx) {
+    ctx = _ctx;
     $("btn-tx-back").addEventListener("click", () => {
         goBack();
     });

src/popup/views/txStatus.js

@@ -9,12 +9,10 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
@@ -64,13 +62,13 @@ function toAddressHtml(address) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
 }
 
 function blockNumberHtml(blockNumber) {
     const num = String(blockNumber);
-    const link = explorerUrl("block", num);
+    const link = `${currentNetwork().explorerUrl}/block/${num}`;
     return copyableHtml(num) + etherscanLinkHtml(link);
 }
 
@@ -82,10 +80,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     endWait();
     const id = waitId;
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     $("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
     $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
     $("wait-tx-hash").innerHTML = txHashHtml(txHash);
@@ -216,10 +211,7 @@ function restoreWait() {
 function showSuccess(txInfo, txHash, blockNumber) {
     endWait();
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
@@ -237,6 +229,10 @@ function tokenLabel(address) {
     return t ? t.symbol : null;
 }
 
+function etherscanTokenLink(address) {
+    return `${currentNetwork().explorerUrl}/token/${address}`;
+}
+
 function decodedDetailsHtml(decoded) {
     if (!decoded || !decoded.details) return "";
     let html = `<div class="border border-border border-dashed p-2 mb-3">`;
@@ -307,10 +303,7 @@ function renderSuccess() {
 function showError(txInfo, txHash, message) {
     endWait();
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,

src/shared/alarms.js

@@ -17,26 +17,16 @@
 // run finished and the alarm fires one run-duration earlier than that. Every
 // guard must therefore either be strictly shorter than the period it gates or
 // be bypassed on the scheduled tick — see backgroundRefresh() in
-// src/background/index.js.
+// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
 
 const { alarmsApi } = require("./browserApi");
 
 const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
-
-// Alarms this extension used to create and no longer has a handler for. A
-// browser keeps an alarm until something clears it, so a job that is deleted
-// from the code goes on waking the service worker on its old schedule forever,
-// on every install that ever ran the version which created it. Removing the job
-// means removing the alarm, so retired names are listed here and cleared on
-// every start until the installs that carry them are long gone.
-const OBSOLETE_ALARMS = [
-    // The 24-hour phishing blocklist refresh, retired when the runtime fetch
-    // was removed and the list became purely build-time vendored.
-    "autistmask-phishing-refresh",
-];
+const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
 
 const MIN_ALARM_PERIOD_MINUTES = 1;
 const BALANCE_REFRESH_PERIOD_MINUTES = 1;
+const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
 
 // alarmsApi() resolves on use rather than at module load: the worker is torn
 // down and re-evaluated repeatedly, and tests install a stub after requiring
@@ -75,34 +65,22 @@ async function ensureAlarm(name, periodInMinutes) {
 }
 
 /**
- * Clear every alarm this extension no longer handles.
+ * Ensure both recurring background jobs are scheduled. Safe to call on every
+ * worker start, on onInstalled and on onStartup.
  *
- * @returns {Promise<string[]>} the retired alarms this call actually cleared.
- */
-async function clearObsoleteAlarms() {
-    const api = alarmsApi();
-    if (!api || !api.clear) return [];
-    const cleared = [];
-    for (const name of OBSOLETE_ALARMS) {
-        if (await api.clear(name)) cleared.push(name);
-    }
-    return cleared;
-}
-
-/**
- * Ensure the recurring background jobs are scheduled, and that retired ones are
- * not. Safe to call on every worker start, on onInstalled and on onStartup.
- *
- * @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
- * call had to create, and which retired ones it removed.
+ * @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
+ * call had to create.
  */
 async function ensureRecurringAlarms() {
     const balance = await ensureAlarm(
         BALANCE_REFRESH_ALARM,
         BALANCE_REFRESH_PERIOD_MINUTES,
     );
-    const cleared = await clearObsoleteAlarms();
-    return { balance, cleared };
+    const phishing = await ensureAlarm(
+        PHISHING_REFRESH_ALARM,
+        PHISHING_REFRESH_PERIOD_MINUTES,
+    );
+    return { balance, phishing };
 }
 
 /**
@@ -124,10 +102,10 @@ function registerAlarmHandlers(handlers) {
 
 module.exports = {
     BALANCE_REFRESH_ALARM,
-    OBSOLETE_ALARMS,
+    PHISHING_REFRESH_ALARM,
     MIN_ALARM_PERIOD_MINUTES,
     BALANCE_REFRESH_PERIOD_MINUTES,
-    clearObsoleteAlarms,
+    PHISHING_REFRESH_PERIOD_MINUTES,
     ensureAlarm,
     ensureRecurringAlarms,
     registerAlarmHandlers,

src/shared/approvalAmount.js

@@ -1,103 +0,0 @@
-// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
-// to display when there is no such scale.
-//
-// The approval screen decodes `transfer` and `approve` calldata into a
-// quantity the user confirms against. That quantity is a base-unit integer,
-// and turning it into a number a person can read needs the token's decimals.
-// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
-// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
-// default of 18 it reads `0.0000`, and a user who reads zero signs.
-//
-// So a scale is either found or the amount is not formatted. Decimals are
-// looked for in the bundled token list, then in the tokens the user tracks,
-// then in what the block explorer reported for the contract; where none of
-// them answers, unknownDecimalsAmount() renders the base-unit integer with the
-// unknown scale stated, and no formatUnits() call is reached at all.
-//
-// This is the display counterpart to transferAmount.js, which takes the same
-// stance on the wallet's own send path: an amount whose scale is unknown or
-// disputed is refused rather than guessed at.
-
-// Solidity's decimals() is a uint8, and every source here is ultimately
-// reporting that call's result.
-const { MAX_DECIMALS } = require("./transferAmount");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
-
-// A decimals value as a number, or null if it is not one. The bundled list
-// stores numbers, the explorer's copy arrives as a string, and a token the
-// user added by hand can carry whatever lookupTokenInfo() got back, so the
-// accepted types are enumerated rather than coerced: Number([]) is 0 and
-// Number(true) is 1, so a coercing check would read an empty array as a scale
-// of zero and format the amount as whole tokens.
-function toDecimals(value) {
-    let n;
-    if (typeof value === "number") {
-        n = value;
-    } else if (typeof value === "bigint") {
-        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
-        n = Number(value);
-    } else if (typeof value === "string") {
-        if (!/^[0-9]+$/.test(value)) return null;
-        n = Number(value);
-    } else {
-        return null;
-    }
-    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
-    return n;
-}
-
-// Every decimals the explorer reported for this contract, across all the
-// addresses whose balances have been fetched. They describe one contract, so
-// they should agree; a set that does not agree is a scale in dispute, and this
-// screen has no way to tell which member is the true one.
-function explorerDecimals(lower, wallets) {
-    let found = null;
-    for (const wallet of wallets || []) {
-        for (const addr of wallet.addresses || []) {
-            for (const tb of addr.tokenBalances || []) {
-                if ((tb.address || "").toLowerCase() !== lower) continue;
-                const d = toDecimals(tb.decimals);
-                if (d === null) continue;
-                if (found !== null && found !== d) return null;
-                found = d;
-            }
-        }
-    }
-    return found;
-}
-
-// The decimals to render a token amount with, or null when nothing knows.
-// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
-function resolveTokenDecimals(tokenAddress, sources) {
-    const lower = (tokenAddress || "").toLowerCase();
-    if (!lower) return null;
-
-    const bundled = TOKEN_BY_ADDRESS.get(lower);
-    if (bundled) {
-        const d = toDecimals(bundled.decimals);
-        if (d !== null) return d;
-    }
-
-    const tracked = ((sources && sources.trackedTokens) || []).find(
-        (t) => (t.address || "").toLowerCase() === lower,
-    );
-    if (tracked) {
-        const d = toDecimals(tracked.decimals);
-        if (d !== null) return d;
-    }
-
-    return explorerDecimals(lower, sources && sources.wallets);
-}
-
-// What the amount line reads when the scale is unknown. The base units are
-// exact and the caveat is part of the same string, so the number on the screen
-// cannot be mistaken for a token quantity, and it can never read as zero for a
-// transfer that is not zero.
-function unknownDecimalsAmount(rawAmount) {
-    return String(rawAmount) + " base units (decimals unknown)";
-}
-
-module.exports = {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-};

src/shared/chainSwitch.js

@@ -19,26 +19,9 @@ async function onChainSwitch(newNetworkId) {
     const net = networkById(newNetworkId);
 
     // --- core identity ---
-    // Endpoints are remembered per network rather than reset to the
-    // defaults, because a user who points the wallet at their own node has
-    // no way to get that URL back once it is gone: overwriting it moved
-    // every address and every transaction onto a third-party endpoint
-    // silently and permanently.
-    //
-    // state.rpcUrl / state.blockscoutUrl stay the live endpoints of the
-    // active network, so nothing that reads them changes. The invariant is
-    // that for the ACTIVE network those two fields are authoritative and
-    // the map entry may be stale (Settings writes the fields directly);
-    // for every other network the map is authoritative. Snapshotting the
-    // outgoing network here, before the switch, is what reconciles them.
-    state.networkEndpoints[state.networkId] = {
-        rpcUrl: state.rpcUrl,
-        blockscoutUrl: state.blockscoutUrl,
-    };
-    const remembered = state.networkEndpoints[net.id] || {};
     state.networkId = net.id;
-    state.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
-    state.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
+    state.rpcUrl = net.defaultRpcUrl;
+    state.blockscoutUrl = net.defaultBlockscoutUrl;
 
     // --- price cache ---
     // Prices are chain-specific (testnet tokens are worthless,

src/shared/domainHash.js

@@ -1,41 +0,0 @@
-// The one definition of how a domain becomes a blocklist entry.
-//
-// The vendored phishing blocklist ships digests, not domain names: see
-// phishingDomains.js for why, and script/vendor-blocklist for how the artifact
-// is produced. Both sides have to agree exactly — a mismatch would silently
-// match nothing, which is a blocklist that quietly protects no one — so the
-// rule lives here and is required by both rather than written down twice.
-//
-// sha256 truncated to 64 bits. Truncation is what keeps the artifact small
-// enough to bundle (16 hex characters per entry rather than 64), and 64 bits is
-// far past what this has to withstand: over ~10^5 entries the chance that any
-// hostname a user visits collides with an entry it is not is about 10^-14 per
-// lookup, and a deliberate collision buys an attacker a false phishing warning
-// on a site they do not control, not a missed one. For scale, Safe Browsing
-// distributes 32-bit prefixes and resolves the rest against a server; this is
-// 32 bits more, with no server involved.
-
-const { sha256, toUtf8Bytes } = require("ethers");
-
-const HASH_ALGORITHM = "sha256";
-const HASH_HEX_CHARS = 16;
-
-/**
- * The blocklist entry for a domain: lowercased, hashed, truncated.
- *
- * @param {string} domain
- * @returns {string} HASH_HEX_CHARS lowercase hex characters, no 0x prefix.
- */
-function hashDomain(domain) {
-    // ethers returns "0x" + 64 hex characters.
-    return sha256(toUtf8Bytes(domain.toLowerCase())).slice(
-        2,
-        2 + HASH_HEX_CHARS,
-    );
-}
-
-module.exports = {
-    HASH_ALGORITHM,
-    HASH_HEX_CHARS,
-    hashDomain,
-};

src/shared/ens.js

@@ -4,7 +4,8 @@
 //
 // POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
 // so this module must not be pulled into src/background/. Anything the
-// background context needs to cache goes in extension storage instead.
+// background context needs to cache goes in extension storage instead (see
+// shared/phishingDomains.js).
 
 const { getProvider } = require("./balances");
 const { log } = require("./log");

src/shared/html.js

@@ -1,41 +0,0 @@
-// HTML escaping for values interpolated into an innerHTML string.
-//
-// Every view in src/popup/views/ builds markup by string concatenation, so
-// this is the only thing standing between a value the wallet did not author
-// and the extension's own DOM. The values that reach it are attacker
-// controlled by design: an ERC-20's symbol() and name() are whatever the
-// contract chooses to return, an ENS name is whatever the resolver returns,
-// and both arrive through the block explorer with no schema.
-//
-// It escapes both quote characters as well as the tag delimiters, because
-// the popup interpolates into attribute values as well as into element
-// text — copyableHtml() writes data-copy="..." and etherscanLinkHtml()
-// writes href="...". A `<`/`>`-only escape leaves an unquoted-attribute
-// break-out intact, and the round trip through a detached element's
-// textContent that used to implement this was exactly that escape: the
-// HTML serializer only escapes `&`, `<`, `>` and U+00A0 in a text node,
-// since a text node has no idea it is about to be pasted inside quotes.
-//
-// Deliberately a pure string function with no DOM dependency: it is called
-// on every rendered row, it is unit-testable without a document, and it
-// cannot be affected by the state of a document that an attacker-supplied
-// string has already been written into.
-
-const HTML_ESCAPES = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;",
-};
-
-// `&` is escaped first by virtue of being in the same pass: a sequential
-// replace would re-escape the ampersands it had just introduced.
-function escapeHtml(s) {
-    if (s === null || s === undefined) return "";
-    return String(s).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
-}
-
-module.exports = {
-    escapeHtml,
-};

src/shared/phishingDomains.js

@@ -1,109 +1,158 @@
-// Domain-based phishing detection against a blocklist vendored at build time.
+// Domain-based phishing detection using a vendored blocklist with delta updates.
 //
-// The list is produced by script/vendor-blocklist from a hash-pinned upstream
-// commit, committed as phishingBlocklist.json, and bundled. There is no runtime
-// fetch: the extension asks nobody anything to answer this question, so no third
-// party learns which sites a user connects to, and no third party decides what
-// this wallet warns about. The cost is staleness — the shipped list is exactly
-// as fresh as the last vendoring run that was released — and the refresh path is
-// re-running that script and shipping the diff.
+// A community-maintained phishing domain blocklist is vendored in
+// phishingBlocklist.json and bundled at build time. At runtime, we fetch
+// the live list periodically and keep only the delta (new entries not in
+// the vendored list) in memory. This keeps runtime memory usage small.
 //
-// The artifact holds digests, not domains: sha256 truncated to 64 bits, one
-// entry per 16 hex characters, concatenated in sorted order into a single
-// string (see domainHash.js). Three things follow from that shape, and all
-// three are the reason for it:
+// The domain-checker checks the in-memory delta first (fresh/recent scam
+// sites), then falls back to the vendored list.
 //
-//   - the extension ships no plaintext list of anyone's domain names, which is
-//     what makes a blocklist assembled elsewhere shippable here at all.
-//   - a lookup is a binary search over that string. Nothing is built at module
-//     load, which matters because the MV3 service worker is torn down when idle
-//     and re-evaluates this file on every wake.
-//   - the file is 1.7 MB rather than 8.7 MB.
-//
-// Nothing here is async: callers answer an approval prompt with the result.
+// If the delta and its fetch timestamp fit in 256 KiB they are persisted to
+// extension storage, so they survive termination of the MV3 service worker.
+// Extension storage, not localStorage: localStorage does not exist in a
+// service worker, so the previous persistence never ran on Chrome at all.
+// The stored timestamps are what keep a restarted worker from re-fetching on
+// every wake while still noticing an overdue update. Those guards apply to the
+// startup path only; the 24-hour alarm tick bypasses them, or it would veto
+// its own refresh — see updatePhishingList().
 
-const vendored = require("./phishingBlocklist.json");
-const { HASH_ALGORITHM, HASH_HEX_CHARS, hashDomain } = require("./domainHash");
+const vendoredConfig = require("./phishingBlocklist.json");
+const { storageLocal } = require("./browserApi");
 
-// The artifact is generated, so a shape it does not have is a build fault, not
-// a runtime condition. It is checked anyway, and loudly, because every way of
-// getting it wrong — a stale format, a truncated file, a different digest —
-// produces a blocklist that matches nothing at all while looking perfectly
-// healthy. A phishing check that silently answers "no" to everything is the one
-// failure this module must not have.
-function checkArtifact(a) {
-    const bad = (why) =>
-        new Error(
-            "phishingBlocklist.json " +
-                why +
-                ". It is generated by script/vendor-blocklist; re-run that " +
-                "rather than editing it.",
-        );
+const BLOCKLIST_URL =
+    "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 
-    if (!a || typeof a !== "object") throw bad("is not an object");
-    if (a.algorithm !== HASH_ALGORITHM) {
-        throw bad(
-            "declares algorithm " +
-                JSON.stringify(a.algorithm) +
-                ", but this build hashes with " +
-                HASH_ALGORITHM,
-        );
-    }
-    if (a.hashHexChars !== HASH_HEX_CHARS) {
-        throw bad(
-            "declares " +
-                JSON.stringify(a.hashHexChars) +
-                " hex characters per entry, but this build produces " +
-                HASH_HEX_CHARS,
-        );
-    }
-    if (typeof a.hashes !== "string") throw bad("has no hashes string");
-    if (!Number.isInteger(a.count) || a.count < 1) {
-        throw bad("declares no usable entry count");
-    }
-    if (a.hashes.length !== a.count * HASH_HEX_CHARS) {
-        throw bad(
-            "holds " +
-                a.hashes.length +
-                " hex characters, which is not the " +
-                a.count * HASH_HEX_CHARS +
-                " its count of " +
-                a.count +
-                " entries requires",
-        );
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+// Floor on how often an unscheduled path may hit the network. The worker is
+// revived every ~30 seconds while the browser is busy, and every revival runs
+// the startup path; without a persisted record of the last attempt, any state
+// that leaves lastFetchTime unset — a fetch that failed, or a delta too large
+// to store — would download the full list on every single wake.
+const MIN_FETCH_ATTEMPT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+
+const DELTA_STORAGE_KEY = "phishing-delta";
+const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
+
+// Vendored set — built once from the bundled JSON.
+const vendoredBlacklist = new Set(
+    (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
+);
+
+// Delta set — only entries from live list that are NOT in vendored.
+let deltaBlacklist = new Set();
+let lastFetchTime = 0;
+let lastAttemptTime = 0;
+let fetchPromise = null;
+let loadPromise = null;
+
+// storageLocal() resolves on use rather than at module load, so a test can
+// install a stub after requiring this module, and it returns null where the
+// API is absent — which is why the popup, with no reason to touch the delta,
+// loads fine without it.
+
+/**
+ * Sanitise a timestamp read back from storage.
+ *
+ * A value in the future is permanent poison: every guard here measures elapsed
+ * time as `Date.now() - stamp` and tests only the lower bound, so a stamp a
+ * year ahead suppresses updates for a year with no path that ever clears it.
+ * Clock skew and a restored profile backup both produce one. Since these
+ * timestamps only ever gate work, discarding an impossible one is safe: it
+ * costs at most a single extra fetch and restores a sane value immediately.
+ *
+ * @param {unknown} value
+ * @returns {number} the timestamp, or 0 if it is unusable.
+ */
+function sanitizeTimestamp(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+    if (value <= 0 || value > Date.now()) return 0;
+    return value;
+}
+
+/**
+ * Load the persisted delta and its timestamps from extension storage.
+ * Runs once per worker lifetime; every entry point funnels through
+ * ensureDeltaLoaded() so a wake from termination restores state exactly once.
+ *
+ * @returns {Promise<void>}
+ */
+async function loadDeltaFromStorage() {
+    const storage = storageLocal();
+    if (!storage) return;
+    try {
+        const result = await storage.get(DELTA_STORAGE_KEY);
+        const data = result && result[DELTA_STORAGE_KEY];
+        if (!data) return;
+        if (Array.isArray(data.blacklist)) {
+            deltaBlacklist = new Set(
+                data.blacklist.map((d) => d.toLowerCase()),
+            );
+        }
+        lastFetchTime = sanitizeTimestamp(data.lastFetchTime);
+        lastAttemptTime = sanitizeTimestamp(data.lastAttemptTime);
+    } catch {
+        // Storage unavailable or corrupt — start empty and re-fetch.
     }
 }
 
-checkArtifact(vendored);
-
-const HASHES = vendored.hashes;
-const COUNT = vendored.count;
+function ensureDeltaLoaded() {
+    if (!loadPromise) loadPromise = loadDeltaFromStorage();
+    return loadPromise;
+}
 
 /**
- * Is this digest one of the vendored entries?
+ * Persist the delta and its timestamps if they fit within MAX_DELTA_BYTES.
  *
- * Binary search over fixed-width records. The digests are lowercase hex of one
- * width, so lexicographic order is numeric order and the artifact is written
- * sorted; tests assert that ordering against the committed file, because an
- * unsorted artifact would fail lookups silently rather than loudly.
+ * The 256 KiB cap covers the delta and its freshness claim: when the delta is
+ * too large to keep, lastFetchTime goes with it, so the next start re-fetches
+ * rather than trusting a freshness claim for a delta it no longer holds.
+ * lastAttemptTime is written either way — it records that the network was
+ * contacted, which stays true whatever became of the response, and it is what
+ * stops a permanently oversized list from downloading on every worker wake.
  *
- * @param {string} hash
- * @returns {boolean}
+ * @returns {Promise<void>}
  */
-function hashListed(hash) {
-    let lo = 0;
-    let hi = COUNT - 1;
-    while (lo <= hi) {
-        const mid = (lo + hi) >> 1;
-        const at = HASHES.slice(
-            mid * HASH_HEX_CHARS,
-            (mid + 1) * HASH_HEX_CHARS,
-        );
-        if (at === hash) return true;
-        if (at < hash) lo = mid + 1;
-        else hi = mid - 1;
+async function saveDeltaToStorage() {
+    const storage = storageLocal();
+    if (!storage) return;
+    try {
+        const data = {
+            blacklist: Array.from(deltaBlacklist),
+            lastFetchTime,
+            lastAttemptTime,
+        };
+        const json = JSON.stringify(data);
+        if (json.length < MAX_DELTA_BYTES) {
+            await storage.set({ [DELTA_STORAGE_KEY]: data });
+        } else if (lastAttemptTime > 0) {
+            await storage.set({ [DELTA_STORAGE_KEY]: { lastAttemptTime } });
+        } else {
+            await storage.remove(DELTA_STORAGE_KEY);
+        }
+    } catch {
+        // Storage unavailable — skip silently
     }
-    return false;
+}
+
+/**
+ * Load a pre-parsed config and compute the delta against the vendored list.
+ * Used for both live fetches and testing.
+ *
+ * @param {{ blacklist?: string[] }} config
+ * @returns {Promise<void>} resolves once the delta has been persisted.
+ */
+function loadConfig(config) {
+    const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
+
+    // Delta = entries in the live list that are NOT in the vendored list
+    deltaBlacklist = new Set(
+        liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
+    );
+
+    lastFetchTime = Date.now();
+    return saveDeltaToStorage();
 }
 
 /**
@@ -126,33 +175,161 @@ function hostnameVariants(hostname) {
 
 /**
  * Check if a hostname is on the phishing blocklist.
+ * Checks delta first (fresh/recent scam sites), then vendored list.
+ *
+ * Synchronous by design — callers answer an approval prompt with it. On a
+ * worker that has just woken, the persisted delta may still be loading; the
+ * vendored list, which is bundled and always present, carries the check until
+ * it lands.
  *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
  */
 function isPhishingDomain(hostname) {
     if (!hostname) return false;
-    for (const variant of hostnameVariants(hostname)) {
-        if (hashListed(hashDomain(variant))) return true;
+    const variants = hostnameVariants(hostname);
+
+    // Check delta blacklist first (fresh/recent scam sites), then vendored
+    for (const v of variants) {
+        if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
     }
     return false;
 }
 
 /**
- * Return the blocklist size for diagnostics.
+ * Fetch the latest blocklist and compute delta against vendored data.
+ * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS,
+ * counted from the persisted timestamp so the cache outlives the worker.
+ *
+ * `force` is what makes the 24-hour alarm actually refresh every 24 hours.
+ * The alarm fires one period after the previous alarm, but lastFetchTime is
+ * stamped when that fetch *completed*, so an unforced tick lands one fetch
+ * latency inside its own TTL, skips, and turns the real cadence into 48 hours.
+ * Shortening the TTL instead would not fix it: the worker wakes every ~30
+ * seconds and the startup path re-checks the TTL each time, so a shortened TTL
+ * simply becomes the real cadence. The TTL is there to stop redundant fetches
+ * on wake, and the scheduled tick is not redundant, so it bypasses it.
+ *
+ * @param {{force?: boolean}} [opts] force: fetch unless one is already in
+ * flight, ignoring both the freshness and the retry guard. For the scheduled
+ * alarm tick only.
+ * @returns {Promise<void>}
+ */
+async function updatePhishingList({ force = false } = {}) {
+    // A worker that has just been revived knows nothing until the persisted
+    // record is back in memory; without this the freshness check below would
+    // always see 0 and re-fetch on every wake.
+    await ensureDeltaLoaded();
+
+    if (!force) {
+        const now = Date.now();
+        // Skip if recently fetched.
+        if (lastFetchTime > 0 && now - lastFetchTime < CACHE_TTL_MS) return;
+        // Skip if the network was contacted recently and the result was not
+        // usable — a failed fetch or an oversized delta leaves lastFetchTime
+        // unset, and without this every wake would retry.
+        if (
+            lastAttemptTime > 0 &&
+            now - lastAttemptTime < MIN_FETCH_ATTEMPT_INTERVAL_MS
+        ) {
+            return;
+        }
+    }
+
+    // De-duplicate concurrent calls
+    if (fetchPromise) return fetchPromise;
+
+    fetchPromise = (async () => {
+        lastAttemptTime = Date.now();
+        try {
+            const resp = await fetch(BLOCKLIST_URL);
+            if (!resp.ok) throw new Error("HTTP " + resp.status);
+            const config = await resp.json();
+            await loadConfig(config);
+        } catch {
+            // Silently fail — vendored list still provides coverage. Persist
+            // the attempt so a persistently failing fetch is retried on the
+            // schedule rather than on every wake.
+            await saveDeltaToStorage();
+        } finally {
+            fetchPromise = null;
+        }
+    })();
+
+    return fetchPromise;
+}
+
+/**
+ * Restore persisted state and fetch if the list is overdue.
+ *
+ * Called from the background script every time it starts — a fresh install,
+ * a browser start, and every revival of a terminated service worker all land
+ * here. The recurring 24-hour schedule itself is an alarm (see
+ * shared/alarms.js), not a timer, because timers die with the worker.
+ *
+ * @returns {Promise<void>}
+ */
+async function initPhishingList() {
+    await ensureDeltaLoaded();
+    return updatePhishingList();
+}
+
+/**
+ * The 24-hour alarm tick. Separate from initPhishingList() because this is the
+ * scheduled refresh and must not be vetoed by the guards that exist to keep
+ * the unscheduled startup path off the network.
+ *
+ * @returns {Promise<void>}
+ */
+async function refreshPhishingListOnSchedule() {
+    return updatePhishingList({ force: true });
+}
+
+/**
+ * Return the total blocklist size (vendored + delta) for diagnostics.
  *
  * @returns {number}
  */
 function getBlocklistSize() {
-    return COUNT;
+    return vendoredBlacklist.size + deltaBlacklist.size;
+}
+
+/**
+ * Return the delta blocklist size for diagnostics.
+ *
+ * @returns {number}
+ */
+function getDeltaSize() {
+    return deltaBlacklist.size;
+}
+
+/**
+ * Reset internal state (for testing).
+ */
+function _reset() {
+    deltaBlacklist = new Set();
+    lastFetchTime = 0;
+    lastAttemptTime = 0;
+    fetchPromise = null;
+    loadPromise = null;
 }
 
 module.exports = {
     isPhishingDomain,
+    updatePhishingList,
+    refreshPhishingListOnSchedule,
+    initPhishingList,
+    loadDeltaFromStorage,
+    loadConfig,
+    CACHE_TTL_MS,
+    MIN_FETCH_ATTEMPT_INTERVAL_MS,
+    DELTA_STORAGE_KEY,
+    MAX_DELTA_BYTES,
     getBlocklistSize,
+    getDeltaSize,
     hostnameVariants,
-    // Exposed for testing only: the ends of the search range are where an
-    // off-by-one hides, and reaching them through isPhishingDomain() would mean
-    // knowing which domain hashes to the first or last entry.
-    _hashListed: hashListed,
+    _reset,
+    // Exposed for testing only
+    _getVendoredBlacklistSize: () => vendoredBlacklist.size,
+    _getDeltaBlacklist: () => deltaBlacklist,
 };

src/shared/prices.js

@@ -21,7 +21,7 @@ async function refreshPrices() {
         const fetched = await getTopTokenPrices(25);
         Object.assign(prices, fetched);
         lastFetchedAt = now;
-    } catch {
+    } catch (e) {
         // prices stay stale on error
     }
 }

src/shared/state.js

@@ -14,11 +14,6 @@ const DEFAULT_STATE = {
     networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
-    // Endpoints remembered per network: { [networkId]: { rpcUrl,
-    // blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
-    // of the active network; this is what the others are restored from
-    // when the active network changes. See onChainSwitch().
-    networkEndpoints: {},
     lastBalanceRefresh: 0,
     activeAddress: null,
     allowedSites: {},
@@ -39,9 +34,6 @@ const DEFAULT_STATE = {
 
 const state = {
     ...DEFAULT_STATE,
-    // Its own object, not the one DEFAULT_STATE holds: onChainSwitch()
-    // mutates this map in place, and a spread copies the reference.
-    networkEndpoints: {},
     currentView: null,
     selectedWallet: null,
     selectedAddress: null,
@@ -96,7 +88,6 @@ async function saveState() {
         networkId: state.networkId,
         rpcUrl: state.rpcUrl,
         blockscoutUrl: state.blockscoutUrl,
-        networkEndpoints: state.networkEndpoints,
         lastBalanceRefresh: state.lastBalanceRefresh,
         activeAddress: state.activeAddress,
         allowedSites: state.allowedSites,
@@ -137,30 +128,6 @@ async function loadState() {
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
         state.blockscoutUrl =
             saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
-        // An actual object is required, not merely a truthy non-array: the
-        // code below and onChainSwitch() index and ASSIGN INTO this value,
-        // and assigning a property to a string or a number is a silent no-op
-        // in sloppy mode. A stored primitive would therefore be re-persisted
-        // unchanged forever, and every switch would fall back to the network
-        // default — the endpoint loss this map exists to prevent, with no
-        // self-healing. The allowedSites/deniedSites guards below are only
-        // read from, which is why they can be looser.
-        state.networkEndpoints =
-            typeof saved.networkEndpoints === "object" &&
-            saved.networkEndpoints !== null &&
-            !Array.isArray(saved.networkEndpoints)
-                ? saved.networkEndpoints
-                : {};
-        // A profile written before this map existed carries exactly one pair
-        // of endpoints, belonging to whatever network it was last on. Adopt
-        // it as that network's remembered pair, so a custom endpoint set on
-        // the old build is not lost by the first switch away and back.
-        if (!state.networkEndpoints[state.networkId]) {
-            state.networkEndpoints[state.networkId] = {
-                rpcUrl: state.rpcUrl,
-                blockscoutUrl: state.blockscoutUrl,
-            };
-        }
         state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
         state.activeAddress = saved.activeAddress || null;
         state.allowedSites =

src/shared/symbolDisplay.js

@@ -1,43 +0,0 @@
-// The length bound on a token symbol as displayed.
-//
-// A symbol is whatever an ERC-20's symbol() returns and the wallet fetches
-// it from the block explorer, which imposes no length: src/shared/balances.js
-// takes `item.token.symbol` as given. A kilobyte-long symbol is a real
-// return value, and rendering it pushes every amount off the row, scrolls
-// the balance list past the screen, and hides the figures the user is there
-// to read.
-//
-// This is a layout bound, not a security control. Escaping is what makes a
-// hostile symbol inert (see src/shared/html.js), and isSpoofedSymbol() is
-// what catches one impersonating a known ticker; neither job belongs here
-// and neither is done here. Truncating an unescaped symbol would still be
-// an injection, just a shorter one.
-//
-// 12 characters, which is the bound lookupTokenInfo() in
-// src/shared/balances.js already applies when it stores a symbol read
-// straight off a contract; the explorer path was the one with no bound at
-// all. The longest symbol across the 512 entries of the bundled list is 10
-// (MSYRUPUSDP), so nothing the wallet ships as a real token is ever
-// truncated. The ellipsis is what tells the user the name they are looking
-// at is not the whole name — worth knowing before they send to it.
-
-const MAX_SYMBOL_LENGTH = 12;
-
-// The placeholder for a token whose symbol the explorer did not report.
-// balances.js already substitutes this; repeated here so a symbol that
-// arrives empty from anywhere else displays the same way rather than as a
-// blank gap in the row.
-const UNKNOWN_SYMBOL = "???";
-
-function displaySymbol(symbol) {
-    const s = symbol === null || symbol === undefined ? "" : String(symbol);
-    if (s.length === 0) return UNKNOWN_SYMBOL;
-    if (s.length <= MAX_SYMBOL_LENGTH) return s;
-    return s.slice(0, MAX_SYMBOL_LENGTH - 1) + "…";
-}
-
-module.exports = {
-    displaySymbol,
-    MAX_SYMBOL_LENGTH,
-    UNKNOWN_SYMBOL,
-};

src/shared/transferAmount.js

@@ -1,116 +0,0 @@
-// The base-unit amount an ERC-20 transfer from the wallet's own Send screen is
-// encoded with.
-//
-// A token amount is a decimal string plus a scale, and the two come from
-// different places. The confirmation screen renders the amount, the balance and
-// the symbol from the block explorer's cached metadata (see
-// fetchTokenBalances() in balances.js); the transfer used to be encoded from
-// decimals() read off the contract at signing time, and nothing compared the
-// two. A token whose on-chain scale differs from the cached one — an
-// upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
-// entry — therefore signed an amount that was never displayed, off by a power
-// of ten for every decimal place of disagreement.
-//
-// So the scale used to encode is the scale the screen rendered with, carried
-// forward on the pending transaction, and the contract's own answer is read
-// only to be compared with it. A disagreement is a refusal, never a preference
-// for either number: the wallet cannot tell which of the two the user meant,
-// and both candidate transfers move an amount nobody approved.
-//
-// This is the confirmTx counterpart to approvalVerify.js, which does the same
-// job for the dApp approval path, and it takes the same stance: a quantity that
-// cannot be compared with what was displayed has not been checked, so an absent
-// or unusable value is refused rather than filled in.
-//
-// Every message here is shown to the user on the transaction error screen, so
-// each is a full sentence and names the numbers it is refusing over.
-
-const { parseUnits } = require("ethers");
-
-// Solidity's decimals() returns a uint8, so anything outside that range is not
-// an answer this wallet can use.
-const MAX_DECIMALS = 255;
-
-const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the number of decimal places this" +
-    " amount was shown with is unknown, so the amount that would be signed" +
-    " cannot be shown to be the amount that was displayed.";
-
-const UNREADABLE_CONTRACT_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the token contract did not report a" +
-    " usable number of decimal places, so the amount that would be signed" +
-    " cannot be checked against the amount that was displayed.";
-
-function mismatchMessage(displayed, onChain) {
-    return (
-        "The transfer was not sent. The token contract reports " +
-        onChain +
-        " decimal places, but the amount was displayed using " +
-        displayed +
-        ", so signing it would move a different amount than the one shown." +
-        " Reopen the wallet to reload this token's details and try again."
-    );
-}
-
-// A decimals value from either source as a number, or null if it is not one.
-// decimals() comes back from ethers as a bigint and the explorer's copy arrives
-// as a string, so both of those are accepted alongside a plain number; anything
-// fractional, negative, out of uint8 range, or of any other type at all is not.
-//
-// The types are enumerated rather than coerced because Number() is far too
-// willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
-// admit an empty array as a scale of zero and encode a whole-token transfer
-// against it.
-function toDecimals(value) {
-    let n;
-    if (typeof value === "number") {
-        n = value;
-    } else if (typeof value === "bigint") {
-        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
-        n = Number(value);
-    } else if (typeof value === "string") {
-        if (!/^[0-9]+$/.test(value)) return null;
-        n = Number(value);
-    } else {
-        return null;
-    }
-    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
-    return n;
-}
-
-// The decimals the confirmation screen rendered an amount with, as a number.
-// Throws when the pending transaction does not carry a usable one — which is
-// also what keeps the gas estimate from quietly estimating a different transfer
-// than the one that would be signed.
-function displayedDecimals(value) {
-    const displayed = toDecimals(value);
-    if (displayed === null) {
-        throw new Error(UNKNOWN_DISPLAYED_DECIMALS_MESSAGE);
-    }
-    return displayed;
-}
-
-// The transfer amount in the token's base units, or a throw. `amount` is the
-// decimal string the user typed and the screen displayed, `displayed` is the
-// scale it was displayed at, and `onChain` is what the contract's decimals()
-// answered at signing time. The two scales must agree.
-function transferAmountUnits(amount, displayed, onChain) {
-    const shown = displayedDecimals(displayed);
-    const reported = toDecimals(onChain);
-    if (reported === null) {
-        throw new Error(UNREADABLE_CONTRACT_DECIMALS_MESSAGE);
-    }
-    if (reported !== shown) {
-        throw new Error(mismatchMessage(shown, reported));
-    }
-    return parseUnits(String(amount), shown);
-}
-
-module.exports = {
-    displayedDecimals,
-    transferAmountUnits,
-    mismatchMessage,
-    MAX_DECIMALS,
-    UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-    UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-};

src/shared/txValidation.js

@@ -82,7 +82,7 @@ function toFixedPoint(value) {
     if (text === "") return null;
     try {
         return parseUnits(text, SCALE_DECIMALS);
-    } catch {
+    } catch (e) {
         return null;
     }
 }

src/shared/uniswap.js

@@ -102,11 +102,6 @@ function decodeV2SwapExactIn(input) {
 // Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
 // ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
 //        address[] path, bool payerIsUser)
-//
-// Nothing calls this: decode() has no 0x09 arm, so a V2 exact-out swap gets
-// its command name and no token or amount detail. Kept for the fix, which is
-// https://git.eeqj.de/sneak/AutistMask/issues/283.
-// eslint-disable-next-line no-unused-vars
 function decodeV2SwapExactOut(input) {
     try {
         const d = coder.decode(

src/shared/vault.js

@@ -57,7 +57,7 @@ async function cryptoBackend() {
     try {
         await WebAssembly.compile(EMPTY_WASM_MODULE);
         return "wasm";
-    } catch {
+    } catch (_) {
         return "asmjs";
     }
 }

tests/alarms.test.js

@@ -80,12 +80,17 @@ describe("alarms module", () => {
         delete global.chrome;
     });
 
-    test("ensureRecurringAlarms schedules the recurring job", async () => {
+    test("ensureRecurringAlarms schedules both recurring jobs", async () => {
         const created = await alarmsMod.ensureRecurringAlarms();
-        expect(created).toEqual({ balance: true, cleared: [] });
+        expect(created).toEqual({ balance: true, phishing: true });
 
-        const names = alarmsStub.created.map((c) => c.name);
-        expect(names).toEqual([alarmsMod.BALANCE_REFRESH_ALARM]);
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        expect(names).toEqual(
+            [
+                alarmsMod.BALANCE_REFRESH_ALARM,
+                alarmsMod.PHISHING_REFRESH_ALARM,
+            ].sort(),
+        );
     });
 
     test("the balance refresh keeps its 60-second cadence", async () => {
@@ -94,35 +99,12 @@ describe("alarms module", () => {
         expect(balance.periodInMinutes).toBe(1);
     });
 
-    test("a retired job's alarm is cleared, not left running", async () => {
-        // The browser holds an alarm until something clears it. Deleting the
-        // job from the code is not enough: on every install that ever ran the
-        // version which created it, the alarm goes on waking the service
-        // worker on its old schedule with nothing to deliver it to.
-        for (const name of alarmsMod.OBSOLETE_ALARMS) {
-            alarmsStub.create(name, { periodInMinutes: 24 * 60 });
-        }
-        expect(alarmsMod.OBSOLETE_ALARMS.length).toBeGreaterThan(0);
-
-        const result = await alarmsMod.ensureRecurringAlarms();
-        expect(result.cleared).toEqual(alarmsMod.OBSOLETE_ALARMS);
-        for (const name of alarmsMod.OBSOLETE_ALARMS) {
-            expect(alarmsStub.alarms.get(name)).toBeUndefined();
-        }
-    });
-
-    test("clearing a retired alarm is not re-reported once it is gone", async () => {
+    test("the phishing refresh keeps its 24-hour cadence", async () => {
         await alarmsMod.ensureRecurringAlarms();
-        const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again.cleared).toEqual([]);
-    });
-
-    test("no retired name is also a live one", async () => {
-        // A name in both lists would be created and then cleared on every
-        // start, so the job it schedules would never fire.
-        expect(alarmsMod.OBSOLETE_ALARMS).not.toContain(
-            alarmsMod.BALANCE_REFRESH_ALARM,
+        const phishing = alarmsStub.alarms.get(
+            alarmsMod.PHISHING_REFRESH_ALARM,
         );
+        expect(phishing.periodInMinutes).toBe(24 * 60);
     });
 
     test("no period is below the browser-enforced minimum", async () => {
@@ -140,14 +122,14 @@ describe("alarms module", () => {
 
     test("a revived worker does not reset an existing alarm's schedule", async () => {
         await alarmsMod.ensureRecurringAlarms();
-        expect(alarmsStub.create).toHaveBeenCalledTimes(1);
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
 
         // Every wake re-runs the startup path. Re-creating an alarm restarts
         // its period, so a busy extension would push the next fire out
         // forever and the job would never run.
         const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: false, cleared: [] });
-        expect(alarmsStub.create).toHaveBeenCalledTimes(1);
+        expect(again).toEqual({ balance: false, phishing: false });
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
     });
 
     test("a missing alarm is re-created on the next start", async () => {
@@ -155,7 +137,7 @@ describe("alarms module", () => {
         await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
 
         const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: true, cleared: [] });
+        expect(again).toEqual({ balance: true, phishing: false });
         expect(
             alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
         ).toBeDefined();
@@ -165,17 +147,17 @@ describe("alarms module", () => {
         // An install carries its alarms across an extension update, so a
         // period changed in a new release only ever reaches users if the
         // stale one is reconciled.
-        alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
+        alarmsStub.create(alarmsMod.PHISHING_REFRESH_ALARM, {
             periodInMinutes: 7 * 24 * 60,
         });
         alarmsStub.create.mockClear();
 
         const created = await alarmsMod.ensureRecurringAlarms();
-        expect(created.balance).toBe(true);
+        expect(created.phishing).toBe(true);
         expect(
-            alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM)
+            alarmsStub.alarms.get(alarmsMod.PHISHING_REFRESH_ALARM)
                 .periodInMinutes,
-        ).toBe(alarmsMod.BALANCE_REFRESH_PERIOD_MINUTES);
+        ).toBe(alarmsMod.PHISHING_REFRESH_PERIOD_MINUTES);
     });
 
     test("reconciling a period settles instead of re-creating forever", async () => {
@@ -186,31 +168,31 @@ describe("alarms module", () => {
         alarmsStub.create.mockClear();
 
         const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: false, cleared: [] });
+        expect(again).toEqual({ balance: false, phishing: false });
         expect(alarmsStub.create).not.toHaveBeenCalled();
     });
 
     test("handlers are dispatched by alarm name from one listener", () => {
         const balance = jest.fn();
-        const other = jest.fn();
+        const phishing = jest.fn();
         expect(
             alarmsMod.registerAlarmHandlers({
                 [alarmsMod.BALANCE_REFRESH_ALARM]: balance,
-                "autistmask-some-other-job": other,
+                [alarmsMod.PHISHING_REFRESH_ALARM]: phishing,
             }),
         ).toBe(true);
         expect(alarmsStub.listenerCount()).toBe(1);
 
         alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
         expect(balance).toHaveBeenCalledTimes(1);
-        expect(other).not.toHaveBeenCalled();
+        expect(phishing).not.toHaveBeenCalled();
 
-        alarmsStub.fire("autistmask-some-other-job");
-        expect(other).toHaveBeenCalledTimes(1);
+        alarmsStub.fire(alarmsMod.PHISHING_REFRESH_ALARM);
+        expect(phishing).toHaveBeenCalledTimes(1);
 
-        alarmsStub.fire("an-alarm-with-no-handler");
+        alarmsStub.fire("some-other-extension-alarm");
         expect(balance).toHaveBeenCalledTimes(1);
-        expect(other).toHaveBeenCalledTimes(1);
+        expect(phishing).toHaveBeenCalledTimes(1);
     });
 
     test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
@@ -223,8 +205,8 @@ describe("alarms module", () => {
         try {
             const mod = require("../src/shared/alarms");
             const created = await mod.ensureRecurringAlarms();
-            expect(created).toEqual({ balance: true, cleared: [] });
-            expect(firefoxAlarms.created).toHaveLength(1);
+            expect(created).toEqual({ balance: true, phishing: true });
+            expect(firefoxAlarms.created).toHaveLength(2);
             // The Chrome stub must not have been touched.
             expect(alarmsStub.create).not.toHaveBeenCalled();
         } finally {
@@ -238,7 +220,7 @@ describe("alarms module", () => {
         const mod = require("../src/shared/alarms");
         await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
             balance: false,
-            cleared: [],
+            phishing: false,
         });
         expect(mod.registerAlarmHandlers({})).toBe(false);
     });
@@ -292,12 +274,9 @@ function loadBackground(initialStore = {}) {
         tabs: { query: jest.fn(), sendMessage: jest.fn() },
         action: { setPopup: jest.fn() },
     };
-    // Present so that a startup path which went to the network would be
-    // recorded rather than throwing, which is what makes "no request was made"
-    // an observation instead of an assumption.
     global.fetch = jest.fn(async () => ({
         ok: true,
-        json: async () => ({}),
+        json: async () => ({ blacklist: [] }),
     }));
     jest.resetModules();
     require("../src/background/index");
@@ -339,21 +318,17 @@ describe("background worker scheduling", () => {
         // Let the startup path's promises settle.
         await settle();
 
-        const names = alarmsStub.created.map((c) => c.name);
-        const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
-        expect(names).toEqual([BALANCE_REFRESH_ALARM]);
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        const {
+            BALANCE_REFRESH_ALARM,
+            PHISHING_REFRESH_ALARM,
+        } = require("../src/shared/alarms");
+        expect(names).toEqual(
+            [BALANCE_REFRESH_ALARM, PHISHING_REFRESH_ALARM].sort(),
+        );
         expect(mockSetIntervalCalls).toBe(0);
     });
 
-    test("startup contacts nothing", async () => {
-        // The phishing blocklist is vendored at build time and there is no
-        // other startup fetch, so a worker coming up asks nobody anything.
-        // Every wake used to be a candidate for a blocklist download.
-        loadBackground();
-        await settle();
-        expect(global.fetch).not.toHaveBeenCalled();
-    });
-
     test("an onAlarm listener is installed on startup", async () => {
         alarmsStub = loadBackground().alarmsStub;
         await settle();
@@ -373,7 +348,7 @@ describe("background worker scheduling", () => {
         alarmsStub.created.length = 0;
         loaded.listeners.onStartup[0]();
         await settle();
-        expect(alarmsStub.created).toHaveLength(1);
+        expect(alarmsStub.created).toHaveLength(2);
     });
 
     test("the install-time listener and the top-level call share one run", async () => {
@@ -385,10 +360,13 @@ describe("background worker scheduling", () => {
         loaded.listeners.onInstalled[0]();
         await settle();
 
-        expect(alarmsStub.created).toHaveLength(1);
-        expect(alarmsStub.created.map((c) => c.name)).toEqual([
-            "autistmask-balance-refresh",
-        ]);
+        expect(alarmsStub.created).toHaveLength(2);
+        expect(alarmsStub.created.map((c) => c.name).sort()).toEqual(
+            [
+                "autistmask-balance-refresh",
+                "autistmask-phishing-refresh",
+            ].sort(),
+        );
     });
 });
 

tests/approvalAmount.test.js

@@ -1,208 +0,0 @@
-// The quantity the dApp approval screen shows for a decoded ERC-20 call.
-//
-// The screen's amount line is the only place a user sees how much a page is
-// asking for, and it is decoded from calldata, which carries base units and
-// no scale. Issue #306: decodeCalldata read decimals from the bundled token
-// list alone and fell back to 18, so a `transfer` of 5000000000 units of a
-// 6-decimal token — 5,000 tokens — was displayed as `0.0000` and confirmed.
-//
-// What is asserted here is that the scale is found wherever the wallet
-// already has it, and that where it is nowhere at all no formatted number is
-// produced: the amount line has to say base units and say the scale is
-// unknown, because a wrong quantity that reads as zero is worse than an
-// unwieldy correct one.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { Interface } = require("ethers");
-const { ERC20_ABI } = require("../src/shared/constants");
-const { state } = require("../src/shared/state");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../src/shared/approvalAmount");
-const { decodeCalldata } = require("../src/popup/views/approval");
-
-const iface = new Interface(ERC20_ABI);
-
-// Outside the bundled list, as the great majority of ERC-20s are.
-const NOVEL_TOKEN = "0xE2E0000000000000000000000000000000000E2e";
-// In the bundled list, at 6 decimals.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const SPENDER = "0x1111111111111111111111111111111111111111";
-
-// 5,000 units of a 6-decimal token, the amount from the issue.
-const FIVE_THOUSAND_AT_SIX = 5000000000n;
-const MAX_UINT256 = (1n << 256n) - 1n;
-
-function transferData(amount) {
-    return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
-}
-
-function approveData(amount) {
-    return iface.encodeFunctionData("approve", [SPENDER, amount]);
-}
-
-// The Amount line as the approval screen renders it.
-function amountLine(data, tokenAddress) {
-    const decoded = decodeCalldata(data, tokenAddress);
-    const detail = decoded.details.find((d) => d.label === "Amount");
-    return detail.value;
-}
-
-// A wallet holding `token` with the decimals the block explorer reported,
-// shaped as balances.js writes it onto state.
-function walletsHolding(token, decimals) {
-    return [
-        {
-            name: "Wallet 1",
-            addresses: [
-                {
-                    address: "0x" + "a".repeat(40),
-                    balance: "1.0",
-                    tokenBalances: [
-                        {
-                            address: token,
-                            symbol: "NOVEL",
-                            decimals,
-                            balance: "5000.0",
-                        },
-                    ],
-                },
-            ],
-        },
-    ];
-}
-
-beforeEach(() => {
-    state.trackedTokens = [];
-    state.wallets = [];
-});
-
-describe("resolveTokenDecimals", () => {
-    test("prefers the bundled list", () => {
-        state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
-        expect(resolveTokenDecimals(USDC, state)).toBe(6);
-    });
-
-    test("reads a token the user tracks", () => {
-        state.trackedTokens = [
-            {
-                address: NOVEL_TOKEN.toLowerCase(),
-                symbol: "NOVEL",
-                decimals: 6,
-            },
-        ];
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("reads the decimals the explorer reported", () => {
-        // Blockscout's copy arrives as a string.
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("falls past a tracked entry whose decimals are unusable", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: NaN },
-        ];
-        state.wallets = walletsHolding(NOVEL_TOKEN, 6);
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("refuses a scale the explorer's own entries disagree about", () => {
-        const wallets = walletsHolding(NOVEL_TOKEN, 6);
-        wallets[0].addresses.push({
-            address: "0x" + "b".repeat(40),
-            balance: "0.0",
-            tokenBalances: [
-                { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 18 },
-            ],
-        });
-        state.wallets = wallets;
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-
-    test("rejects values that are not a uint8", () => {
-        for (const decimals of [-1, 256, 1.5, true, [], {}, null, "6.0", ""]) {
-            state.trackedTokens = [{ address: NOVEL_TOKEN, decimals }];
-            expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-        }
-    });
-
-    test("is null when nothing knows the token", () => {
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-});
-
-describe("decodeCalldata amount", () => {
-    test("transfer of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer priced off the explorer's decimals shows the true quantity", () => {
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).toBe(unknownDecimalsAmount(FIVE_THOUSAND_AT_SIX));
-        // The defect: any rendering that reads as a token quantity, and above
-        // all one that reads as zero.
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("approve of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN)).toBe(
-            "5000.0000",
-        );
-    });
-
-    test("approve of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN);
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("an unbounded allowance is still named, with or without a scale", () => {
-        expect(amountLine(approveData(MAX_UINT256), NOVEL_TOKEN)).toBe(
-            "Unlimited",
-        );
-        expect(amountLine(approveData(MAX_UINT256), USDC)).toBe("Unlimited");
-    });
-
-    test("a bundled token keeps its symbol and its scale", () => {
-        expect(amountLine(transferData(FIVE_THOUSAND_AT_SIX), USDC)).toBe(
-            "5000.0000 USDC",
-        );
-    });
-
-    test("the amount carried to the status screens is the same string", () => {
-        const decoded = decodeCalldata(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        const detail = decoded.details.find((d) => d.label === "Amount");
-        expect(detail.rawValue).toBe(
-            "5000000000 base units (decimals unknown)",
-        );
-    });
-});

tests/backgroundApproval.test.js

@@ -20,11 +20,6 @@
 
 const { Network, Wallet } = require("ethers");
 
-// The real formatter the approval screen renders failures through. Bound here,
-// before any jest.doMock() of the module, so the copy assertions below check
-// what the user is actually shown.
-const { describeSigningFailure } = require("../src/shared/approvalVerify");
-
 const SIGNER_KEY =
     "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
 const OTHER_KEY =
@@ -39,21 +34,6 @@ const HOSTNAME = "dapp.example";
 const UNCONNECTED_ORIGIN = "https://stranger.example";
 const EXT_URL = "chrome-extension://autistmask/";
 
-// An origin the persisted state has never allowed, so asking to connect from
-// it raises a prompt rather than being answered from allowedSites.
-const FRESH_ORIGIN = "https://fresh.example";
-
-// The approval id in the most recent popup URL of a list, or null when none
-// of them carries one. Takes both shapes: the absolute URL windows.create()
-// is given and the extension-relative one action.setPopup() is given.
-function approvalIdIn(urls) {
-    for (let i = urls.length - 1; i >= 0; i--) {
-        if (!urls[i] || !urls[i].includes("?approval=")) continue;
-        return new URL(urls[i], EXT_URL).searchParams.get("approval");
-    }
-    return null;
-}
-
 // What the dApp asks for: no nonce, no gas, no fees. This is the shape that
 // makes a duplicate broadcast possible at all.
 const TX_PARAMS = {
@@ -157,21 +137,16 @@ function loadBackground(options) {
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
         isPhishingDomain: () => false,
+        refreshPhishingListOnSchedule: jest.fn(async () => {}),
+        initPhishingList: jest.fn(async () => {}),
     }));
     jest.doMock("../src/shared/alarms", () => ({
         BALANCE_REFRESH_ALARM: "balance",
+        PHISHING_REFRESH_ALARM: "phishing",
         BALANCE_REFRESH_PERIOD_MINUTES: 1,
         ensureRecurringAlarms: jest.fn(async () => {}),
         registerAlarmHandlers: jest.fn(),
     }));
-    // The real verification module, except where a test replaces one export
-    // with a throw to drive the handler's own error handling into failing.
-    if (opts.approvalVerify) {
-        jest.doMock("../src/shared/approvalVerify", () => ({
-            ...jest.requireActual("../src/shared/approvalVerify"),
-            ...opts.approvalVerify,
-        }));
-    }
 
     const persisted = {
         wallets: [
@@ -185,21 +160,13 @@ function loadBackground(options) {
 
     let messageListener = null;
     let windowRemovedListener = null;
-    let connectListener = null;
     const created = [];
     const removed = [];
-    // Every URL the background put on the browser action. A site approval
-    // raised through action.openPopup() opens no window at all, so this is
-    // the only place its id appears.
-    const actionPopups = [];
 
     global.chrome = {
         storage: {
             local: {
-                get: jest.fn(
-                    opts.storageGet ||
-                        (async () => ({ autistmask: persisted })),
-                ),
+                get: jest.fn(async () => ({ autistmask: persisted })),
                 set: jest.fn(async () => {}),
             },
         },
@@ -210,14 +177,7 @@ function loadBackground(options) {
                     messageListener = fn;
                 },
             },
-            // Captured, not swallowed: the approval port is what carries a
-            // site connection's decision and the popup teardown that races
-            // it, so a no-op stub here hides the whole subject of #275.
-            onConnect: {
-                addListener: (fn) => {
-                    connectListener = fn;
-                },
-            },
+            onConnect: { addListener: () => {} },
             lastError: null,
         },
         windows: {
@@ -245,17 +205,7 @@ function loadBackground(options) {
             query: (q, cb) => cb([]),
             sendMessage: () => {},
         },
-        action: {
-            setPopup: (o) => {
-                actionPopups.push(o.popup);
-            },
-            // The production route for a site connection. Present only when
-            // a test asks for it, because with it the prompt is the toolbar
-            // popup: no window is created, so windows.onRemoved can never
-            // fire for it and the port disconnect is the only close signal
-            // that exists.
-            ...(opts.actionPopup ? { openPopup: () => Promise.resolve() } : {}),
-        },
+        action: { setPopup: () => {} },
     };
 
     require("../src/background/index");
@@ -323,70 +273,6 @@ function loadBackground(options) {
         };
     }
 
-    // A dApp asking to connect. The origin defaults to one the persisted
-    // state has never allowed, so the request really does raise a prompt
-    // instead of being answered from allowedSites.
-    function requestSite(origin) {
-        let rpcResult = null;
-        messageListener(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "eth_requestAccounts",
-                params: [],
-            },
-            { origin: origin || FRESH_ORIGIN },
-            (r) => {
-                rpcResult = r;
-            },
-        );
-        return {
-            // Wherever the prompt went: the toolbar popup URL when
-            // action.openPopup() carried it, the created window otherwise.
-            id: () =>
-                approvalIdIn(actionPopups) ||
-                approvalIdIn(created.map((c) => c.url)),
-            result: () => rpcResult,
-        };
-    }
-
-    // The popup's approval port, as the browser delivers it. Messages posted
-    // on a port and that port's disconnect travel one channel in FIFO order,
-    // which is exactly the property the fix rests on, so this stub delivers
-    // them in the order the caller emits them and never reorders them.
-    function connectApproval(id, senderUrl) {
-        const onMessage = [];
-        const onDisconnect = [];
-        const port = {
-            name: "approval:" + id,
-            sender: {
-                url:
-                    senderUrl === undefined
-                        ? EXT_URL + "src/popup/index.html?approval=" + id
-                        : senderUrl,
-            },
-            onMessage: { addListener: (fn) => onMessage.push(fn) },
-            onDisconnect: { addListener: (fn) => onDisconnect.push(fn) },
-        };
-        connectListener(port);
-        return {
-            decide: (approved, remember) => {
-                for (const fn of onMessage) {
-                    fn(
-                        {
-                            type: "AUTISTMASK_APPROVAL_DECISION",
-                            approved,
-                            remember: !!remember,
-                        },
-                        port,
-                    );
-                }
-            },
-            disconnect: () => {
-                for (const fn of onDisconnect) fn(port);
-            },
-        };
-    }
-
     // The user closes the approval popup. `created` is index-aligned with the
     // ids the window stub hands back, so window 1 is the first popup opened.
     function closeWindow(windowId) {
@@ -397,8 +283,6 @@ function loadBackground(options) {
         send,
         requestTx,
         requestSign,
-        requestSite,
-        connectApproval,
         closeWindow,
         broadcastTransaction,
         loadState,
@@ -425,15 +309,6 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
-// settle() only drains microtasks. A handler whose last-resort .catch() has to
-// run after a macrotask boundary needs those turns too, so the assertion that
-// the page WAS answered is what reports a regression rather than a timeout.
-async function settleIncludingRejections() {
-    await settle();
-    await new Promise((resolve) => setImmediate(resolve));
-    await new Promise((resolve) => setImmediate(resolve));
-}
-
 afterEach(() => {
     delete global.chrome;
     jest.resetModules();
@@ -1500,200 +1375,6 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 });
 
-// A handler that throws must still answer. `sendResponse` is the only thing
-// that settles the page's window.ethereum.request() promise, so a throw that
-// escapes a handler leaves that promise pending forever — no error, no
-// timeout, indistinguishable from a slow wallet. Each case below drives a real
-// throw out of a handler rather than asserting the catch block exists.
-describe("a handler that throws still settles the page", () => {
-    const INTERNAL_ERROR = {
-        code: -32603,
-        message:
-            "AutistMask could not complete this request because of an internal error.",
-    };
-
-    let errorLog;
-    beforeEach(() => {
-        errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
-    });
-    afterEach(() => {
-        errorLog.mockRestore();
-    });
-
-    // getState() awaits extension storage unguarded, and every read path in
-    // handleRpc goes through it. A storage read that rejects is the whole
-    // failure — no hook in the handler itself.
-    test("a rejected handleRpc rejects the page instead of hanging it", async () => {
-        const bg = loadBackground({
-            storageGet: async () => {
-                throw new Error("storage unavailable");
-            },
-        });
-
-        const answer = bg.send(
-            { type: "AUTISTMASK_RPC", method: "eth_accounts", params: [] },
-            { origin: ORIGIN },
-        );
-        await settleIncludingRejections();
-
-        // The channel is held open for the async answer, and the answer
-        // arrives.
-        expect(answer.kept).toBe(true);
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR,
-        });
-        // Not swallowed: the throw is on the background console, which is how
-        // this class gets caught in future.
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "RPC request failed:",
-            "eth_accounts",
-            expect.objectContaining({ message: "storage unavailable" }),
-        );
-    });
-
-    // The transaction response handler wraps every statement in a try, so what
-    // escapes it is a throw from inside one of its catch blocks. Here the
-    // failure classifier itself throws while classifying a real verification
-    // failure — the approval is left claimed, so nothing else can settle it.
-    // The escape happens before broadcastTransaction() is reached, so the
-    // reported stage must be the one that says the transaction is gone.
-    test("a throw while verifying a transaction settles both the page and the popup", async () => {
-        const bg = loadBackground({
-            approvalVerify: {
-                describeTxFailure: () => {
-                    throw new Error("classifier broke");
-                },
-            },
-        });
-        const pending = bg.requestTx();
-        await settle();
-        const id = pending.id();
-
-        // A real verification failure: the artifact is signed at a nonce the
-        // approval never displayed.
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id,
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE + 1),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settleIncludingRejections();
-
-        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
-        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR.message,
-            retryable: false,
-            // Nothing was broadcast, so the popup must say the request is gone
-            // rather than that it may still have reached the network.
-            stage: "verify",
-        });
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "transaction approval response failed:",
-            expect.objectContaining({ message: "classifier broke" }),
-        );
-        // The copy the user actually reads, from the popup's own formatter.
-        expect(
-            describeSigningFailure(answer.sendResponse.mock.calls[0][0], "")
-                .message,
-        ).toBe(
-            INTERNAL_ERROR.message +
-                " This request can no longer be signed." +
-                " Please start it again from the site.",
-        );
-    });
-
-    // The other side of the same local: once broadcastTransaction() has been
-    // entered the wallet genuinely cannot tell whether the node took the
-    // transaction, and the copy that warns about a second send is correct.
-    test("a throw while handling a failed broadcast reports the broadcast stage", async () => {
-        const bg = loadBackground({
-            approvalVerify: {
-                describeTxFailure: () => {
-                    throw new Error("classifier broke");
-                },
-            },
-        });
-        bg.broadcastTransaction.mockRejectedValue(new Error("node refused"));
-        const pending = bg.requestTx();
-        await settle();
-        const id = pending.id();
-
-        // The approved artifact, so verification passes and the failure
-        // happens at the broadcast.
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id,
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settleIncludingRejections();
-
-        expect(bg.broadcastTransaction).toHaveBeenCalled();
-        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR.message,
-            retryable: false,
-            stage: "broadcast",
-        });
-        expect(
-            describeSigningFailure(answer.sendResponse.mock.calls[0][0], "")
-                .message,
-        ).toBe(
-            INTERNAL_ERROR.message +
-                " The transaction may still have reached the network." +
-                " Check the account before sending it again.",
-        );
-    });
-
-    test("a throw while handling a failed signature settles both the page and the popup", async () => {
-        const bg = loadBackground({
-            approvalVerify: {
-                failureIsRetryable: () => {
-                    throw new Error("classifier broke");
-                },
-            },
-        });
-        const pending = bg.requestSign();
-        await settle();
-
-        // A real verification failure: the active address moved after the
-        // approval was raised.
-        bg.setActiveAddress(other.address);
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                signature: await signer.signMessage(
-                    Buffer.from(MESSAGE.slice(2), "hex"),
-                ),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settleIncludingRejections();
-
-        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR.message,
-            retryable: false,
-        });
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "sign approval response failed:",
-            expect.objectContaining({ message: "classifier broke" }),
-        );
-    });
-});
-
 describe("popup-only messages", () => {
     test("a page sender cannot answer an approval", async () => {
         const bg = loadBackground();
@@ -1718,197 +1399,3 @@ describe("popup-only messages", () => {
         });
     });
 });
-
-// A site connection decided in a popup that closes on the next line.
-//
-// The decision and the teardown are two events the popup emits back to back,
-// and the background must not be able to reach different outcomes depending on
-// which of them it processes first. It cannot, because they are now one
-// channel: the decision is posted on the approval port that the close then
-// disconnects, so it is delivered first. Every test here therefore emits the
-// close IMMEDIATELY after the decision, with nothing awaited in between —
-// which is what the popup does, and what used to report a user who approved as
-// having refused (#275).
-describe("a site connection decided as the popup closes", () => {
-    // The production route: chrome.action.openPopup() put the prompt in the
-    // toolbar popup, which is not a window, so nothing but the port
-    // disconnect can tell the background this prompt is gone.
-    test("approving in the toolbar popup connects the site", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-        const id = pending.id();
-        expect(id).toBeTruthy();
-        expect(bg.created).toHaveLength(0);
-
-        const port = bg.connectApproval(id);
-        port.decide(true, false);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({ result: [signer.address] });
-    });
-
-    test("closing the toolbar popup without deciding is a rejection", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    test("rejecting is a rejection, and the close that follows adds nothing", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        port.decide(false, false);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The port carries a decision now, so it carries the sender check the
-    // one-off message used to carry. A content script that guessed an
-    // approval id must not be able to connect the site it is running on.
-    test("a decision from a page sender is ignored, and the close rejects", async () => {
-        const bg = loadBackground({ actionPopup: true });
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id(), FRESH_ORIGIN + "/x.html");
-        port.decide(true, true);
-        await settle();
-        expect(pending.result()).toBeNull();
-
-        port.disconnect();
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The fallback shape, where openPopup() is unavailable and the prompt is
-    // a window the extension opened. Closing it fires windows.onRemoved as
-    // well, on a channel of its own that is ordered against nothing — so the
-    // window event must not be allowed to decide a site approval either.
-    //
-    // The event goes FIRST here, which is the interleaving the guard in the
-    // onRemoved listener exists for: the approval is still pending when the
-    // event arrives, so the listener really reaches it and really has to
-    // decline it. With the decision first there is nothing left in
-    // pendingApprovals and the listener finds no approval to spare.
-    test("approving in the fallback window survives a window event that lands first", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-        expect(bg.created).toHaveLength(1);
-
-        const port = bg.connectApproval(pending.id());
-        bg.closeWindow(1);
-        port.decide(true, false);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({ result: [signer.address] });
-    });
-
-    test("approving in the fallback window survives a window event that follows", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        port.decide(true, false);
-        bg.closeWindow(1);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({ result: [signer.address] });
-    });
-
-    // The connected port is what silences the window event, so connecting one
-    // must take the same sender check the decision takes. Otherwise a content
-    // script that guessed the id switches off the only settlement path a
-    // prompt whose real popup never connected has, and the dApp hangs.
-    test("a port from a page sender does not silence the window event", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        // Connected and held open — no disconnect, so nothing but the window
-        // event can settle this approval.
-        bg.connectApproval(pending.id(), FRESH_ORIGIN + "/x.html");
-        bg.closeWindow(1);
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // Same shape, and the same window event arriving before the popup has
-    // said anything at all — which is a user closing the window rather than
-    // deciding, and still has to reach the dApp as a rejection.
-    test("closing the fallback window without deciding is a rejection", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        const port = bg.connectApproval(pending.id());
-        bg.closeWindow(1);
-        port.disconnect();
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The net under the paragraph above: a prompt whose page never got as far
-    // as connecting the port has no disconnect to reject it, so the window
-    // event has to. Otherwise the dApp waits forever on a window that is gone.
-    test("a window that closes before its popup ever connected still rejects", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSite();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-
-    // The `isSite &&` half of that skip, which is what keeps it from reaching
-    // a tx or sign approval. The popup connects its port in show() before it
-    // knows the approval's type, and the background sets portConnected without
-    // looking at the type either, so a tx approval in the fallback window
-    // carries the flag too. Without the conjunct the window event would skip
-    // it, windowClosed would never be set, releaseApproval() would never settle
-    // it, and the page would hang — the #271 regression this guard is written
-    // around.
-    test("a tx window closed with the port connected still rejects", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-        bg.connectApproval(pending.id());
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-    });
-});

tests/balanceLineEscaping.test.js

@@ -1,69 +0,0 @@
-// balanceLine() is the row that issue #307 was reported against: every
-// screen that lists a holding renders through it, and the symbol it renders
-// is whatever an ERC-20's symbol() returned. This asserts against the
-// string it emits, which is what gets assigned to innerHTML.
-//
-// The browser half of the same claim — that a real Chrome renders that
-// string as text and puts no iframe in the popup DOM — is in
-// tests/e2e/run.js. This half runs inside the 20-second make test cap.
-
-"use strict";
-
-// helpers.js reaches for both at module scope through the modules it pulls
-// in. Neither is exercised by anything asserted here.
-global.chrome = {
-    storage: {
-        local: {
-            get: () => Promise.resolve({}),
-            set: () => Promise.resolve(),
-        },
-    },
-    runtime: { sendMessage: () => {} },
-};
-global.document = {
-    getElementById: () => null,
-    createElement: () => ({ style: {}, classList: { toggle() {} } }),
-    body: { prepend: () => {} },
-    addEventListener: () => {},
-};
-
-const { balanceLine } = require("../src/popup/views/helpers");
-const { MAX_SYMBOL_LENGTH } = require("../src/shared/symbolDisplay");
-
-// The payload from the issue's reproduction, verbatim.
-const HOSTILE_SYMBOL =
-    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
-
-describe("balanceLine", () => {
-    test("emits a hostile symbol as text, not as an element", () => {
-        // Deliberately asserted on the escaping alone. The cap truncates
-        // this payload before its id attribute, so an assertion about the
-        // rest of the payload would pass on the cap and say nothing about
-        // the escape.
-        const html = balanceLine(HOSTILE_SYMBOL, 1, null, null);
-        expect(html).not.toContain("<iframe");
-        expect(html).toContain("&lt;iframe");
-    });
-
-    test("caps the symbol before rendering it", () => {
-        const html = balanceLine("A".repeat(4096), 1, null, null);
-        expect(html).toContain("A".repeat(MAX_SYMBOL_LENGTH - 1) + "…");
-        expect(html).not.toContain("A".repeat(MAX_SYMBOL_LENGTH + 1));
-    });
-
-    // The token id lands inside data-token="...", so a quote in it is a
-    // way out of the attribute and into a new one.
-    test("keeps a quote-bearing token id inside its attribute", () => {
-        const html = balanceLine("TKN", 1, null, '" onclick="alert(1)');
-        expect(html).not.toContain('onclick="');
-        expect(html).toContain('data-token="&quot; onclick=&quot;alert(1)"');
-    });
-
-    test("renders an ordinary holding unchanged", () => {
-        const html = balanceLine("USDC", 1.5, null, "0xabc");
-        expect(html).toContain("<span>USDC</span>");
-        expect(html).toContain("<span>1.5000</span>");
-        expect(html).toContain('data-token="0xabc"');
-    });
-});

tests/chainSwitchGate.test.js

@@ -1,232 +0,0 @@
-// Who may move the active chain.
-//
-// wallet_switchEthereumChain used to be answered for any origin at all, with
-// no connection check and no prompt, so a page the user had never connected
-// to could clear the [TESTNET] banner under someone who believed they were
-// on Sepolia (https://git.eeqj.de/sneak/AutistMask/issues/308). The refusal
-// is asserted as a refusal to ACT — the state unmoved and no chainChanged
-// broadcast — because an error code alone would not distinguish a gate from
-// a switch that happened and then reported a failure.
-//
-// The endpoint half of that issue lives in tests/networkEndpoints.test.js;
-// this file mocks the state module, which that one exercises for real.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-// The site the persisted state has connected, and one it has never heard of.
-const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
-const STRANGER_ORIGIN = "https://stranger.example";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-// The user's own node, so a switch that happens is visible as the loss of it.
-const CUSTOM_RPC = "http://127.0.0.1:8545";
-
-function walletFixture() {
-    return [
-        {
-            name: "Wallet 1",
-            type: "hd",
-            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
-        },
-    ];
-}
-
-// Let the handler's promise chain run to the next suspension point. The gate
-// reads storage before it answers, so the response is several awaits deep.
-async function settle() {
-    for (let i = 0; i < 50; i++) await Promise.resolve();
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-// ---------------------------------------------------------------------------
-// The gate: which origins the background will switch the chain for.
-// ---------------------------------------------------------------------------
-
-// Load the background worker against stubbed browser APIs, with the real
-// chain-switch module behind it, and return the handles to drive it. The
-// wallet state is a plain object so that a switch that DID happen is visible
-// as a mutation of it, and one that did not is visible as its absence.
-function loadBackground() {
-    jest.resetModules();
-
-    const walletState = {
-        networkId: "mainnet",
-        rpcUrl: CUSTOM_RPC,
-        blockscoutUrl: MAINNET.defaultBlockscoutUrl,
-        networkEndpoints: {},
-        wallets: walletFixture(),
-        lastBalanceRefresh: 1,
-        tokenHolderCache: {},
-        fraudContracts: [],
-    };
-
-    jest.doMock("../src/shared/state", () => ({
-        state: walletState,
-        loadState: jest.fn(async () => {}),
-        saveState: jest.fn(async () => {}),
-        currentNetwork: () => networkById(walletState.networkId),
-    }));
-    jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => ({}),
-        refreshBalances: jest.fn(async () => {}),
-    }));
-    jest.doMock("../src/shared/phishingDomains", () => ({
-        isPhishingDomain: () => false,
-    }));
-    jest.doMock("../src/shared/alarms", () => ({
-        BALANCE_REFRESH_ALARM: "balance",
-        BALANCE_REFRESH_PERIOD_MINUTES: 1,
-        ensureRecurringAlarms: jest.fn(async () => {}),
-        registerAlarmHandlers: jest.fn(),
-    }));
-
-    const persisted = {
-        wallets: walletFixture(),
-        activeAddress: ADDRESS,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
-        deniedSites: {},
-    };
-
-    let messageListener = null;
-    // Every message the background pushed at a content script. chainChanged
-    // is what tells a page the wallet moved, so an ungated switch is visible
-    // here as well as in the state.
-    const toTabs = [];
-
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () => ({ autistmask: persisted })),
-                set: jest.fn(async () => {}),
-            },
-        },
-        runtime: {
-            getURL: (path) => "chrome-extension://autistmask/" + path,
-            onMessage: {
-                addListener: (fn) => {
-                    messageListener = fn;
-                },
-            },
-            onConnect: { addListener: () => {} },
-            lastError: null,
-        },
-        windows: {
-            getLastFocused: (cb) => cb(null),
-            create: (options, cb) => cb({ id: 1 }),
-            remove: (id, cb) => {
-                if (cb) cb();
-            },
-            onRemoved: { addListener: () => {} },
-        },
-        tabs: {
-            query: (queryInfo, cb) => cb([{ id: 1 }]),
-            sendMessage: (tabId, message, cb) => {
-                toTabs.push(message);
-                if (cb) cb();
-            },
-        },
-        action: { setPopup: () => {} },
-    };
-
-    require("../src/background/index");
-
-    async function switchChain(chainId, origin) {
-        let result = null;
-        messageListener(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "wallet_switchEthereumChain",
-                params: [{ chainId }],
-            },
-            { origin },
-            (r) => {
-                result = r;
-            },
-        );
-        await settle();
-        return result;
-    }
-
-    return {
-        switchChain,
-        walletState,
-        chainChangedEvents: () =>
-            toTabs.filter((m) => m.eventName === "chainChanged"),
-    };
-}
-
-describe("wallet_switchEthereumChain is gated on the connection", () => {
-    test("an origin the wallet was never connected to is refused with 4100", async () => {
-        const bg = loadBackground();
-
-        const result = await bg.switchChain(SEPOLIA.chainId, STRANGER_ORIGIN);
-
-        expect(result.error).toEqual({ code: 4100, message: "Unauthorized" });
-        expect(result.result).toBeUndefined();
-        // The refusal has to be a refusal to ACT, not just an error string:
-        // the wallet is still on mainnet, still on the user's own node, and
-        // no page was told the chain moved.
-        expect(bg.walletState.networkId).toBe("mainnet");
-        expect(bg.walletState.rpcUrl).toBe(CUSTOM_RPC);
-        expect(bg.chainChangedEvents()).toEqual([]);
-    });
-
-    test("an unconnected origin is refused even for the chain already active", async () => {
-        const bg = loadBackground();
-
-        const result = await bg.switchChain(MAINNET.chainId, STRANGER_ORIGIN);
-
-        expect(result.error).toEqual({ code: 4100, message: "Unauthorized" });
-    });
-
-    test("an unconnected origin is refused before the unsupported-chain answer", async () => {
-        const bg = loadBackground();
-
-        const result = await bg.switchChain("0x89", STRANGER_ORIGIN);
-
-        expect(result.error.code).toBe(4100);
-    });
-
-    test("a connected origin switches the chain", async () => {
-        const bg = loadBackground();
-
-        const result = await bg.switchChain(SEPOLIA.chainId, CONNECTED_ORIGIN);
-
-        expect(result).toEqual({ result: null });
-        expect(bg.walletState.networkId).toBe("sepolia");
-        expect(bg.chainChangedEvents()).toEqual([
-            {
-                type: "AUTISTMASK_EVENT",
-                eventName: "chainChanged",
-                data: SEPOLIA.chainId,
-            },
-        ]);
-    });
-
-    test("a connected origin asking for an unsupported chain still gets 4902", async () => {
-        const bg = loadBackground();
-
-        const result = await bg.switchChain("0x89", CONNECTED_ORIGIN);
-
-        expect(result.error.code).toBe(4902);
-        expect(bg.walletState.networkId).toBe("mainnet");
-    });
-
-    test("a switch by a connected origin keeps the user's endpoint", async () => {
-        const bg = loadBackground();
-
-        await bg.switchChain(SEPOLIA.chainId, CONNECTED_ORIGIN);
-        expect(bg.walletState.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
-
-        await bg.switchChain(MAINNET.chainId, CONNECTED_ORIGIN);
-        expect(bg.walletState.rpcUrl).toBe(CUSTOM_RPC);
-    });
-});

tests/coldWorkerChainId.test.js

@@ -1,258 +0,0 @@
-// What eth_chainId and net_version answer on a worker that has not loaded
-// state yet.
-//
-// The MV3 service worker is terminated when idle and revived by the next
-// message, and nothing loads state at module scope. Both methods answered from
-// currentNetwork(), which reads the module-level `state` singleton, so a
-// worker revived by the page's own message answered out of DEFAULT_STATE and
-// told a page it was on mainnet while the user was on Sepolia
-// (https://git.eeqj.de/sneak/AutistMask/issues/317).
-//
-// This file therefore uses the REAL state module and never calls loadState()
-// itself: the handler has to answer from storage on its own. Same shape as
-// tests/coldWorkerChainSwitch.test.js, which covers the write side.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
-const UNKNOWN_ORIGIN = "https://stranger.example";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-const REFRESHED_BALANCE = "1.5";
-
-function storedProfile(networkId) {
-    return {
-        hasWallet: true,
-        wallets: [
-            {
-                name: "Wallet 1",
-                type: "hd",
-                addresses: [
-                    { address: ADDRESS, balance: "0", tokenBalances: [] },
-                ],
-            },
-        ],
-        activeAddress: ADDRESS,
-        networkId,
-        rpcUrl: networkById(networkId).defaultRpcUrl,
-        blockscoutUrl: networkById(networkId).defaultBlockscoutUrl,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
-        deniedSites: {},
-        trackedTokens: [],
-    };
-}
-
-async function settle() {
-    for (let i = 0; i < 50; i++) await Promise.resolve();
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-// Load the background worker with the real state module behind it, over a
-// storage stub that keeps what is written.
-//
-// The stub structured-clones in both directions, as the real
-// chrome.storage.local does. A stub that handed back the live stored object
-// would alias it into whatever read it, so an in-place mutation of a detached
-// copy would appear to have reached storage and this whole class of defect
-// would be invisible here.
-//
-// opts.refreshBalances replaces the balances stub, so a test can hold a
-// refresh open across a message.
-function loadColdWorker(networkId, opts) {
-    jest.resetModules();
-
-    const options = opts || {};
-
-    jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => ({}),
-        refreshBalances: options.refreshBalances || jest.fn(async () => {}),
-    }));
-    jest.doMock("../src/shared/phishingDomains", () => ({
-        isPhishingDomain: () => false,
-    }));
-
-    let alarmHandlers = {};
-    jest.doMock("../src/shared/alarms", () => ({
-        BALANCE_REFRESH_ALARM: "balance",
-        BALANCE_REFRESH_PERIOD_MINUTES: 1,
-        ensureRecurringAlarms: jest.fn(async () => {}),
-        registerAlarmHandlers: jest.fn((handlers) => {
-            alarmHandlers = handlers;
-        }),
-    }));
-
-    const store = { autistmask: storedProfile(networkId) };
-
-    let messageListener = null;
-    const set = jest.fn(async (items) => {
-        store.autistmask = structuredClone(items.autistmask);
-    });
-
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () => structuredClone(store)),
-                set,
-            },
-        },
-        runtime: {
-            getURL: (path) => "chrome-extension://autistmask/" + path,
-            onMessage: {
-                addListener: (fn) => {
-                    messageListener = fn;
-                },
-            },
-            onConnect: { addListener: () => {} },
-            lastError: null,
-        },
-        windows: {
-            getLastFocused: (cb) => cb(null),
-            create: (options, cb) => cb({ id: 1 }),
-            remove: (id, cb) => {
-                if (cb) cb();
-            },
-            onRemoved: { addListener: () => {} },
-        },
-        tabs: {
-            query: (queryInfo, cb) => cb([{ id: 1 }]),
-            sendMessage: (tabId, message, cb) => {
-                if (cb) cb();
-            },
-        },
-        action: { setPopup: () => {} },
-    };
-
-    require("../src/background/index");
-
-    async function rpc(method, origin) {
-        let result = null;
-        messageListener(
-            { type: "AUTISTMASK_RPC", method, params: [] },
-            { origin: origin || CONNECTED_ORIGIN },
-            (r) => {
-                result = r;
-            },
-        );
-        await settle();
-        return result;
-    }
-
-    return {
-        rpc,
-        persisted: () => store.autistmask,
-        storageSet: set,
-        fireBalanceAlarm: () => alarmHandlers.balance(),
-    };
-}
-
-describe("chain identity read by a worker that never loaded state", () => {
-    test("eth_chainId answers the stored chain, not the default", async () => {
-        // The first message this worker ever sees. Reading the unloaded
-        // singleton answers mainnet's 0x1 to a user who is on Sepolia.
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("eth_chainId")).toEqual({
-            result: SEPOLIA.chainId,
-        });
-    });
-
-    test("net_version answers the stored chain, not the default", async () => {
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("net_version")).toEqual({
-            result: SEPOLIA.networkVersion,
-        });
-    });
-
-    test("answers the stored chain to an origin that never connected", async () => {
-        // Neither method is gated on a connection, so the stale answer reached
-        // any page at all; the fixed answer has to as well.
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("eth_chainId", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.chainId,
-        });
-        expect(await bg.rpc("net_version", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.networkVersion,
-        });
-    });
-
-    test("answers mainnet for a profile stored on mainnet", async () => {
-        // The default and the stored value agree here, so this case cannot
-        // catch the defect; it is what keeps the fix from being a swap.
-        const bg = loadColdWorker("mainnet");
-
-        expect(await bg.rpc("eth_chainId")).toEqual({
-            result: MAINNET.chainId,
-        });
-        expect(await bg.rpc("net_version")).toEqual({
-            result: MAINNET.networkVersion,
-        });
-    });
-
-    test("persists nothing: these are reads", async () => {
-        // The load must not turn a read into a write. saveState() persists
-        // every field of the singleton, and a read path that reached it would
-        // be the wipe https://git.eeqj.de/sneak/AutistMask/issues/316 fixed.
-        const bg = loadColdWorker("sepolia");
-
-        await bg.rpc("eth_chainId");
-        await bg.rpc("net_version");
-
-        expect(bg.storageSet).not.toHaveBeenCalled();
-        expect(bg.persisted()).toEqual(storedProfile("sepolia"));
-    });
-
-    test("a chain read arriving mid-refresh does not discard the refresh", async () => {
-        // Any page reaches these two methods, and the injected provider sends
-        // eth_chainId on every page load, so this overlap is ordinary traffic
-        // rather than a contrived race.
-        //
-        // backgroundRefresh() hands the singleton's wallets to
-        // refreshBalances(), which mutates those address objects in place once
-        // the network round trip resolves, and only then saves. Answering the
-        // page by calling loadState() would replace state.wallets mid-flight,
-        // so the refreshed balances would land on detached objects and the
-        // save that follows would persist the pre-refresh values — while still
-        // stamping lastBalanceRefresh, suppressing the redo.
-        let releaseRoundTrip;
-        const roundTrip = new Promise((resolve) => {
-            releaseRoundTrip = resolve;
-        });
-        let refreshReachedNetwork;
-        const inFlight = new Promise((resolve) => {
-            refreshReachedNetwork = resolve;
-        });
-
-        const bg = loadColdWorker("sepolia", {
-            refreshBalances: async (wallets) => {
-                refreshReachedNetwork();
-                await roundTrip;
-                // In place, on the objects handed in — as balances.js does.
-                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
-            },
-        });
-
-        const refresh = bg.fireBalanceAlarm();
-        await inFlight;
-
-        expect(await bg.rpc("eth_chainId", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.chainId,
-        });
-
-        releaseRoundTrip();
-        await refresh;
-
-        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
-            REFRESHED_BALANCE,
-        );
-    });
-});

tests/coldWorkerChainSwitch.test.js

@@ -1,212 +0,0 @@
-// What a chain switch does to a worker that has not loaded state yet.
-//
-// The MV3 service worker is terminated when idle and revived by the next
-// message, and nothing loads state at module scope. The chain-switch handler
-// reaches onChainSwitch(), which mutates the module-level `state` singleton
-// and then persists EVERY field of it, so a handler that runs before a load
-// writes DEFAULT_STATE over the user's stored profile — every wallet, every
-// site approval, every tracked token and the custom endpoint
-// (https://git.eeqj.de/sneak/AutistMask/issues/316). The same singleton is
-// what currentNetwork() answers from, so the same-chain early return also
-// compares against the wrong network.
-//
-// This file therefore uses the REAL state module and never calls loadState()
-// itself: the handler has to do it. tests/chainSwitchGate.test.js mocks the
-// state module wholesale and tests/networkEndpoints.test.js always loads
-// first, so neither can see this.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-// The user's own node, and a wallet whose loss is the whole point.
-const CUSTOM_RPC = "http://127.0.0.1:8545";
-const CUSTOM_BLOCKSCOUT = "http://127.0.0.1:4000/api/v2";
-const TOKEN = "0x6B175474E89094C44Da98b954EedeAC495271d0F";
-
-function walletFixture() {
-    return [
-        {
-            name: "Wallet 1",
-            type: "hd",
-            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
-        },
-    ];
-}
-
-// A profile as an installed extension holds it, on `networkId`.
-function storedProfile(networkId) {
-    return {
-        hasWallet: true,
-        wallets: walletFixture(),
-        activeAddress: ADDRESS,
-        networkId,
-        rpcUrl: CUSTOM_RPC,
-        blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
-        deniedSites: {},
-        trackedTokens: [{ address: TOKEN, symbol: "DAI", decimals: 18 }],
-        theme: "dark",
-    };
-}
-
-async function settle() {
-    for (let i = 0; i < 50; i++) await Promise.resolve();
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-// Load the background worker with the real state and chain-switch modules
-// behind it, over a storage stub that actually keeps what is written — a
-// wipe is only observable against storage that remembers.
-function loadColdWorker(networkId) {
-    jest.resetModules();
-
-    jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => ({}),
-        refreshBalances: jest.fn(async () => {}),
-    }));
-    jest.doMock("../src/shared/phishingDomains", () => ({
-        isPhishingDomain: () => false,
-    }));
-    jest.doMock("../src/shared/alarms", () => ({
-        BALANCE_REFRESH_ALARM: "balance",
-        BALANCE_REFRESH_PERIOD_MINUTES: 1,
-        ensureRecurringAlarms: jest.fn(async () => {}),
-        registerAlarmHandlers: jest.fn(),
-    }));
-
-    const store = { autistmask: storedProfile(networkId) };
-
-    let messageListener = null;
-    const toTabs = [];
-
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () => ({ autistmask: store.autistmask })),
-                set: jest.fn(async (items) => {
-                    store.autistmask = items.autistmask;
-                }),
-            },
-        },
-        runtime: {
-            getURL: (path) => "chrome-extension://autistmask/" + path,
-            onMessage: {
-                addListener: (fn) => {
-                    messageListener = fn;
-                },
-            },
-            onConnect: { addListener: () => {} },
-            lastError: null,
-        },
-        windows: {
-            getLastFocused: (cb) => cb(null),
-            create: (options, cb) => cb({ id: 1 }),
-            remove: (id, cb) => {
-                if (cb) cb();
-            },
-            onRemoved: { addListener: () => {} },
-        },
-        tabs: {
-            query: (queryInfo, cb) => cb([{ id: 1 }]),
-            sendMessage: (tabId, message, cb) => {
-                toTabs.push(message);
-                if (cb) cb();
-            },
-        },
-        action: { setPopup: () => {} },
-    };
-
-    require("../src/background/index");
-
-    async function switchChain(chainId) {
-        let result = null;
-        messageListener(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "wallet_switchEthereumChain",
-                params: [{ chainId }],
-            },
-            { origin: CONNECTED_ORIGIN },
-            (r) => {
-                result = r;
-            },
-        );
-        await settle();
-        return result;
-    }
-
-    return {
-        switchChain,
-        persisted: () => store.autistmask,
-        chainChangedEvents: () =>
-            toTabs.filter((m) => m.eventName === "chainChanged"),
-    };
-}
-
-describe("a chain switch on a worker that never loaded state", () => {
-    test("keeps the wallets, approvals, tokens and custom endpoint", async () => {
-        const bg = loadColdWorker("mainnet");
-
-        const result = await bg.switchChain(SEPOLIA.chainId);
-        expect(result).toEqual({ result: null });
-
-        const after = bg.persisted();
-        // The switch itself happened.
-        expect(after.networkId).toBe("sepolia");
-        expect(after.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
-
-        // And it took nothing else with it. Without the load these come back
-        // as [], {}, [] and "system" from DEFAULT_STATE — every wallet in the
-        // extension gone, encrypted secrets included.
-        expect(after.wallets).toEqual(walletFixture());
-        expect(after.hasWallet).toBe(true);
-        expect(after.activeAddress).toBe(ADDRESS);
-        expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_HOSTNAME] });
-        expect(after.trackedTokens).toEqual([
-            { address: TOKEN, symbol: "DAI", decimals: 18 },
-        ]);
-        expect(after.theme).toBe("dark");
-
-        // The user's mainnet endpoint is remembered rather than replaced by
-        // the public default, so switching back returns it.
-        expect(after.networkEndpoints.mainnet).toEqual({
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        });
-
-        await bg.switchChain(MAINNET.chainId);
-        expect(bg.persisted().rpcUrl).toBe(CUSTOM_RPC);
-        expect(bg.persisted().blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-        expect(bg.persisted().wallets).toEqual(walletFixture());
-    });
-
-    test("compares the requested chain against the stored one, not the default", async () => {
-        // Stored on Sepolia, asked for mainnet. Reading the unloaded
-        // singleton makes this look like the chain already active, so the
-        // page is told the switch succeeded while the wallet stays on the
-        // testnet it was on.
-        const bg = loadColdWorker("sepolia");
-
-        const result = await bg.switchChain(MAINNET.chainId);
-        expect(result).toEqual({ result: null });
-
-        expect(bg.persisted().networkId).toBe("mainnet");
-        expect(bg.chainChangedEvents()).toEqual([
-            {
-                type: "AUTISTMASK_EVENT",
-                eventName: "chainChanged",
-                data: MAINNET.chainId,
-            },
-        ]);
-    });
-});

tests/e2e/Dockerfile

@@ -1,34 +0,0 @@
-# Chrome end-to-end image: the pinned Playwright image with this repo and a
-# freshly built extension inside it, built by script/test-e2e. The suite is
-# still started with `docker run`, so every runtime flag the harness needs
-# (--ipc=host in particular) applies as before.
-#
-# The repo is baked in rather than bind-mounted because a bind mount does
-# not resolve under Gitea Actions: the runner runs the job in a container
-# against the HOST's docker socket, so the source side of a -v is resolved
-# by the host daemon while the job's checkout lives on a docker volume that
-# is not a host path -- the mount silently succeeds and /work is empty. A
-# build context is streamed to the daemon and so works from anywhere.
-# Building the extension here too means the machine starting a run needs
-# docker and nothing else.
-
-# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-#
-# The playwright-core devDependency is pinned to the matching Playwright
-# version (1.56.0) and the two must be bumped together: the browsers ship
-# inside this image, and playwright-core looks for the exact browser
-# revision its own version expects. A mismatch fails at launch.
-FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
-
-WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build

tests/e2e/firefox/Dockerfile

@@ -1,24 +1,10 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
-# with this repo and a freshly built extension inside it, built by
-# script/test-e2e-firefox. The harness itself has no dependencies, so
-# nothing is installed for it.
+# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
+# harness itself has no dependencies, so nothing is installed for it.
 #
-# The build context is the repo root. The repo is baked in rather than
-# bind-mounted because a bind mount does not resolve under Gitea Actions:
-# the runner runs the job in a container against the HOST's docker socket,
-# so the source side of a -v is resolved by the host daemon while the job's
-# checkout lives on a docker volume that is not a host path -- the mount
-# silently succeeds and /work is empty. Baking the build in is also the
-# only way this suite can have both a built extension and the
-# `--network none` it runs under, since a container with no network cannot
-# install anything.
-#
-# All three external artifacts are pinned by digest, and are fetched in
-# layers above the repo copy, so editing the harness or any source file
-# re-runs only the two cheap layers at the bottom. The Firefox version in
-# particular must not float: -remote-allow-system-access is mandatory on
-# 153 and was not on 142, so the flag the harness passes is
-# version-coupled.
+# All three external artifacts are pinned by digest. The Firefox version in
+# particular must not float: -remote-allow-system-access is mandatory on 153
+# and was not on 142, so the flag the harness passes is version-coupled.
 
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
@@ -62,16 +48,4 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 
 WORKDIR /work
-
-# Same layering as the root Dockerfile: script/bootstrap installs the
-# prerequisites and the dependencies, and the manifests are copied first so
-# that layer is cached until they change.
-COPY script/ script/
-COPY package.json yarn.lock ./
-RUN script/bootstrap
-
-COPY . .
-
-RUN make build
-
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]

tests/e2e/firefox/driver.js

@@ -88,7 +88,7 @@ class Driver {
         let parsed;
         try {
             parsed = JSON.parse(text);
-        } catch {
+        } catch (_) {
             throw new Error(
                 method + " " + path + ": non-JSON response: " + text,
             );
@@ -229,9 +229,7 @@ class Driver {
     // condition it was waiting on rather than "timed out".
     async waitFor(what, script, args = [], timeout = DEFAULT_WAIT_MS) {
         const deadline = Date.now() + timeout;
-        // Assigned on every path through the loop body before it is read, so
-        // there is no initializer to give it.
-        let last;
+        let last = null;
         for (;;) {
             try {
                 const v = await this.execute(script, args);
@@ -514,7 +512,7 @@ async function waitForDriverReady(base, timeoutMs) {
                 const body = await res.json();
                 if (body && body.value && body.value.ready !== false) return;
             }
-        } catch {
+        } catch (_) {
             // not listening yet
         }
         if (Date.now() >= deadline) {

tests/e2e/harness.js

@@ -13,7 +13,7 @@ const os = require("os");
 const path = require("path");
 
 const { chromium } = require("playwright-core");
-const { installNetworkStubs, WORKER_PROBE_URL } = require("./network");
+const { installNetworkStubs } = require("./network");
 
 const REPO_ROOT = path.resolve(__dirname, "..", "..");
 const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
@@ -129,109 +129,42 @@ function attachErrorListeners(ctx, errors) {
     // if it ever stops being.
 }
 
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// The most recently seen background worker, waiting for one if none has
-// appeared yet. Most recent rather than first: Chrome stops an idle MV3
-// worker and starts a fresh one on the next event, and a handle to a
-// stopped worker cannot be evaluated in.
 async function serviceWorker(ctx) {
-    const workers = ctx.serviceWorkers();
-    const latest = workers[workers.length - 1];
-    if (latest) return latest;
+    const [existing] = ctx.serviceWorkers();
+    if (existing) return existing;
     return ctx.waitForEvent("serviceworker", { timeout: 30000 });
 }
 
-// How long to wait for the probe request the worker is asked to make.
+// How long to wait for the background worker's first outbound request.
+//
+// The margin that actually decides whether this check is sound is not
+// this timeout — it is whether the route handler is installed before the
+// worker fetches. Measured over several runs: route installation
+// completes 11-23ms after the context comes up, and the worker's
+// blocklist fetch arrives 525-883ms after that, so the route wins by
+// roughly 25-50x. This 30s figure is only slack for a loaded machine on
+// top of that; losing the race fails the run rather than passing it
+// quietly, which was verified by forcing a 3s delay before route
+// installation.
 const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
 
 // ctx.route() only sees service-worker requests when Playwright runs with
 // PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
-// sets. Without it every fetch the background worker makes goes to the
-// real internet and nothing says so. A harness whose isolation can lapse
-// in silence is worthless, so this does not take the flag on trust: a
-// request the worker itself issues has to show up in the route handler,
-// or the suite refuses to run.
+// sets. Without it the worker's traffic — notably the phishing blocklist
+// fetch src/background/index.js issues at startup — goes to the real
+// internet, and nothing says so, because src/shared/phishingDomains.js
+// swallows fetch failures. A harness whose isolation can lapse in silence
+// is worthless, so this does not take the flag on trust: the background
+// worker's own startup fetch has to show up in the route handler, or the
+// suite refuses to run.
 //
-// The anchor is a probe the harness asks the worker for, not traffic the
-// extension generates on its own. It used to be the phishing blocklist
-// fetch src/background/index.js issued at startup; that fetch is gone —
-// the blocklist is vendored at build time and the extension contacts
-// nobody when it starts — so there is no longer any startup traffic to
-// observe and the check generates its own.
-//
-// Evaluating in the worker straight after launch does not work, and that
-// is not a stale observation: it was tried again here and failed with
-// "Target page, context or browser has been closed" on the first run.
-// Chrome stops the freshly registered worker as soon as it has nothing to
-// do, and the extension no longer gives it anything to do — which is the
-// same change that removed the old anchor. So the probe wakes the worker
-// before it evaluates in it, by sending it a message from an extension
-// page and waiting for the reply: delivering a message is what starts a
-// stopped worker, and a worker that has just answered one is alive.
-// The evaluated fetch is not awaited, so nothing in the worker is held
-// open by the probe either.
-async function wakeWorker(ctx) {
-    const sw = await serviceWorker(ctx);
-    const extensionId = new URL(sw.url()).host;
-    const page = await ctx.newPage();
-    try {
-        await page.goto(
-            "chrome-extension://" + extensionId + "/src/popup/index.html",
-        );
-        // eth_chainId is answered from local state: it wakes the worker
-        // and changes nothing.
-        await page.evaluate(
-            () =>
-                new Promise((resolve) => {
-                    chrome.runtime.sendMessage(
-                        {
-                            type: "AUTISTMASK_RPC",
-                            method: "eth_chainId",
-                            params: [],
-                        },
-                        () => resolve(null),
-                    );
-                }),
-        );
-    } finally {
-        await page.close();
-    }
-}
-
-async function probeFromWorker(ctx, url) {
-    let lastError = null;
-    for (let attempt = 0; attempt < 5; attempt++) {
-        try {
-            await wakeWorker(ctx);
-            const sw = await serviceWorker(ctx);
-            await sw.evaluate((u) => {
-                // Deliberately not awaited and never rejected: what is
-                // being observed is that the request reaches the route
-                // handler, and an unhandled rejection in the worker would
-                // be collected as a suite error if it did not.
-                fetch(u).catch(() => {});
-            }, url);
-            return;
-        } catch (e) {
-            lastError = e;
-            await sleep(500);
-        }
-    }
-    throw new Error(
-        "could not ask the background worker to fetch " +
-            url +
-            ", so service-worker interception was never tested. Last " +
-            "error: " +
-            (lastError && lastError.message),
-    );
-}
-
-async function assertWorkerTrafficIntercepted(ctx, stubs) {
-    await probeFromWorker(ctx, WORKER_PROBE_URL);
-
+// Deliberately NOT a synthetic probe fetched through worker.evaluate():
+// evaluating in an extension worker this early kills it (the call fails
+// with "Target page, context or browser has been closed" and the worker
+// disappears), which would break the very thing being measured. Observing
+// traffic the extension already generates costs nothing and cannot
+// perturb it.
+async function assertWorkerTrafficIntercepted(stubs) {
     const seen = await stubs.waitForServiceWorkerTraffic(
         WORKER_TRAFFIC_TIMEOUT_MS,
     );
@@ -244,16 +177,19 @@ async function assertWorkerTrafficIntercepted(ctx, stubs) {
     throw new Error(
         "observed no service-worker request in the route handler within " +
             WORKER_TRAFFIC_TIMEOUT_MS +
-            "ms, although the background worker was asked to fetch " +
-            WORKER_PROBE_URL +
-            ". Two causes are plausible and this check cannot distinguish " +
+            "ms. Under working interception the background worker's " +
+            "startup blocklist fetch (src/background/index.js) reaches the " +
+            "handler about half a second after the route is installed. " +
+            "Two causes are plausible and this check cannot distinguish " +
             "them: (1) service-worker interception is not in effect, so " +
-            "that request went to the real internet unobserved — the suite " +
+            "that traffic went to the real internet unobserved — the suite " +
             "must be run through script/test-e2e, which sets " +
             "PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
             "Playwright upgrade may have dropped or renamed that flag; " +
-            "(2) the probe never ran, because the worker was torn down " +
-            "between being handed over and being evaluated in. Either way " +
+            "(2) no worker request was made in the first place — the route " +
+            "lost the startup race, or the worker no longer fetches at " +
+            "startup, in which case this check needs a new anchor because " +
+            "there is no longer any worker traffic to observe. Either way " +
             "the fix is a replacement mechanism or an honest downgrade of " +
             "the isolation claims in tests/e2e/network.js and README.md — " +
             "not deleting this check",
@@ -305,7 +241,7 @@ async function launch(routeOpts) {
         routeOpts.report = (text) => errors.record("network", text);
         const stubs = await installNetworkStubs(ctx, routeOpts);
 
-        await assertWorkerTrafficIntercepted(ctx, stubs);
+        await assertWorkerTrafficIntercepted(stubs);
 
         // The extension id is derived from the unpacked path, so it
         // changes and must never be hardcoded. It is the host part of the
@@ -351,7 +287,7 @@ async function pageCompilesWasm(page) {
         try {
             await WebAssembly.compile(new Uint8Array(bytes));
             return true;
-        } catch {
+        } catch (_) {
             return false;
         }
     }, EMPTY_WASM_MODULE);

tests/e2e/network.js

@@ -9,12 +9,13 @@
 //
 // Service-worker coverage is not free: ctx.route() only sees worker
 // traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
-// the environment, which script/test-e2e does. Without it every fetch the
-// MV3 background worker makes — the JSON-RPC calls behind every approval
-// in this suite among them — goes to the real internet unobserved. That is
-// not left to trust: waitForServiceWorkerTraffic() below backs the
-// launch-time canary in harness.js, which fails the entire suite if worker
-// requests stop being visible here.
+// the environment, which script/test-e2e does. Without it the phishing
+// blocklist fetch that src/background/index.js issues at worker startup
+// silently reaches raw.githubusercontent.com on the open internet, and
+// src/shared/phishingDomains.js swallows the failure so nothing surfaces
+// it. That is not left to trust: waitForServiceWorkerTraffic() below
+// backs the launch-time canary in harness.js, which fails the entire
+// suite if worker requests stop being visible here.
 //
 // Anything not explicitly stubbed here is aborted AND reported to the
 // error collector, so a newly added outbound call shows up as a test
@@ -102,22 +103,6 @@ function word(value) {
 const DAPP_ORIGIN = "https://dapp.e2e.test";
 const DAPP_URL = DAPP_ORIGIN + "/";
 
-// The same page, served from a hostname that is on the vendored phishing
-// blocklist, so the phishing warning can be driven end to end against the real
-// list rather than a stub of it. It is a live entry at the pinned upstream
-// commit; upstream prunes, so a re-vendoring run that retires it turns the
-// phishing test red, and the fix is a current entry, not a weaker assertion.
-const PHISHING_DAPP_ORIGIN = "https://myetheywallet.com";
-const PHISHING_DAPP_URL = PHISHING_DAPP_ORIGIN + "/";
-
-// A request the harness asks the background service worker to make, purely so
-// that worker interception can be proved before any test runs. Nothing in the
-// extension fetches at startup any more — the blocklist is vendored at build
-// time — so the canary in harness.js has no product traffic to anchor on and
-// generates its own. See assertWorkerTrafficIntercepted().
-const WORKER_PROBE_ORIGIN = "https://worker-probe.e2e.test";
-const WORKER_PROBE_URL = WORKER_PROBE_ORIGIN + "/canary";
-
 // Requests are parked rather than awaited. An approval prompt only exists
 // while its call is in flight, so a test that awaited the promise could
 // never drive the popup that has to settle it; start() files the promise
@@ -221,6 +206,11 @@ const RPC_RESULTS = {
     eth_estimateGas: hex(GAS_LIMIT),
     eth_getTransactionCount: "0x0",
     eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
+    // "not mined yet", which is what a node answers for a transaction it has
+    // only just accepted. The wait screen the dApp transaction approval hands
+    // off to polls this every 10 seconds; leaving it unstubbed would report
+    // the poll as escaping traffic the moment a test outlived one tick.
+    eth_getTransactionReceipt: null,
 };
 
 // The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
@@ -248,35 +238,26 @@ function latestBlock() {
 const SELECTOR_DECIMALS = "0x313ce567";
 
 // Every eth_call still answers with a zero word except decimals() on the
-// stub token, which the wallet reads back at signing time to compare with
-// the scale the confirmation screen rendered (issue #305).
-//
-// opts.tokenDecimalsOverride is the lying contract: set it and decimals()
-// answers something other than the value this same fixture reports through
-// Blockscout, which is exactly the disagreement the wallet must refuse to
-// sign over. It is read at request time, so a test flips it on the options
-// object the route was registered with — after the confirmation screen has
-// been built — without re-registering anything.
-function ethCallResult(req, opts) {
+// stub token. ethers reads that before it can encode an ERC-20 transfer,
+// and a zero there makes parseUnits() reject any fractional amount — so the
+// ERC-20 confirmation path would fail its gas estimate for a reason that
+// has nothing to do with what is being tested.
+function ethCallResult(req) {
     const call = Array.isArray(req.params) ? req.params[0] : null;
     if (!call || typeof call !== "object") return ZERO_WORD;
     const data = String(call.data || call.input || "").toLowerCase();
     const to = String(call.to || "").toLowerCase();
     if (data.startsWith(SELECTOR_DECIMALS) && to === STUB_TOKEN.address) {
-        return word(opts.tokenDecimalsOverride || STUB_TOKEN.decimals);
+        return word(STUB_TOKEN.decimals);
     }
     return ZERO_WORD;
 }
 
-// opts.tokenSymbolOverride is the hostile contract: set it and the explorer
-// reports that string as the token's symbol, exactly as it would for a token
-// whose symbol() returns markup. Read at request time, like every other
-// fixture switch, so a test can flip it and reopen the popup.
-function tokenObject(opts) {
+function tokenObject() {
     return {
         address_hash: STUB_TOKEN.address,
         address: STUB_TOKEN.address,
-        symbol: (opts && opts.tokenSymbolOverride) || STUB_TOKEN.symbol,
+        symbol: STUB_TOKEN.symbol,
         name: STUB_TOKEN.name,
         decimals: STUB_TOKEN.decimals,
         holders_count: STUB_TOKEN.holders,
@@ -285,7 +266,7 @@ function tokenObject(opts) {
 }
 
 // One received ERC-20 transfer of 1.5 E2E to the address under test.
-function tokenTransferItems(address, opts) {
+function tokenTransferItems(address) {
     return [
         {
             transaction_hash: STUB_TX_HASH,
@@ -294,7 +275,7 @@ function tokenTransferItems(address, opts) {
             from: { hash: STUB_COUNTERPARTY },
             to: { hash: address },
             total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
-            token: tokenObject(opts),
+            token: tokenObject(),
         },
     ];
 }
@@ -321,11 +302,11 @@ function nativeTransactionItems(address) {
 // A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
 // this is what puts an ERC-20 in the send screen's token dropdown, which is
 // the only way the confirmation screen's ERC-20 path can be reached.
-function tokenBalanceItems(opts) {
+function tokenBalanceItems() {
     return [
         {
             value: "1500000",
-            token: tokenObject(opts),
+            token: tokenObject(),
         },
     ];
 }
@@ -350,38 +331,6 @@ function transactionDetails(hash) {
     };
 }
 
-// The receipt for a transaction this run broadcast.
-//
-// eth_getTransactionReceipt otherwise answers null — "not mined yet", which is
-// what a node says about a transaction it has only just accepted, and what the
-// wait screen has to keep polling through. opts.seedReceipt confirms it
-// instead, which is how a test that drives the popup's own send to a broadcast
-// gets off the wait screen: the wait resolves to the success view, which has a
-// Done button, rather than polling for a receipt for the rest of the suite.
-//
-// Every field ethers' receipt formatter requires is present. A receipt it
-// cannot parse throws inside the poll, which the wallet reports through
-// log.errorf — i.e. console.error — and the harness fails the run on, so a
-// half-populated fixture here would surface as an unrelated-looking failure.
-function transactionReceipt(hash) {
-    return {
-        transactionHash: hash,
-        transactionIndex: "0x0",
-        blockHash: "0x" + "33".repeat(32),
-        blockNumber: hex(STUB_BLOCK_NUMBER),
-        from: STUB_COUNTERPARTY,
-        to: STUB_TOKEN.address,
-        cumulativeGasUsed: hex(GAS_LIMIT),
-        gasUsed: hex(GAS_LIMIT),
-        effectiveGasPrice: hex(GAS_PRICE_WEI),
-        contractAddress: null,
-        logs: [],
-        logsBloom: "0x" + "00".repeat(256),
-        status: "0x1",
-        type: "0x2",
-    };
-}
-
 function jsonResponse(route, body) {
     return route.fulfill({
         status: 200,
@@ -444,13 +393,7 @@ function rpcReply(req, opts, report) {
         });
     }
     if (req.method === "eth_call") {
-        return Object.assign(envelope, { result: ethCallResult(req, opts) });
-    }
-    if (req.method === "eth_getTransactionReceipt") {
-        const hash = Array.isArray(req.params) ? req.params[0] : null;
-        return Object.assign(envelope, {
-            result: opts.seedReceipt && hash ? transactionReceipt(hash) : null,
-        });
+        return Object.assign(envelope, { result: ethCallResult(req) });
     }
     if (req.method === "eth_getBlockByNumber") {
         return Object.assign(envelope, { result: latestBlock() });
@@ -597,14 +540,6 @@ function traceEnabled(raw) {
  *   eth_estimateGas until this is cleared again.
  * @param {string[]} [opts.broadcastTransactions]  every raw signed
  *   transaction handed to eth_sendRawTransaction, appended in order.
- * @param {string} [opts.tokenDecimalsOverride]  what decimals() answers for
- *   the stub token, in place of the value Blockscout reports for it. This is
- *   the token that lies about its scale; read at request time.
- * @param {string} [opts.tokenSymbolOverride]  what the explorer reports as
- *   the stub token's symbol, in place of "E2E". This is the token whose
- *   symbol is markup; read at request time.
- * @param {boolean} [opts.seedReceipt]  answer eth_getTransactionReceipt with a
- *   confirmed receipt instead of null, so a wait screen resolves.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -620,9 +555,10 @@ async function installNetworkStubs(ctx, opts) {
     // E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
     // tagged [sw] when it originated in the background service worker.
     // It exists so the isolation claim above can be re-checked by anyone
-    // in one command, without editing files: the canary probe and then
-    // every JSON-RPC call behind an approval showing up with an [sw] tag
-    // is the proof that the worker really is intercepted.
+    // in one command, without editing files: the phishing blocklist fetch
+    // showing up with an [sw] tag is the proof that the worker really is
+    // intercepted and that the raw.githubusercontent.com stub below is
+    // live code rather than decoration.
     const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
 
     // Regex rather than a glob so chrome-extension:// resource loads are
@@ -653,11 +589,7 @@ async function installNetworkStubs(ctx, opts) {
         // trips run against a real http(s) origin — which is what makes the
         // shipped content scripts inject at all — without any remote origin
         // being involved.
-        if (
-            (url.origin === DAPP_ORIGIN ||
-                url.origin === PHISHING_DAPP_ORIGIN) &&
-            p === "/"
-        ) {
+        if (url.origin === DAPP_ORIGIN && p === "/") {
             return route.fulfill({
                 status: 200,
                 contentType: "text/html; charset=utf-8",
@@ -681,14 +613,14 @@ async function installNetworkStubs(ctx, opts) {
                 return jsonResponse(route, {
                     items:
                         opts.seedTokenTransfer && addr
-                            ? tokenTransferItems(addr, opts)
+                            ? tokenTransferItems(addr)
                             : [],
                 });
             }
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
                 return jsonResponse(
                     route,
-                    opts.seedTokenBalance ? tokenBalanceItems(opts) : [],
+                    opts.seedTokenBalance ? tokenBalanceItems() : [],
                 );
             }
             for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {
@@ -703,10 +635,18 @@ async function installNetworkStubs(ctx, opts) {
             return jsonResponse(route, { Data: {} });
         }
 
-        // The interception canary's own request. Answered with nothing: what
-        // is being observed is that it arrived here at all.
-        if (url.href === WORKER_PROBE_URL) {
-            return route.fulfill({ status: 204, body: "" });
+        // MetaMask phishing blocklist
+        if (
+            url.hostname === "raw.githubusercontent.com" ||
+            p.endsWith("/eth-phishing-detect/main/src/config.json")
+        ) {
+            return jsonResponse(route, {
+                version: 2,
+                tolerance: 2,
+                fuzzylist: [],
+                whitelist: [],
+                blacklist: [],
+            });
         }
 
         // Best-effort Etherscan address labels: served as an empty page.
@@ -727,12 +667,12 @@ async function installNetworkStubs(ctx, opts) {
          * Resolve with the first service-worker-originated request this
          * handler saw, or null if none arrives within `ms`.
          *
-         * The caller asks the worker for one request of its own (see
-         * WORKER_PROBE_URL) and then waits here, so under working
-         * interception this resolves almost immediately. Nothing arriving
-         * means worker traffic is bypassing the handler entirely and going
-         * to the real internet, which the caller turns into a hard failure
-         * of the whole suite.
+         * The background worker fetches the phishing blocklist at
+         * startup, unconditionally, within about a second of the context
+         * coming up — so under working interception this resolves almost
+         * immediately. Nothing arriving means worker traffic is bypassing
+         * the handler entirely and going to the real internet, which the
+         * caller turns into a hard failure of the whole suite.
          */
         waitForServiceWorkerTraffic(ms) {
             if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
@@ -756,9 +696,6 @@ module.exports = {
     DAPP_HTML,
     DAPP_ORIGIN,
     DAPP_URL,
-    PHISHING_DAPP_ORIGIN,
-    PHISHING_DAPP_URL,
-    WORKER_PROBE_URL,
     FEE_ESTIMATE_WEI,
     FEE_RESERVE_WEI,
     STUB_COUNTERPARTY,

tests/htmlEscape.test.js

@@ -1,110 +0,0 @@
-// The escape every view depends on, and the length bound on a displayed
-// token symbol. Both were added for #307, where a token whose symbol()
-// returned an <iframe> tag rendered that iframe inside the popup.
-
-const { escapeHtml } = require("../src/shared/html");
-const {
-    displaySymbol,
-    MAX_SYMBOL_LENGTH,
-    UNKNOWN_SYMBOL,
-} = require("../src/shared/symbolDisplay");
-
-// The payload from the issue's reproduction, verbatim.
-const HOSTILE_SYMBOL =
-    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
-
-describe("escapeHtml", () => {
-    test("escapes all five characters, quotes included", () => {
-        expect(escapeHtml("&<>\"'")).toBe("&amp;&lt;&gt;&quot;&#39;");
-    });
-
-    // The regression this function was rewritten for. The previous
-    // implementation round-tripped through a detached div's textContent,
-    // and an HTML text node serializes a quote as itself — so a value with
-    // a quote in it broke straight out of data-copy="..." and href="...".
-    test("escapes quotes, which the textContent round trip did not", () => {
-        expect(escapeHtml('a"b')).toBe("a&quot;b");
-        expect(escapeHtml("a'b")).toBe("a&#39;b");
-    });
-
-    test("does not double-escape an ampersand it just introduced", () => {
-        expect(escapeHtml("&lt;")).toBe("&amp;lt;");
-        expect(escapeHtml("&amp;")).toBe("&amp;amp;");
-    });
-
-    test("leaves a string with nothing to escape untouched", () => {
-        expect(escapeHtml("USDC")).toBe("USDC");
-        expect(escapeHtml("")).toBe("");
-    });
-
-    test("renders the hostile symbol inert", () => {
-        const out = escapeHtml(HOSTILE_SYMBOL);
-        expect(out).not.toContain("<");
-        expect(out).not.toContain(">");
-        expect(out).not.toContain('"');
-        expect(out).toContain("&lt;iframe");
-    });
-
-    // A quoted attribute is broken out of by a quote, a bare one by a
-    // space; both are closed here. Asserted as a whole attribute rather
-    // than character by character, because it is the attribute that has to
-    // survive, not the escape table.
-    test("a value carrying a quote stays inside its attribute", () => {
-        const evil = '" onload="alert(1)';
-        const attr = `data-copy="${escapeHtml(evil)}"`;
-        expect(attr).toBe('data-copy="&quot; onload=&quot;alert(1)"');
-        expect(attr.split('"').length - 1).toBe(2);
-    });
-
-    test("null and undefined render as nothing rather than as words", () => {
-        expect(escapeHtml(null)).toBe("");
-        expect(escapeHtml(undefined)).toBe("");
-    });
-
-    test("coerces a non-string without losing the escape", () => {
-        expect(escapeHtml(42)).toBe("42");
-        expect(escapeHtml({ toString: () => "<b>" })).toBe("&lt;b&gt;");
-    });
-});
-
-describe("displaySymbol", () => {
-    test("passes every symbol in the bundled list through unchanged", () => {
-        const { TOKENS } = require("../src/shared/tokenList");
-        for (const t of TOKENS) {
-            expect([t.address, displaySymbol(t.symbol)]).toEqual([
-                t.address,
-                t.symbol,
-            ]);
-        }
-    });
-
-    test("caps an over-long symbol and marks it as truncated", () => {
-        const long = "A".repeat(4096);
-        const out = displaySymbol(long);
-        expect(out.length).toBe(MAX_SYMBOL_LENGTH);
-        expect(out.endsWith("…")).toBe(true);
-    });
-
-    test("keeps a symbol of exactly the cap intact", () => {
-        const exact = "A".repeat(MAX_SYMBOL_LENGTH);
-        expect(displaySymbol(exact)).toBe(exact);
-    });
-
-    test("substitutes a placeholder for an absent symbol", () => {
-        expect(displaySymbol("")).toBe(UNKNOWN_SYMBOL);
-        expect(displaySymbol(null)).toBe(UNKNOWN_SYMBOL);
-        expect(displaySymbol(undefined)).toBe(UNKNOWN_SYMBOL);
-    });
-
-    // The cap is a layout bound and nothing more: it must not be mistaken
-    // for the thing that makes a symbol safe to render. A short hostile
-    // symbol passes through it untouched, and is inert only because the
-    // caller escapes it afterwards.
-    test("does not sanitize — a short markup symbol survives it verbatim", () => {
-        expect(displaySymbol("<img src=x>")).toBe("<img src=x>");
-        expect(escapeHtml(displaySymbol("<img src=x>"))).toBe(
-            "&lt;img src=x&gt;",
-        );
-    });
-});

tests/manifest.test.js

@@ -13,33 +13,6 @@
 // an exact match on the token set is what keeps the next edit from
 // smuggling one in alongside.
 //
-// It is also the anti-regression check for #307. The policy used to declare
-// script-src and object-src and nothing else, which left every directive
-// that does not fall back to them — and, absent default-src, every one that
-// does — wide open: a hostile ERC-20 symbol that reached innerHTML could
-// load a full-viewport cross-origin iframe over the wallet's own UI. The
-// escaping in src/shared/html.js is the primary fix; default-src is what
-// stops the next escape that slips from reaching the network.
-//
-// Every directive below is pinned exactly, because each of the four
-// loosenings is load-bearing and none of them may grow:
-//
-//   style-src 'unsafe-inline'  src/popup/index.html and the view helpers
-//                              use style="..." attributes throughout, which
-//                              CSP blocks without it. Chrome enforces this
-//                              on attributes, not just <style> blocks, and
-//                              Firefox has never implemented style-src-attr,
-//                              so there is no narrower spelling available.
-//   img-src data:              blockies are data: PNGs assigned to img.src.
-//   connect-src https: http:   the RPC endpoint is user-configurable, and a
-//                              local node over http://127.0.0.1 is a
-//                              supported configuration — the Firefox e2e
-//                              suite runs on exactly that.
-//   frame-src/form-action/base-uri  named rather than inherited: form-action
-//                              and base-uri do not fall back to default-src
-//                              at all, and frame-src 'none' is what kills
-//                              the reported attack outright.
-//
 // build.js copies these files to dist/<target>/manifest.json verbatim, so
 // what is asserted here is what ships.
 
@@ -48,22 +21,8 @@ const path = require("path");
 
 const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
 
-const EXPECTED_DIRECTIVES = {
-    "default-src": ["'self'"],
-    "script-src": ["'self'", "'wasm-unsafe-eval'"],
-    "object-src": ["'self'"],
-    "style-src": ["'self'", "'unsafe-inline'"],
-    "img-src": ["'self'", "data:"],
-    "connect-src": ["'self'", "http:", "https:"],
-    "frame-src": ["'none'"],
-    "form-action": ["'none'"],
-    "base-uri": ["'none'"],
-};
-
-// Directives that fetch script. Nothing that can execute code may name a
-// remote source, an eval form, or an inline form; 'wasm-unsafe-eval' is the
-// single deliberate exception and it is pinned above.
-const SCRIPT_DIRECTIVES = ["default-src", "script-src", "object-src"];
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
 
 const FORBIDDEN_SOURCES = [
     "'unsafe-eval'",
@@ -94,31 +53,26 @@ function parseCsp(policy) {
 
 function assertPolicy(policy) {
     const directives = parseCsp(policy);
-    // Exact, in both directions: a directive that appears here and not in
-    // EXPECTED_DIRECTIVES is an unreviewed addition, and one that
-    // disappears silently reopens whatever it was closing.
-    expect(Object.keys(directives).sort()).toEqual(
-        Object.keys(EXPECTED_DIRECTIVES).sort(),
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
     );
-    for (const [name, sources] of Object.entries(EXPECTED_DIRECTIVES)) {
-        expect([name, directives[name].slice().sort()]).toEqual([
-            name,
-            sources.slice().sort(),
-        ]);
-    }
-    for (const name of SCRIPT_DIRECTIVES) {
-        for (const source of FORBIDDEN_SOURCES) {
-            expect(name + " " + directives[name].join(" ")).not.toContain(
-                " " + source,
-            );
-        }
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
     }
 }
 
 describe("shipped Content Security Policy", () => {
     // MV3 takes an object and applies extension_pages to the popup and the
     // background service worker, which is where libsodium runs.
-    test("chrome MV3 ships the pinned policy, default-src included", () => {
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
         const csp = readManifest("chrome").content_security_policy;
         expect(typeof csp).toBe("object");
         expect(Object.keys(csp)).toEqual(["extension_pages"]);
@@ -133,7 +87,7 @@ describe("shipped Content Security Policy", () => {
     // Firefox before 106 rejects an MV2 policy string that omits
     // object-src and falls back to its own default, discarding everything
     // declared here. Same policy as Chrome, different manifest shape.
-    test("firefox MV2 ships the pinned policy, default-src included", () => {
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
         const csp = readManifest("firefox").content_security_policy;
         expect(typeof csp).toBe("string");
         assertPolicy(csp);

tests/networkEndpoints.test.js

@@ -1,192 +0,0 @@
-// What a chain switch is allowed to do to the endpoints the user configured.
-//
-// A switch used to overwrite state.rpcUrl and state.blockscoutUrl with the
-// network defaults, so a user pointing the wallet at their own node lost that
-// url the first time anything switched chains — with no notification and no
-// way to recover it, having been moved onto a public endpoint that then sees
-// every address they hold (https://git.eeqj.de/sneak/AutistMask/issues/308).
-// Endpoints are now remembered per network, which is why the round trips
-// below assert the ORIGINAL url comes back rather than only that the switch
-// happened.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-// The user's own node: the pair the switch used to throw away.
-const CUSTOM_RPC = "http://127.0.0.1:8545";
-const CUSTOM_BLOCKSCOUT = "http://127.0.0.1:4000/api/v2";
-
-function walletFixture() {
-    return [
-        {
-            name: "Wallet 1",
-            type: "hd",
-            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
-        },
-    ];
-}
-
-// The real state module against stubbed storage, plus whatever the last
-// saveState() wrote — so a case can reload a fresh module from the bytes an
-// earlier one persisted, which is what an extension restart does. `state` is
-// a module-level singleton, so the registry has to be reset per load.
-function loadModuleWith(persisted) {
-    jest.resetModules();
-    let written = null;
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () =>
-                    persisted ? { autistmask: persisted } : {},
-                ),
-                set: jest.fn(async (items) => {
-                    written = items.autistmask;
-                }),
-            },
-        },
-    };
-    return {
-        mod: require("../src/shared/state"),
-        chainSwitch: require("../src/shared/chainSwitch"),
-        written: () => written,
-    };
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-describe("a custom endpoint survives a chain switch", () => {
-    test("switching away and back restores the user's rpc and blockscout urls", async () => {
-        const { mod, chainSwitch } = loadModuleWith({
-            wallets: walletFixture(),
-            networkId: "mainnet",
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-            networkEndpoints: {
-                mainnet: {
-                    rpcUrl: CUSTOM_RPC,
-                    blockscoutUrl: CUSTOM_BLOCKSCOUT,
-                },
-            },
-        });
-        await mod.loadState();
-
-        await chainSwitch.onChainSwitch("sepolia");
-        // The new chain gets its own endpoints, not the ones belonging to the
-        // chain just left: a mainnet node cannot answer for Sepolia.
-        expect(mod.state.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
-        expect(mod.state.blockscoutUrl).toBe(SEPOLIA.defaultBlockscoutUrl);
-
-        await chainSwitch.onChainSwitch("mainnet");
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-    });
-
-    test("an endpoint set on the network being left is remembered, not lost", async () => {
-        const { mod, chainSwitch } = loadModuleWith({
-            wallets: walletFixture(),
-            networkId: "sepolia",
-            rpcUrl: SEPOLIA.defaultRpcUrl,
-            blockscoutUrl: SEPOLIA.defaultBlockscoutUrl,
-            networkEndpoints: {},
-        });
-        await mod.loadState();
-
-        // What the Settings screen does: write the live field, then save. The
-        // map entry for the active network is stale until the switch, which
-        // is what snapshotting the outgoing network exists to reconcile.
-        mod.state.rpcUrl = CUSTOM_RPC;
-        await mod.saveState();
-
-        await chainSwitch.onChainSwitch("mainnet");
-        expect(mod.state.rpcUrl).toBe(MAINNET.defaultRpcUrl);
-
-        await chainSwitch.onChainSwitch("sepolia");
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-    });
-
-    test("the remembered endpoints survive an extension restart", async () => {
-        const first = loadModuleWith({
-            wallets: walletFixture(),
-            networkId: "mainnet",
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        });
-        await first.mod.loadState();
-        await first.chainSwitch.onChainSwitch("sepolia");
-
-        // Reload from exactly the bytes the switch persisted.
-        const second = loadModuleWith(first.written());
-        await second.mod.loadState();
-        expect(second.mod.state.networkId).toBe("sepolia");
-        expect(second.mod.state.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
-
-        await second.chainSwitch.onChainSwitch("mainnet");
-        expect(second.mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(second.mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-    });
-
-    test("a profile written before networkEndpoints existed keeps its endpoint", async () => {
-        // Exactly the stored shape the current release writes: one pair of
-        // urls and no map. It is adopted as the remembered pair of the
-        // network it was stored under.
-        const { mod, chainSwitch } = loadModuleWith({
-            wallets: walletFixture(),
-            networkId: "mainnet",
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        });
-        await mod.loadState();
-
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(mod.state.networkEndpoints).toEqual({
-            mainnet: { rpcUrl: CUSTOM_RPC, blockscoutUrl: CUSTOM_BLOCKSCOUT },
-        });
-
-        await chainSwitch.onChainSwitch("sepolia");
-        await chainSwitch.onChainSwitch("mainnet");
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-    });
-
-    // A primitive is the dangerous case, not the array: assigning a property
-    // to a string throws nothing and stores nothing, so a stored string would
-    // be carried through loadState() and re-persisted by every save, and each
-    // switch would fall back to the public default in place of the user's
-    // endpoint, permanently.
-    test.each([
-        ["an array", ["not", "a", "map"]],
-        ["a string", "junk"],
-        ["a number", 7],
-    ])("a stored networkEndpoints that is %s is discarded", async (_, bad) => {
-        const { mod, chainSwitch } = loadModuleWith({
-            wallets: walletFixture(),
-            networkId: "mainnet",
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-            networkEndpoints: bad,
-        });
-        await mod.loadState();
-
-        // Discarded, then seeded from the live endpoints the same way an old
-        // profile is — never left as something onChainSwitch() would index.
-        expect(mod.state.networkEndpoints).toEqual({
-            mainnet: {
-                rpcUrl: CUSTOM_RPC,
-                blockscoutUrl: CUSTOM_BLOCKSCOUT,
-            },
-        });
-
-        // And the endpoint really survives the round trip, which is the point
-        // of discarding it rather than only of the shape being right.
-        await chainSwitch.onChainSwitch("sepolia");
-        await chainSwitch.onChainSwitch("mainnet");
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-    });
-});

tests/passwordMessages.test.js

@@ -1,4 +1,4 @@
-// One wording for one condition (issues #172 and #265).
+// One wording for one condition (issue #172).
 //
 // Every screen that asks for the password decrypts the vault itself, and
 // each one used to write its own sentence for the same failure: the send
@@ -21,15 +21,6 @@
 // call site is read back to its own catch handler and the prose that
 // handler shows the user must be the canonical sentence and nothing else
 // — which fails on a novel wording, not only on a known-superseded one.
-//
-// The empty-password condition (#265) is pinned the same way and off the
-// same call sites: the private key export screen said "Password is
-// required." where the other five said "Please enter your password." Each
-// decrypt's password variable is walked back to the guard that rejects it
-// when blank, and the prose that guard shows must be the canonical
-// sentence. Anchoring on the decrypt keeps the wallet-creation screen out
-// of the set: an empty field there is a password being CHOSEN, a
-// different condition with its own wording.
 
 const fs = require("fs");
 const path = require("path");
@@ -37,7 +28,6 @@ const path = require("path");
 const SRC = path.join(__dirname, "..", "src");
 
 const CANONICAL = "That password is incorrect. Please try again.";
-const CANONICAL_EMPTY = "Please enter your password.";
 
 // Wordings this repo has actually shipped for the same condition. This is
 // a secondary, whole-file sweep for stragglers outside a decrypt handler;
@@ -46,7 +36,6 @@ const CANONICAL_EMPTY = "Please enter your password.";
 const SUPERSEDED = [
     "Wrong password.",
     "That password is not correct. Please try again.",
-    "Password is required.",
 ];
 
 function jsFilesUnder(dir) {
@@ -160,71 +149,6 @@ function handlerMessages(file, callOffset, label) {
         .filter((v) => v.includes(" "));
 }
 
-// The identifier a decrypt call passes as its password, which is what the
-// empty-field guard for that screen tests.
-function passwordArg(masked, callOffset, label) {
-    const open = callOffset + "decryptWithPassword".length;
-    const args = [];
-    let depth = 0;
-    let start = open + 1;
-    for (let i = open; i < masked.length; i++) {
-        const c = masked[i];
-        if (c === "(" || c === "[" || c === "{") depth += 1;
-        else if (c === ")" || c === "]" || c === "}") {
-            depth -= 1;
-            if (depth === 0) {
-                args.push(masked.slice(start, i));
-                break;
-            }
-        } else if (c === "," && depth === 1) {
-            args.push(masked.slice(start, i));
-            start = i + 1;
-        }
-    }
-    const arg = (args[1] ?? "").trim();
-    if (!/^[A-Za-z_$][\w$]*$/.test(arg))
-        throw new Error(`${label}: password argument is not a name: ${arg}`);
-    return arg;
-}
-
-// Innermost block enclosing the decrypt that also declares its password
-// variable — the handler the screen's submit button runs, which is where
-// the empty-field guard lives.
-function declaringBlock(masked, callOffset, ident, label) {
-    const declared = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*=`);
-    let at = callOffset;
-    for (;;) {
-        const open = enclosingBlockStart(masked, at);
-        if (open === -1) throw new Error(`${label}: nothing declares ${ident}`);
-        const end = blockEnd(masked, open);
-        if (declared.test(masked.slice(open, end))) return [open, end];
-        at = open - 1;
-    }
-}
-
-// The prose the empty-field guard puts in front of the user. Exactly one
-// guard per handler is required: two would mean the condition is answered
-// in more than one place and this would be pinning only one of them.
-function emptyGuardMessages(file, callOffset, label) {
-    const { masked, strings } = scan(fs.readFileSync(file, "utf8"));
-    const ident = passwordArg(masked, callOffset, label);
-    const [from, to] = declaringBlock(masked, callOffset, ident, label);
-    const guard = new RegExp(`if\\s*\\(\\s*!\\s*${ident}\\s*\\)\\s*\\{`, "g");
-    const opens = [];
-    let m;
-    while ((m = guard.exec(masked.slice(from, to))) !== null)
-        opens.push(from + m.index + m[0].length - 1);
-    if (opens.length !== 1)
-        throw new Error(
-            `${label}: expected one empty-${ident} guard, found ${opens.length}`,
-        );
-    const close = blockEnd(masked, opens[0]);
-    return strings
-        .filter((s) => s.offset >= opens[0] && s.offset < close)
-        .map((s) => s.value)
-        .filter((v) => v.includes(" "));
-}
-
 // The call sites are found, not listed: the file layout moves (the private
 // key export was in addressDetail.js when #172 was filed and is its own
 // view now), and a hardcoded list would quietly stop covering a screen it
@@ -263,9 +187,8 @@ describe("password failure messages", () => {
         });
     });
 
-    test("the canonical messages are full sentences", () => {
+    test("the canonical message is a full sentence", () => {
         expect(CANONICAL).toMatch(/^[A-Z][^]*\.$/);
-        expect(CANONICAL_EMPTY).toMatch(/^[A-Z][^]*\.$/);
     });
 
     // Exact equality, per call site: a message that is merely different
@@ -280,15 +203,6 @@ describe("password failure messages", () => {
         },
     );
 
-    test.each(sites.map((s) => [s.label, s]))(
-        "%s answers an empty password field with the canonical sentence",
-        (label, site) => {
-            expect(emptyGuardMessages(site.file, site.offset, label)).toEqual([
-                CANONICAL_EMPTY,
-            ]);
-        },
-    );
-
     test.each(files.map((f) => [path.relative(SRC, f), f]))(
         "%s carries no superseded wording",
         (_rel, file) => {

tests/phishingDomains.test.js

@@ -1,219 +1,573 @@
-// The phishing blocklist is vendored at build time and shipped as digests:
-// script/vendor-blocklist writes src/shared/phishingBlocklist.json, and nothing
-// fetches anything at runtime. Two things therefore have to be proven here, and
-// the second is the one that would otherwise fail silently:
-//
-//   - real domains from the vendored list are detected, and clean ones are not.
-//   - a malformed artifact fails loudly. Every way of getting the artifact
-//     wrong produces a blocklist that matches nothing while looking healthy,
-//     which is a phishing check that answers "no" to everything.
+// Extension storage stub for the Node test environment. The module resolves
+// the storage API on use, so this only has to exist before the first call.
+// Values round-trip through JSON the way structured cloning would, so a test
+// cannot pass by holding a live reference to the module's own array.
+const storageStore = {};
+global.chrome = {
+    storage: {
+        local: {
+            get: async (key) =>
+                Object.prototype.hasOwnProperty.call(storageStore, key)
+                    ? { [key]: JSON.parse(JSON.stringify(storageStore[key])) }
+                    : {},
+            set: async (items) => {
+                for (const [key, value] of Object.entries(items)) {
+                    storageStore[key] = JSON.parse(JSON.stringify(value));
+                }
+            },
+            remove: async (key) => {
+                delete storageStore[key];
+            },
+        },
+    },
+};
 
 const {
     isPhishingDomain,
+    loadConfig,
     getBlocklistSize,
+    getDeltaSize,
     hostnameVariants,
+    DELTA_STORAGE_KEY,
+    _reset,
+    _getVendoredBlacklistSize,
+    _getDeltaBlacklist,
 } = require("../src/shared/phishingDomains");
-const { HASH_HEX_CHARS, hashDomain } = require("../src/shared/domainHash");
-const vendored = require("../src/shared/phishingBlocklist.json");
 
-// Domains present in the vendored list at the pinned upstream commit. Upstream
-// prunes as well as adds, so re-vendoring can retire one of these and turn this
-// red; that is the intended prompt to pick a current entry, not a licence to
-// weaken the assertion into "some domain somewhere matches".
-const LISTED = [
-    "0-google.ph",
-    "myetheywallet.com",
-    // An underscore is not legal in a hostname, but DNS carries one and
-    // browsers resolve it, and upstream lists well over a hundred phishing
-    // sites that use one. The vendoring transform keeps them.
-    "phntum-wallett.godaddysites.com",
-    "coinbase_prologin1.godaddysites.com",
-];
-
-// Not on the list, and the kind of host a user actually visits.
-const CLEAN = ["etherscan.io", "example.com", "opensea.io", "sneak.berlin"];
-
-describe("vendored blocklist", () => {
-    test("the artifact holds the whole list", () => {
-        expect(getBlocklistSize()).toBeGreaterThan(100000);
-        expect(vendored.hashes).toHaveLength(vendored.count * HASH_HEX_CHARS);
-    });
-
-    test("the digests are sorted and unique", () => {
-        // The lookup is a binary search over the concatenated digests. An
-        // unsorted or duplicated artifact would fail lookups quietly rather
-        // than loudly, so the ordering the search depends on is asserted here
-        // against the committed file rather than assumed of the generator.
-        // One assertion at the end rather than one per entry: 100k+ expect()
-        // calls cost seconds, and make test is capped at 30 for the whole
-        // suite. The index of the first offender is reported, so a failure
-        // still says where.
-        let previous = "";
-        let outOfOrderAt = -1;
-        for (let i = 0; i < vendored.count; i++) {
-            const at = vendored.hashes.slice(
-                i * HASH_HEX_CHARS,
-                (i + 1) * HASH_HEX_CHARS,
-            );
-            if (at <= previous) {
-                outOfOrderAt = i;
-                break;
-            }
-            previous = at;
-        }
-        expect(outOfOrderAt).toBe(-1);
-    });
-
-    test("every digest is lowercase hex of the declared width", () => {
-        expect(vendored.hashes).toMatch(/^[0-9a-f]*$/);
-    });
-
-    test("detects domains from the vendored list", () => {
-        for (const domain of LISTED) {
-            expect(isPhishingDomain(domain)).toBe(true);
-        }
-    });
-
-    test("does not flag legitimate domains", () => {
-        for (const domain of CLEAN) {
-            expect(isPhishingDomain(domain)).toBe(false);
-        }
-    });
-
-    test("detects a subdomain of a listed domain", () => {
-        expect(isPhishingDomain("wallet." + LISTED[0])).toBe(true);
-        expect(isPhishingDomain("a.b.c." + LISTED[0])).toBe(true);
-    });
-
-    test("matching is case-insensitive", () => {
-        expect(isPhishingDomain(LISTED[0].toUpperCase())).toBe(true);
-    });
-
-    test("returns false for an empty or missing hostname", () => {
-        expect(isPhishingDomain("")).toBe(false);
-        expect(isPhishingDomain(null)).toBe(false);
-        expect(isPhishingDomain(undefined)).toBe(false);
-    });
-
-    test("the first and last entries are both reachable", () => {
-        // The ends are where an off-by-one in a binary search hides: a search
-        // that never examines index 0 or index count-1 still finds everything
-        // in between, and the real list is not searched exhaustively here.
-        const first = vendored.hashes.slice(0, HASH_HEX_CHARS);
-        const last = vendored.hashes.slice(-HASH_HEX_CHARS);
-        const { _hashListed } = require("../src/shared/phishingDomains");
-        expect(_hashListed(first)).toBe(true);
-        expect(_hashListed(last)).toBe(true);
-        expect(_hashListed("0".repeat(HASH_HEX_CHARS))).toBe(false);
-        expect(_hashListed("f".repeat(HASH_HEX_CHARS))).toBe(false);
-    });
-});
-
-describe("hostnameVariants", () => {
-    test("returns exact hostname plus parent domains", () => {
-        expect(hostnameVariants("sub.evil.com")).toEqual([
-            "sub.evil.com",
-            "evil.com",
-        ]);
-    });
-
-    test("returns just the hostname for a bare domain", () => {
-        expect(hostnameVariants("example.com")).toEqual(["example.com"]);
-    });
-
-    test("handles deep subdomain chains", () => {
-        expect(hostnameVariants("a.b.c.d.com")).toEqual([
-            "a.b.c.d.com",
-            "b.c.d.com",
-            "c.d.com",
-            "d.com",
-        ]);
-    });
-
-    test("lowercases hostnames", () => {
-        expect(hostnameVariants("Evil.COM")).toEqual(["evil.com"]);
-    });
-});
-
-describe("domain hashing", () => {
-    test("a digest is the declared width of lowercase hex", () => {
-        const hash = hashDomain("example.com");
-        expect(hash).toHaveLength(HASH_HEX_CHARS);
-        expect(hash).toMatch(/^[0-9a-f]+$/);
-    });
-
-    test("hashing is case-insensitive, so lookups are too", () => {
-        expect(hashDomain("Evil.COM")).toBe(hashDomain("evil.com"));
-    });
-
-    test("different domains get different digests", () => {
-        expect(hashDomain("evil.com")).not.toBe(hashDomain("evil.org"));
-    });
-});
-
-// A blocklist that silently matches nothing is the failure this module must not
-// have, so each way of breaking the artifact is required to throw at load. The
-// generator is the only thing that writes this file, but "the generator is
-// correct" is not something the shipped extension can check at runtime — this
-// is what makes a format drift a build failure rather than a silent one.
-describe("a malformed artifact fails loudly", () => {
-    const GOOD = {
-        algorithm: "sha256",
-        hashHexChars: HASH_HEX_CHARS,
-        count: 2,
-        hashes: "0".repeat(HASH_HEX_CHARS) + "1".repeat(HASH_HEX_CHARS),
-    };
-
-    function loadWith(artifact) {
-        let mod;
-        jest.isolateModules(() => {
-            jest.doMock(
-                "../src/shared/phishingBlocklist.json",
-                () => artifact,
-                {
-                    virtual: false,
-                },
-            );
-            mod = require("../src/shared/phishingDomains");
-        });
-        return mod;
+function clearStorage() {
+    for (const key of Object.keys(storageStore)) {
+        delete storageStore[key];
     }
+}
+
+// The MV3 service worker is torn down when idle and re-evaluated on the next
+// event, which wipes every module-level variable. Re-requiring the module with
+// the registry reset is exactly that: fresh in-memory state, same extension
+// storage underneath.
+function restartWorker() {
+    jest.resetModules();
+    return require("../src/shared/phishingDomains");
+}
+
+// Reset delta state before each test to avoid cross-test contamination.
+// Note: vendored sets are immutable and always present.
+beforeEach(() => {
+    _reset();
+    clearStorage();
+});
+
+describe("phishingDomains", () => {
+    describe("vendored blocklist", () => {
+        test("vendored blacklist is loaded from bundled JSON", () => {
+            // The vendored blocklist should have a large number of entries
+            expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
+        });
+
+        test("detects domains from vendored blacklist", () => {
+            // These are well-known phishing domains in the vendored list
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+            expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
+        });
+
+        test("getBlocklistSize includes vendored entries", () => {
+            expect(getBlocklistSize()).toBeGreaterThan(100000);
+        });
+    });
+
+    describe("hostnameVariants", () => {
+        test("returns exact hostname plus parent domains", () => {
+            const variants = hostnameVariants("sub.evil.com");
+            expect(variants).toEqual(["sub.evil.com", "evil.com"]);
+        });
+
+        test("returns just the hostname for a bare domain", () => {
+            const variants = hostnameVariants("example.com");
+            expect(variants).toEqual(["example.com"]);
+        });
+
+        test("handles deep subdomain chains", () => {
+            const variants = hostnameVariants("a.b.c.d.com");
+            expect(variants).toEqual([
+                "a.b.c.d.com",
+                "b.c.d.com",
+                "c.d.com",
+                "d.com",
+            ]);
+        });
+
+        test("lowercases hostnames", () => {
+            const variants = hostnameVariants("Evil.COM");
+            expect(variants).toEqual(["evil.com"]);
+        });
+    });
+
+    describe("delta computation via loadConfig", () => {
+        test("loadConfig computes delta of new entries not in vendored list", () => {
+            loadConfig({
+                blacklist: [
+                    "brand-new-scam-site-xyz123.com",
+                    "hopprotocol.pro", // already in vendored
+                ],
+            });
+            // Only the new domain should be in the delta
+            expect(
+                _getDeltaBlacklist().has("brand-new-scam-site-xyz123.com"),
+            ).toBe(true);
+            expect(_getDeltaBlacklist().has("hopprotocol.pro")).toBe(false);
+            expect(getDeltaSize()).toBe(1);
+        });
+
+        test("re-loading config replaces previous delta", () => {
+            loadConfig({
+                blacklist: ["first-scam-xyz.com"],
+            });
+            expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
+
+            loadConfig({
+                blacklist: ["second-scam-xyz.com"],
+            });
+            expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
+            expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
+        });
+
+        test("getBlocklistSize includes both vendored and delta", () => {
+            const baseSize = getBlocklistSize();
+            loadConfig({
+                blacklist: ["delta-only-scam-xyz.com"],
+            });
+            expect(getBlocklistSize()).toBe(baseSize + 1);
+        });
+    });
+
+    describe("isPhishingDomain with delta + vendored", () => {
+        test("detects domain from delta blacklist", () => {
+            loadConfig({
+                blacklist: ["fresh-scam-xyz.com"],
+            });
+            expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
+        });
+
+        test("detects domain from vendored blacklist", () => {
+            // No delta loaded — vendored still works
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+        });
+
+        test("returns false for clean domains", () => {
+            expect(isPhishingDomain("etherscan.io")).toBe(false);
+            expect(isPhishingDomain("example.com")).toBe(false);
+        });
+
+        test("detects subdomain of blacklisted domain (vendored)", () => {
+            expect(isPhishingDomain("app.hopprotocol.pro")).toBe(true);
+        });
+
+        test("detects subdomain of blacklisted domain (delta)", () => {
+            loadConfig({
+                blacklist: ["delta-phish-xyz.com"],
+            });
+            expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
+        });
+
+        test("case-insensitive matching", () => {
+            loadConfig({
+                blacklist: ["Delta-Scam-XYZ.COM"],
+            });
+            expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
+            expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
+        });
+
+        test("returns false for empty/null hostname", () => {
+            expect(isPhishingDomain("")).toBe(false);
+            expect(isPhishingDomain(null)).toBe(false);
+        });
+
+        test("handles config with no blacklist key", () => {
+            loadConfig({});
+            expect(getDeltaSize()).toBe(0);
+            // Vendored list still works
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+        });
+    });
+
+    describe("extension storage persistence", () => {
+        test("delta is persisted to extension storage, not localStorage", async () => {
+            await loadConfig({
+                blacklist: ["persisted-scam-xyz.com"],
+            });
+            const stored = storageStore[DELTA_STORAGE_KEY];
+            expect(stored).toBeDefined();
+            expect(stored.blacklist).toContain("persisted-scam-xyz.com");
+        });
+
+        test("the fetch timestamp is persisted alongside the delta", async () => {
+            const before = Date.now();
+            await loadConfig({ blacklist: ["timestamped-scam-xyz.com"] });
+            const stored = storageStore[DELTA_STORAGE_KEY];
+            expect(typeof stored.lastFetchTime).toBe("number");
+            expect(stored.lastFetchTime).toBeGreaterThanOrEqual(before);
+        });
+
+        test("an oversized delta is dropped entirely, timestamp included", async () => {
+            // A record above the 256 KiB cap is not worth keeping; the
+            // timestamp goes with it so the next start re-fetches rather than
+            // claiming freshness for a delta that was never stored.
+            const huge = [];
+            for (let i = 0; i < 20000; i++) {
+                huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+            }
+            await loadConfig({ blacklist: huge });
+            expect(storageStore[DELTA_STORAGE_KEY]).toBeUndefined();
+        });
+
+        test("delta is cleared on _reset", () => {
+            loadConfig({
+                blacklist: ["temp-scam-xyz.com"],
+            });
+            expect(getDeltaSize()).toBe(1);
+            _reset();
+            expect(getDeltaSize()).toBe(0);
+        });
+    });
+
+    describe("real-world blocklist patterns", () => {
+        test("detects known phishing domains from vendored list", () => {
+            expect(isPhishingDomain("uniswap-trade.web.app")).toBe(true);
+            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+            expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
+        });
+
+        test("does not flag legitimate domains", () => {
+            expect(isPhishingDomain("opensea.io")).toBe(false);
+            expect(isPhishingDomain("etherscan.io")).toBe(false);
+        });
+    });
+});
+
+describe("phishing list across a service worker restart", () => {
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+    });
 
     afterEach(() => {
-        jest.dontMock("../src/shared/phishingBlocklist.json");
+        delete global.fetch;
     });
 
-    test("the control artifact loads", () => {
-        expect(loadWith(GOOD).getBlocklistSize()).toBe(2);
+    test("a revived worker restores the persisted delta without re-fetching", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["restart-scam-xyz.com"] });
+
+        const revived = restartWorker();
+        // Nothing in memory yet — this is a brand new module instance.
+        expect(revived.getDeltaSize()).toBe(0);
+
+        global.fetch = jest.fn();
+        await revived.initPhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.getDeltaSize()).toBe(1);
+        expect(revived.isPhishingDomain("restart-scam-xyz.com")).toBe(true);
     });
 
-    test("a different digest algorithm throws", () => {
-        expect(() => loadWith({ ...GOOD, algorithm: "md5" })).toThrow(
-            /algorithm/,
-        );
+    test("repeated wakes inside the cache window never re-fetch", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["no-storm-scam-xyz.com"] });
+
+        global.fetch = jest.fn();
+        for (let i = 0; i < 5; i++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+        }
+        expect(global.fetch).not.toHaveBeenCalled();
     });
 
-    test("a different digest width throws", () => {
-        expect(() => loadWith({ ...GOOD, hashHexChars: 8 })).toThrow(
-            /hex characters per entry/,
-        );
+    test("a persisted timestamp older than the TTL causes a fetch on startup", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["stale-scam-xyz.com"] });
+
+        // Age the persisted record past the 24-hour TTL.
+        storageStore[first.DELTA_STORAGE_KEY].lastFetchTime =
+            Date.now() - first.CACHE_TTL_MS - 1000;
+
+        const revived = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["refreshed-scam-xyz.com"] }),
+        }));
+        await revived.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(revived.isPhishingDomain("refreshed-scam-xyz.com")).toBe(true);
+        expect(revived.isPhishingDomain("stale-scam-xyz.com")).toBe(false);
     });
 
-    test("a count that does not match the string length throws", () => {
-        expect(() => loadWith({ ...GOOD, count: 3 })).toThrow(
-            /which is not the/,
-        );
+    test("a first start with nothing persisted fetches immediately", async () => {
+        const fresh = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["first-run-scam-xyz.com"] }),
+        }));
+        await fresh.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(fresh.isPhishingDomain("first-run-scam-xyz.com")).toBe(true);
     });
 
-    test("a missing hashes string throws", () => {
-        expect(() => loadWith({ ...GOOD, hashes: undefined })).toThrow(
-            /no hashes string/,
-        );
-    });
+    test("updatePhishingList honours the persisted timestamp on its own", async () => {
+        // The startup path calls updatePhishingList() directly, so it must
+        // load persisted state itself rather than relying on anything else
+        // having finished first.
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["alarm-tick-scam-xyz.com"] });
 
-    test("an empty artifact throws rather than matching nothing", () => {
-        expect(() => loadWith({ ...GOOD, count: 0, hashes: "" })).toThrow(
-            /entry count/,
-        );
+        const revived = restartWorker();
+        global.fetch = jest.fn();
+        await revived.updatePhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.isPhishingDomain("alarm-tick-scam-xyz.com")).toBe(true);
+    });
+});
+
+// The alarm period alone must set the cadence. lastFetchTime is stamped when
+// the fetch completes, so it lands one fetch latency after the alarm that
+// caused it; a freshness guard timed to the alarm period therefore vetoes
+// every scheduled tick and halves the real refresh rate. These tests measure
+// the interval between fetches that actually happened.
+describe("phishing refresh steady-state cadence", () => {
+    const { PHISHING_REFRESH_PERIOD_MINUTES } = require("../src/shared/alarms");
+    const PERIOD_MS = PHISHING_REFRESH_PERIOD_MINUTES * 60 * 1000;
+
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function fetchStub(latencyMs, seen) {
+        return jest.fn(async () => {
+            seen.push(now);
+            // A network fetch takes time, and lastFetchTime is stamped after
+            // it, not when the alarm fired.
+            now += latencyMs;
+            return { ok: true, json: async () => ({ blacklist: [] }) };
+        });
+    }
+
+    test("ten alarm ticks produce ten fetches, one per period", async () => {
+        const fetchedAt = [];
+        global.fetch = fetchStub(5000, fetchedAt);
+
+        const startup = require("../src/shared/phishingDomains");
+        const T0 = now;
+        await startup.initPhishingList();
+        expect(fetchedAt).toEqual([T0]);
+
+        const TICKS = 10;
+        let tickAt = T0 + PERIOD_MS;
+        for (let i = 0; i < TICKS; i++) {
+            now = tickAt;
+            tickAt += PERIOD_MS;
+            // The browser wakes a terminated worker to deliver the alarm, so
+            // every tick starts from cold memory and the persisted record.
+            const revived = restartWorker();
+            await revived.refreshPhishingListOnSchedule();
+        }
+
+        expect(fetchedAt).toHaveLength(TICKS + 1);
+        const intervals = fetchedAt.slice(1).map((t, i) => t - fetchedAt[i]);
+        expect(intervals).toEqual(new Array(TICKS).fill(PERIOD_MS));
+    });
+
+    test("the scheduled tick fetches whatever the last fetch's latency was", async () => {
+        // The alarm fires one period after the previous alarm, which is
+        // `latency` short of one period since the fetch it caused completed.
+        for (const latency of [200, 1000, 5000]) {
+            clearStorage();
+            jest.resetModules();
+            storageStore[DELTA_STORAGE_KEY] = {
+                blacklist: [],
+                lastFetchTime: now - PERIOD_MS + latency,
+                lastAttemptTime: now - PERIOD_MS,
+            };
+            const mod = require("../src/shared/phishingDomains");
+            const fetchedAt = [];
+            global.fetch = fetchStub(latency, fetchedAt);
+
+            await mod.refreshPhishingListOnSchedule();
+            expect(fetchedAt).toHaveLength(1);
+        }
+    });
+
+    test("a worker wake inside the cache window still does not fetch", async () => {
+        // The TTL is not removed, only taken off the scheduled path. Chrome
+        // revives the worker every ~30 seconds and every revival runs the
+        // startup path, so the TTL still has to keep that off the network.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: [],
+            lastFetchTime: now - PERIOD_MS + 5000,
+            lastAttemptTime: now - PERIOD_MS,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = jest.fn();
+
+        await mod.initPhishingList();
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});
+
+describe("phishing list timestamps that cannot be trusted", () => {
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function okFetch() {
+        return jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["recovered-scam-xyz.com"] }),
+        }));
+    }
+
+    // jest.resetModules() clears the call record of a jest.fn, and simulating
+    // a worker restart is exactly that call. Anything counted across restarts
+    // has to be counted outside the mock.
+    function countingFetch(counter, response) {
+        return async () => {
+            counter.calls++;
+            return response();
+        };
+    }
+
+    test("a lastFetchTime in the future is discarded rather than trusted", async () => {
+        // Clock skew or a restored profile backup writes one. Every guard
+        // measures `Date.now() - stamp` and only tests the lower bound, so a
+        // stamp a year ahead would suppress updates for a year, and now that
+        // the value is persisted it would outlive every worker.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: ["poisoned-scam-xyz.com"],
+            lastFetchTime: now + 365 * 24 * 60 * 60 * 1000,
+            lastAttemptTime: 0,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(mod.isPhishingDomain("recovered-scam-xyz.com")).toBe(true);
+        // And the record it leaves behind is sane, so recovery is permanent.
+        expect(
+            storageStore[DELTA_STORAGE_KEY].lastFetchTime,
+        ).toBeLessThanOrEqual(now);
+    });
+
+    test("a lastAttemptTime in the future does not suppress the retry", async () => {
+        storageStore[DELTA_STORAGE_KEY] = {
+            lastAttemptTime: now + 365 * 24 * 60 * 60 * 1000,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+    });
+
+    test("an oversized delta does not re-download on every worker wake", async () => {
+        // The delta and its freshness claim are both dropped, which is right,
+        // but nothing then says a fetch just happened. Chrome cycles the
+        // worker roughly every 30 seconds idle, so without the attempt stamp
+        // this is a full blocklist download per wake, forever.
+        const huge = [];
+        for (let i = 0; i < 20000; i++) {
+            huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+        }
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: true,
+            json: async () => ({ blacklist: huge }),
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000; // idle timeout, worker torn down and revived
+        }
+
+        expect(counter.calls).toBe(1);
+        expect(storageStore[DELTA_STORAGE_KEY].blacklist).toBeUndefined();
+        expect(typeof storageStore[DELTA_STORAGE_KEY].lastAttemptTime).toBe(
+            "number",
+        );
+    });
+
+    test("a failing fetch is not retried on every worker wake either", async () => {
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000;
+        }
+
+        expect(counter.calls).toBe(1);
+    });
+
+    test("the retry floor expires, so a failure is not permanent", async () => {
+        const {
+            MIN_FETCH_ATTEMPT_INTERVAL_MS,
+        } = require("../src/shared/phishingDomains");
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Still inside the floor: no retry.
+        now += MIN_FETCH_ATTEMPT_INTERVAL_MS - 1000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Past it: the extension goes back to the network.
+        now += 2000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(2);
+    });
+
+    test("the scheduled tick ignores the retry floor", async () => {
+        // The alarm period is far above the floor, but the floor exists to
+        // throttle wakes, not the schedule.
+        storageStore[DELTA_STORAGE_KEY] = { lastAttemptTime: now - 1000 };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.refreshPhishingListOnSchedule();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
     });
 });

tests/popupElementIds.test.js

@@ -1,182 +0,0 @@
-// Every element id the popup views look up must exist in the markup they
-// look it up in.
-//
-// The failure this catches: `$("settings-hide-dsut")` is valid JavaScript
-// referring to a defined function, so neither jest (node environment, no
-// DOM) nor a linter has anything to object to. At runtime `$()` returns
-// null and the next property access throws, which in `init()` aborts the
-// rest of that view's wiring and takes the whole screen down. Settings is
-// the densest concentration of these lookups in the codebase.
-//
-// This is the cheap general half of the guard: it runs in `make check`
-// with no browser and covers every id in every view, not the ones some
-// test happens to click. The expensive specific half is the Settings
-// section of the end-to-end suite (tests/e2e/run.js), which proves the
-// screen actually comes up and its controls work.
-//
-// Scope and limits, stated rather than implied:
-//   - Only literal string arguments are resolvable statically. A call
-//     like `$(containerId)` is invisible here; those are covered by the
-//     e2e run instead.
-//   - `document.getElementById()` is checked too, minus the ids listed in
-//     RUNTIME_CREATED_IDS, which name nodes the code creates itself and
-//     which are legitimately absent from the static markup.
-
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const POPUP_DIR = path.join(__dirname, "..", "src", "popup");
-const POPUP_HTML_PATH = path.join(POPUP_DIR, "index.html");
-
-// Nodes built at runtime rather than authored in index.html. Each one must
-// be created unconditionally by the code before it is ever looked up.
-const RUNTIME_CREATED_IDS = new Set([
-    // Created by updateDebugBanner() in src/popup/views/helpers.js.
-    "debug-banner",
-]);
-
-// Every id lookup the popup performs with a literal argument, as
-// {id, file, line, source} records.
-//
-// showView("x") is included because it resolves to the element id
-// "view-x": a view name with no matching section is the same defect one
-// indirection further out.
-const PATTERNS = [
-    { re: /\$\(\s*"([^"\n]+)"\s*\)/g, id: (m) => m[1], source: "$()" },
-    {
-        re: /document\.getElementById\(\s*"([^"\n]+)"\s*\)/g,
-        id: (m) => m[1],
-        source: "getElementById()",
-    },
-    {
-        re: /\b(?:showError|hideError)\(\s*"([^"\n]+)"/g,
-        id: (m) => m[1],
-        source: "showError()/hideError()",
-    },
-    {
-        re: /\bshowView\(\s*"([^"\n]+)"\s*\)/g,
-        id: (m) => "view-" + m[1],
-        source: "showView()",
-    },
-];
-
-function jsFilesUnder(dir) {
-    const out = [];
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const full = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-            out.push(...jsFilesUnder(full));
-        } else if (entry.name.endsWith(".js")) {
-            out.push(full);
-        }
-    }
-    return out.sort();
-}
-
-function lineOf(text, index) {
-    return text.slice(0, index).split("\n").length;
-}
-
-function collectReferences() {
-    const refs = [];
-    for (const file of jsFilesUnder(POPUP_DIR)) {
-        const text = fs.readFileSync(file, "utf8");
-        const rel = path.relative(path.join(__dirname, ".."), file);
-        for (const { re, id, source } of PATTERNS) {
-            re.lastIndex = 0;
-            let m;
-            while ((m = re.exec(text)) !== null) {
-                refs.push({
-                    id: id(m),
-                    file: rel,
-                    line: lineOf(text, m.index),
-                    source,
-                });
-            }
-        }
-    }
-    return refs;
-}
-
-function collectHtmlIds(html) {
-    const ids = [];
-    const re = /\bid="([^"]+)"/g;
-    let m;
-    while ((m = re.exec(html)) !== null) ids.push(m[1]);
-    return ids;
-}
-
-const HTML = fs.readFileSync(POPUP_HTML_PATH, "utf8");
-const HTML_IDS = collectHtmlIds(HTML);
-const HTML_ID_SET = new Set(HTML_IDS);
-const REFERENCES = collectReferences();
-
-describe("every element id the popup looks up exists in its markup", () => {
-    // A guard that found nothing to check would pass forever. If a
-    // refactor renames the directory, changes the helper, or moves the
-    // markup, this fails instead of quietly covering zero call sites.
-    // The floors are far below the counts measured when this was written
-    // (434 lookups across 20 of the 24 files under src/popup/, against 274
-    // ids in the markup), so ordinary churn does not trip them.
-    test("the scan actually found the code and the markup", () => {
-        const files = new Set(REFERENCES.map((r) => r.file));
-        expect(files.size).toBeGreaterThanOrEqual(15);
-        expect(REFERENCES.length).toBeGreaterThanOrEqual(300);
-        expect(HTML_IDS.length).toBeGreaterThanOrEqual(200);
-
-        // The densest screen, named explicitly: a scan that stopped
-        // covering src/popup/views/settings.js is the exact regression
-        // this file was written for.
-        expect(
-            files.has(path.join("src", "popup", "views", "settings.js")),
-        ).toBe(true);
-        expect(
-            REFERENCES.some((r) => r.id === "settings-hide-spoofed-symbols"),
-        ).toBe(true);
-        expect(REFERENCES.some((r) => r.id === "view-settings")).toBe(true);
-    });
-
-    test("no lookup names an id that src/popup/index.html does not define", () => {
-        const missing = REFERENCES.filter(
-            (r) => !HTML_ID_SET.has(r.id) && !RUNTIME_CREATED_IDS.has(r.id),
-        ).map(
-            (r) =>
-                r.file +
-                ":" +
-                r.line +
-                " " +
-                r.source +
-                ' looks up id "' +
-                r.id +
-                '", which is not in src/popup/index.html',
-        );
-
-        expect(missing).toEqual([]);
-    });
-
-    test("every id excused as runtime-created is still looked up somewhere", () => {
-        // Otherwise the exception list becomes a place stale names
-        // accumulate, and the next real miss can be waved through by
-        // adding one more.
-        for (const id of RUNTIME_CREATED_IDS) {
-            expect(REFERENCES.some((r) => r.id === id)).toBe(true);
-            expect(HTML_ID_SET.has(id)).toBe(false);
-        }
-    });
-
-    test("index.html defines no id twice", () => {
-        // getElementById returns the first match, so a duplicate id means
-        // one of the two elements can never be reached by the code that
-        // thinks it owns it.
-        const seen = new Set();
-        const duplicated = [];
-        for (const id of HTML_IDS) {
-            if (seen.has(id)) duplicated.push(id);
-            seen.add(id);
-        }
-
-        expect(duplicated).toEqual([]);
-    });
-});

tests/symbolSpoof.test.js

@@ -384,7 +384,7 @@ describe("the shipped token list", () => {
                 "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
             ],
             MUSD: [
-                "0xaca92e438df0b2401ff60da7e4337b687a2435da",
+                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
                 "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
             ],
             JPYC: [

tests/transferAmount.test.js

@@ -1,128 +0,0 @@
-// The scale an ERC-20 transfer from the wallet's own Send screen is encoded
-// with (issue #305). The screen renders from the block explorer's cached
-// decimals; the transfer used to be encoded from decimals() read off the
-// contract at signing time, with nothing comparing the two, so a token whose
-// on-chain scale differed signed an amount that was never displayed.
-
-const { parseUnits } = require("ethers");
-const {
-    displayedDecimals,
-    transferAmountUnits,
-    MAX_DECIMALS,
-    UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-    UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-} = require("../src/shared/transferAmount");
-
-describe("displayedDecimals", () => {
-    test("accepts what the explorer and the contract each answer with", () => {
-        // A string is what fetchTokenBalances() parses out of Blockscout, a
-        // number is what it stores, and a bigint is what ethers hands back
-        // from a uint8 return.
-        expect(displayedDecimals("6")).toBe(6);
-        expect(displayedDecimals(6)).toBe(6);
-        expect(displayedDecimals(6n)).toBe(6);
-        expect(displayedDecimals(0)).toBe(0);
-        expect(displayedDecimals(MAX_DECIMALS)).toBe(MAX_DECIMALS);
-    });
-
-    test("refuses anything that is not a uint8", () => {
-        for (const bad of [
-            null,
-            undefined,
-            "",
-            "eighteen",
-            NaN,
-            6.5,
-            -1,
-            MAX_DECIMALS + 1,
-            true,
-            {},
-            [],
-        ]) {
-            expect(() => displayedDecimals(bad)).toThrow(
-                UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-            );
-        }
-    });
-});
-
-describe("transferAmountUnits", () => {
-    test("encodes with the displayed scale when the contract agrees", () => {
-        expect(transferAmountUnits("0.25", 6, 6n)).toBe(parseUnits("0.25", 6));
-        expect(transferAmountUnits("0.25", "6", 6n)).toBe(
-            parseUnits("0.25", 6),
-        );
-        expect(transferAmountUnits("1.5", 18, 18n)).toBe(parseUnits("1.5", 18));
-    });
-
-    // The reproduction on the issue: 0.25 of a token displayed at 6 decimals,
-    // signed against a contract answering 18, moves 10^12 times the amount
-    // that was approved.
-    test("refuses the reproduction rather than signing either amount", () => {
-        expect(() => transferAmountUnits("0.25", 6, 18n)).toThrow(
-            /contract reports 18 decimal places, but the amount was displayed using 6/,
-        );
-    });
-
-    test("refuses a disagreement in the other direction too", () => {
-        expect(() => transferAmountUnits("0.25", 18, 6n)).toThrow(
-            /contract reports 6 decimal places, but the amount was displayed using 18/,
-        );
-    });
-
-    test("never returns the amount at either scale on a disagreement", () => {
-        // The point of the refusal: both candidate encodings exist, and the
-        // wallet must produce neither.
-        let thrown = null;
-        try {
-            transferAmountUnits("0.25", 6, 18n);
-        } catch (e) {
-            thrown = e;
-        }
-        expect(thrown).toBeInstanceOf(Error);
-        expect(thrown.message).toMatch(/was not sent/);
-    });
-
-    test("refuses when the screen's scale is unknown", () => {
-        expect(() => transferAmountUnits("0.25", null, 6n)).toThrow(
-            UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-        );
-        expect(() => transferAmountUnits("0.25", undefined, 6n)).toThrow(
-            UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-        );
-    });
-
-    test("refuses when the contract's answer is not a uint8", () => {
-        for (const bad of [null, undefined, "", "eighteen", 6.5, -1, 256]) {
-            expect(() => transferAmountUnits("0.25", 6, bad)).toThrow(
-                UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-            );
-        }
-    });
-
-    test("rejects an amount finer than the token's scale", () => {
-        // parseUnits' own refusal, reached only once the scales agree: a
-        // fractional base unit cannot be sent and must not be truncated.
-        expect(() => transferAmountUnits("0.0000001", 6, 6n)).toThrow();
-    });
-
-    test("every refusal is a full sentence", () => {
-        const messages = [];
-        for (const args of [
-            ["0.25", 6, 18n],
-            ["0.25", null, 6n],
-            ["0.25", 6, "eighteen"],
-        ]) {
-            try {
-                transferAmountUnits(...args);
-            } catch (e) {
-                messages.push(e.message);
-            }
-        }
-        expect(messages).toHaveLength(3);
-        for (const m of messages) {
-            expect(m).toMatch(/^[A-Z]/);
-            expect(m).toMatch(/\.$/);
-        }
-    });
-});

tests/uniswap.test.js

@@ -1,4 +1,4 @@
-const { AbiCoder, Interface, solidityPacked } = require("ethers");
+const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 
 const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";

yarn.lock

@@ -427,90 +427,6 @@
   resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz#0eaf705c941a218a43dba8e09f1df1d6cd2f1f17"
   integrity sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==
 
-"@eslint-community/eslint-utils@^4.8.0":
-  version "4.10.1"
-  resolved "https://registry.yarnpkg.com/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz#8911bd72b2c3640a543609e0400b8c4d2e7e7cb6"
-  integrity sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==
-  dependencies:
-    eslint-visitor-keys "^3.4.3"
-
-"@eslint-community/regexpp@^4.12.2":
-  version "4.12.2"
-  resolved "https://registry.yarnpkg.com/@eslint-community/regexpp/-/regexpp-4.12.2.tgz#bccdf615bcf7b6e8db830ec0b8d21c9a25de597b"
-  integrity sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==
-
-"@eslint/config-array@^0.23.5":
-  version "0.23.5"
-  resolved "https://registry.yarnpkg.com/@eslint/config-array/-/config-array-0.23.5.tgz#56e86d243049195d8acc0c06a1b3dfdc3fa3de95"
-  integrity sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==
-  dependencies:
-    "@eslint/object-schema" "^3.0.5"
-    debug "^4.3.1"
-    minimatch "^10.2.4"
-
-"@eslint/config-helpers@^0.7.0":
-  version "0.7.0"
-  resolved "https://registry.yarnpkg.com/@eslint/config-helpers/-/config-helpers-0.7.0.tgz#09ee4aa07b73f059ec2d4c74bf4b2ff02b322377"
-  integrity sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==
-  dependencies:
-    "@eslint/core" "^1.2.1"
-
-"@eslint/core@^1.2.1":
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/@eslint/core/-/core-1.2.1.tgz#c1da7cd1b82fa8787f98b5629fb811848a1b63ce"
-  integrity sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==
-  dependencies:
-    "@types/json-schema" "^7.0.15"
-
-"@eslint/js@10.0.1":
-  version "10.0.1"
-  resolved "https://registry.yarnpkg.com/@eslint/js/-/js-10.0.1.tgz#1e8a876f50117af8ab67e47d5ad94d38d6622583"
-  integrity sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==
-
-"@eslint/object-schema@^3.0.5":
-  version "3.0.5"
-  resolved "https://registry.yarnpkg.com/@eslint/object-schema/-/object-schema-3.0.5.tgz#88e9bf4d11d2b19c082e78ebe7ce88724a5eb091"
-  integrity sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==
-
-"@eslint/plugin-kit@^0.7.2":
-  version "0.7.2"
-  resolved "https://registry.yarnpkg.com/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz#4b0962f3f2c7ce8bc98b3ecfe34525c09d2cb729"
-  integrity sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==
-  dependencies:
-    "@eslint/core" "^1.2.1"
-    levn "^0.4.1"
-
-"@humanfs/core@^0.19.2":
-  version "0.19.2"
-  resolved "https://registry.yarnpkg.com/@humanfs/core/-/core-0.19.2.tgz#a8272ca03b2acf492670222b2320b6c421bfde60"
-  integrity sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==
-  dependencies:
-    "@humanfs/types" "^0.15.0"
-
-"@humanfs/node@^0.16.6":
-  version "0.16.8"
-  resolved "https://registry.yarnpkg.com/@humanfs/node/-/node-0.16.8.tgz#8f800cccc13f4f8cd3116e2d9c0a94939da3e3ed"
-  integrity sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==
-  dependencies:
-    "@humanfs/core" "^0.19.2"
-    "@humanfs/types" "^0.15.0"
-    "@humanwhocodes/retry" "^0.4.0"
-
-"@humanfs/types@^0.15.0":
-  version "0.15.0"
-  resolved "https://registry.yarnpkg.com/@humanfs/types/-/types-0.15.0.tgz#f2a09f62012390b2bff3fc6fb248ddec8c09a090"
-  integrity sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==
-
-"@humanwhocodes/module-importer@^1.0.1":
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz#af5b2691a22b44be847b0ca81641c5fb6ad0172c"
-  integrity sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==
-
-"@humanwhocodes/retry@^0.4.0", "@humanwhocodes/retry@^0.4.2":
-  version "0.4.3"
-  resolved "https://registry.yarnpkg.com/@humanwhocodes/retry/-/retry-0.4.3.tgz#c2b9d2e374ee62c586d3adbea87199b1d7a7a6ba"
-  integrity sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==
-
 "@isaacs/cliui@^8.0.2":
   version "8.0.2"
   resolved "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz"
@@ -1092,16 +1008,6 @@
   dependencies:
     "@babel/types" "^7.28.2"
 
-"@types/esrecurse@^4.3.1":
-  version "4.3.1"
-  resolved "https://registry.yarnpkg.com/@types/esrecurse/-/esrecurse-4.3.1.tgz#6f636af962fbe6191b830bd676ba5986926bccec"
-  integrity sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==
-
-"@types/estree@^1.0.6", "@types/estree@^1.0.8":
-  version "1.0.9"
-  resolved "https://registry.yarnpkg.com/@types/estree/-/estree-1.0.9.tgz#cf3f0e876d7bee15a93ab925b82bf570a3904a24"
-  integrity sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==
-
 "@types/istanbul-lib-coverage@*", "@types/istanbul-lib-coverage@^2.0.1", "@types/istanbul-lib-coverage@^2.0.6":
   version "2.0.6"
   resolved "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz"
@@ -1121,11 +1027,6 @@
   dependencies:
     "@types/istanbul-lib-report" "*"
 
-"@types/json-schema@^7.0.15":
-  version "7.0.15"
-  resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.15.tgz#596a1747233694d50f6ad8a7869fcb6f56cf5841"
-  integrity sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==
-
 "@types/node@*", "@types/node@22.7.5":
   version "22.7.5"
   resolved "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz"
@@ -1252,31 +1153,11 @@
   resolved "https://registry.yarnpkg.com/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz#538b1e103bf8d9864e7b85cc96fa8d6fb6c40777"
   integrity sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==
 
-acorn-jsx@^5.3.2:
-  version "5.3.2"
-  resolved "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz#7ed5bb55908b3b2f1bc55c6af1653bada7f07937"
-  integrity sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==
-
-acorn@^8.16.0:
-  version "8.18.0"
-  resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.18.0.tgz#4faf01b2d6d326bfeed97aea1f52220b5f4c1940"
-  integrity sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==
-
 aes-js@4.0.0-beta.5:
   version "4.0.0-beta.5"
   resolved "https://registry.npmjs.org/aes-js/-/aes-js-4.0.0-beta.5.tgz"
   integrity sha512-G965FqalsNyrPqgEGON7nIx1e/OVENSgiEIzyC63haUMuvNnwIgIjMs52hlTCKhkBny7A2ORNlfY9Zu+jmGk1Q==
 
-ajv@^6.14.0:
-  version "6.15.0"
-  resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.15.0.tgz#07e982c74626167aa7a2495c53817892d7139492"
-  integrity sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==
-  dependencies:
-    fast-deep-equal "^3.1.1"
-    fast-json-stable-stringify "^2.0.0"
-    json-schema-traverse "^0.4.1"
-    uri-js "^4.2.2"
-
 ansi-escapes@^4.3.2:
   version "4.3.2"
   resolved "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz"
@@ -1416,13 +1297,6 @@ brace-expansion@^5.0.2:
   dependencies:
     balanced-match "^4.0.2"
 
-brace-expansion@^5.0.8:
-  version "5.0.9"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf"
-  integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==
-  dependencies:
-    balanced-match "^4.0.2"
-
 braces@^3.0.3:
   version "3.0.3"
   resolved "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz"
@@ -1555,7 +1429,7 @@ cross-spawn@^7.0.3, cross-spawn@^7.0.6:
     shebang-command "^2.0.0"
     which "^2.0.1"
 
-debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2:
+debug@^4.1.0, debug@^4.1.1, debug@^4.3.1:
   version "4.4.3"
   resolved "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz"
   integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==
@@ -1572,11 +1446,6 @@ dedent@^1.6.0:
   resolved "https://registry.npmjs.org/dedent/-/dedent-1.7.1.tgz"
   integrity sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==
 
-deep-is@^0.1.3:
-  version "0.1.4"
-  resolved "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz#a6f2dce612fadd2ef1f519b73551f17e85199831"
-  integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==
-
 deepmerge@^4.3.1:
   version "4.3.1"
   resolved "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz"
@@ -1679,105 +1548,11 @@ escape-string-regexp@^2.0.0:
   resolved "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz"
   integrity sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==
 
-escape-string-regexp@^4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz#14ba83a5d373e3d311e5afca29cf5bfad965bf34"
-  integrity sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==
-
-eslint-scope@^9.1.2:
-  version "9.1.2"
-  resolved "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-9.1.2.tgz#b9de6ace2fab1cff24d2e58d85b74c8fcea39802"
-  integrity sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==
-  dependencies:
-    "@types/esrecurse" "^4.3.1"
-    "@types/estree" "^1.0.8"
-    esrecurse "^4.3.0"
-    estraverse "^5.2.0"
-
-eslint-visitor-keys@^3.4.3:
-  version "3.4.3"
-  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz#0cd72fe8550e3c2eae156a96a4dddcd1c8ac5800"
-  integrity sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==
-
-eslint-visitor-keys@^5.0.1:
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz#9e3c9489697824d2d4ce3a8ad12628f91e9f59be"
-  integrity sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==
-
-eslint@10.8.1:
-  version "10.8.1"
-  resolved "https://registry.yarnpkg.com/eslint/-/eslint-10.8.1.tgz#fb37d514c19b6dd5b2d6b70169fd26fddfa97967"
-  integrity sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==
-  dependencies:
-    "@eslint-community/eslint-utils" "^4.8.0"
-    "@eslint-community/regexpp" "^4.12.2"
-    "@eslint/config-array" "^0.23.5"
-    "@eslint/config-helpers" "^0.7.0"
-    "@eslint/core" "^1.2.1"
-    "@eslint/plugin-kit" "^0.7.2"
-    "@humanfs/node" "^0.16.6"
-    "@humanwhocodes/module-importer" "^1.0.1"
-    "@humanwhocodes/retry" "^0.4.2"
-    "@types/estree" "^1.0.6"
-    ajv "^6.14.0"
-    cross-spawn "^7.0.6"
-    debug "^4.3.2"
-    escape-string-regexp "^4.0.0"
-    eslint-scope "^9.1.2"
-    eslint-visitor-keys "^5.0.1"
-    espree "^11.2.0"
-    esquery "^1.7.0"
-    esutils "^2.0.2"
-    fast-deep-equal "^3.1.3"
-    file-entry-cache "^8.0.0"
-    find-up "^5.0.0"
-    glob-parent "^6.0.2"
-    ignore "^5.2.0"
-    imurmurhash "^0.1.4"
-    is-glob "^4.0.0"
-    json-stable-stringify-without-jsonify "^1.0.1"
-    minimatch "^10.2.5"
-    natural-compare "^1.4.0"
-    optionator "^0.9.3"
-
-espree@^11.2.0:
-  version "11.2.0"
-  resolved "https://registry.yarnpkg.com/espree/-/espree-11.2.0.tgz#01d5e47dc332aaba3059008362454a8cc34ccaa5"
-  integrity sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==
-  dependencies:
-    acorn "^8.16.0"
-    acorn-jsx "^5.3.2"
-    eslint-visitor-keys "^5.0.1"
-
 esprima@^4.0.0:
   version "4.0.1"
   resolved "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz"
   integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
 
-esquery@^1.7.0:
-  version "1.7.0"
-  resolved "https://registry.yarnpkg.com/esquery/-/esquery-1.7.0.tgz#08d048f261f0ddedb5bae95f46809463d9c9496d"
-  integrity sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==
-  dependencies:
-    estraverse "^5.1.0"
-
-esrecurse@^4.3.0:
-  version "4.3.0"
-  resolved "https://registry.yarnpkg.com/esrecurse/-/esrecurse-4.3.0.tgz#7ad7964d679abb28bee72cec63758b1c5d2c9921"
-  integrity sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==
-  dependencies:
-    estraverse "^5.2.0"
-
-estraverse@^5.1.0, estraverse@^5.2.0:
-  version "5.3.0"
-  resolved "https://registry.yarnpkg.com/estraverse/-/estraverse-5.3.0.tgz#2eea5290702f26ab8fe5370370ff86c965d21123"
-  integrity sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==
-
-esutils@^2.0.2:
-  version "2.0.3"
-  resolved "https://registry.yarnpkg.com/esutils/-/esutils-2.0.3.tgz#74d2eb4de0b8da1293711910d50775b9b710ef64"
-  integrity sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==
-
 ethereum-blockies-base64@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmjs.org/ethereum-blockies-base64/-/ethereum-blockies-base64-1.0.2.tgz"
@@ -1830,21 +1605,11 @@ expect@30.2.0:
     jest-mock "30.2.0"
     jest-util "30.2.0"
 
-fast-deep-equal@^3.1.1, fast-deep-equal@^3.1.3:
-  version "3.1.3"
-  resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
-  integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
-
-fast-json-stable-stringify@^2.0.0, fast-json-stable-stringify@^2.1.0:
+fast-json-stable-stringify@^2.1.0:
   version "2.1.0"
   resolved "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz"
   integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
 
-fast-levenshtein@^2.0.6:
-  version "2.0.6"
-  resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
-  integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
-
 fb-watchman@^2.0.2:
   version "2.0.2"
   resolved "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz"
@@ -1852,13 +1617,6 @@ fb-watchman@^2.0.2:
   dependencies:
     bser "2.1.1"
 
-file-entry-cache@^8.0.0:
-  version "8.0.0"
-  resolved "https://registry.yarnpkg.com/file-entry-cache/-/file-entry-cache-8.0.0.tgz#7787bddcf1131bffb92636c69457bbc0edd6d81f"
-  integrity sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==
-  dependencies:
-    flat-cache "^4.0.0"
-
 fill-range@^7.1.1:
   version "7.1.1"
   resolved "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz"
@@ -1874,27 +1632,6 @@ find-up@^4.0.0, find-up@^4.1.0:
     locate-path "^5.0.0"
     path-exists "^4.0.0"
 
-find-up@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/find-up/-/find-up-5.0.0.tgz#4c92819ecb7083561e4f4a240a86be5198f536fc"
-  integrity sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==
-  dependencies:
-    locate-path "^6.0.0"
-    path-exists "^4.0.0"
-
-flat-cache@^4.0.0:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/flat-cache/-/flat-cache-4.0.1.tgz#0ece39fcb14ee012f4b0410bd33dd9c1f011127c"
-  integrity sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==
-  dependencies:
-    flatted "^3.2.9"
-    keyv "^4.5.4"
-
-flatted@^3.2.9:
-  version "3.4.4"
-  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.4.tgz#aeeca2a506303f0cee61c59e6c9f2a88d2f29fc6"
-  integrity sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==
-
 foreground-child@^3.1.0:
   version "3.3.1"
   resolved "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz"
@@ -1933,13 +1670,6 @@ get-stream@^6.0.0:
   resolved "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz"
   integrity sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==
 
-glob-parent@^6.0.2:
-  version "6.0.2"
-  resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-6.0.2.tgz#6d237d99083950c79290f24c7642a3de9a28f9e3"
-  integrity sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==
-  dependencies:
-    is-glob "^4.0.3"
-
 glob@^10.3.10:
   version "10.5.0"
   resolved "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz"
@@ -1964,11 +1694,6 @@ glob@^7.1.4:
     once "^1.3.0"
     path-is-absolute "^1.0.0"
 
-globals@17.11.0:
-  version "17.11.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.11.0.tgz#d643485bb30220d7751e511cf4f68c73d3870d87"
-  integrity sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==
-
 graceful-fs@^4.2.11, graceful-fs@^4.2.4:
   version "4.2.11"
   resolved "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz"
@@ -1989,11 +1714,6 @@ human-signals@^2.1.0:
   resolved "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz"
   integrity sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==
 
-ignore@^5.2.0:
-  version "5.3.2"
-  resolved "https://registry.yarnpkg.com/ignore/-/ignore-5.3.2.tgz#3cd40e729f3643fd87cb04e50bf0eb722bc596f5"
-  integrity sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==
-
 import-local@^3.2.0:
   version "3.2.0"
   resolved "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz"
@@ -2040,7 +1760,7 @@ is-generator-fn@^2.1.0:
   resolved "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz"
   integrity sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==
 
-is-glob@^4.0.0, is-glob@^4.0.3:
+is-glob@^4.0.3:
   version "4.0.3"
   resolved "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz"
   integrity sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==
@@ -2492,51 +2212,21 @@ jsesc@^3.0.2:
   resolved "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz"
   integrity sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==
 
-json-buffer@3.0.1:
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/json-buffer/-/json-buffer-3.0.1.tgz#9338802a30d3b6605fbe0613e094008ca8c05a13"
-  integrity sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==
-
 json-parse-even-better-errors@^2.3.0:
   version "2.3.1"
   resolved "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz"
   integrity sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==
 
-json-schema-traverse@^0.4.1:
-  version "0.4.1"
-  resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz#69f6a87d9513ab8bb8fe63bdb0979c448e684660"
-  integrity sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==
-
-json-stable-stringify-without-jsonify@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz#9db7b59496ad3f3cfef30a75142d2d930ad72651"
-  integrity sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==
-
 json5@^2.2.3:
   version "2.2.3"
   resolved "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz"
   integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
 
-keyv@^4.5.4:
-  version "4.5.4"
-  resolved "https://registry.yarnpkg.com/keyv/-/keyv-4.5.4.tgz#a879a99e29452f942439f2a405e3af8b31d4de93"
-  integrity sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==
-  dependencies:
-    json-buffer "3.0.1"
-
 leven@^3.1.0:
   version "3.1.0"
   resolved "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz"
   integrity sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==
 
-levn@^0.4.1:
-  version "0.4.1"
-  resolved "https://registry.yarnpkg.com/levn/-/levn-0.4.1.tgz#ae4562c007473b932a6200d403268dd2fffc6ade"
-  integrity sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==
-  dependencies:
-    prelude-ls "^1.2.1"
-    type-check "~0.4.0"
-
 libsodium-sumo@^0.8.0:
   version "0.8.2"
   resolved "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.8.2.tgz"
@@ -2635,13 +2325,6 @@ locate-path@^5.0.0:
   dependencies:
     p-locate "^4.1.0"
 
-locate-path@^6.0.0:
-  version "6.0.0"
-  resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-6.0.0.tgz#55321eb309febbc59c4801d931a72452a681d286"
-  integrity sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==
-  dependencies:
-    p-locate "^5.0.0"
-
 lru-cache@^10.2.0:
   version "10.4.3"
   resolved "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz"
@@ -2693,13 +2376,6 @@ mimic-fn@^2.1.0:
   resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz"
   integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
 
-minimatch@^10.2.4, minimatch@^10.2.5:
-  version "10.2.6"
-  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.6.tgz#fd956bbe0b77241e9f15ac5dccb1c638060968ef"
-  integrity sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==
-  dependencies:
-    brace-expansion "^5.0.8"
-
 minimatch@^3.0.4, minimatch@^3.1.1:
   version "3.1.3"
   resolved "https://registry.npmjs.org/minimatch/-/minimatch-3.1.3.tgz"
@@ -2780,18 +2456,6 @@ onetime@^5.1.2:
   dependencies:
     mimic-fn "^2.1.0"
 
-optionator@^0.9.3:
-  version "0.9.4"
-  resolved "https://registry.yarnpkg.com/optionator/-/optionator-0.9.4.tgz#7ea1c1a5d91d764fb282139c88fe11e182a3a734"
-  integrity sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==
-  dependencies:
-    deep-is "^0.1.3"
-    fast-levenshtein "^2.0.6"
-    levn "^0.4.1"
-    prelude-ls "^1.2.1"
-    type-check "^0.4.0"
-    word-wrap "^1.2.5"
-
 p-limit@^2.2.0:
   version "2.3.0"
   resolved "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz"
@@ -2799,7 +2463,7 @@ p-limit@^2.2.0:
   dependencies:
     p-try "^2.0.0"
 
-p-limit@^3.0.2, p-limit@^3.1.0:
+p-limit@^3.1.0:
   version "3.1.0"
   resolved "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz"
   integrity sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==
@@ -2813,13 +2477,6 @@ p-locate@^4.1.0:
   dependencies:
     p-limit "^2.2.0"
 
-p-locate@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-5.0.0.tgz#83c8315c6785005e3bd021839411c9e110e6d834"
-  integrity sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==
-  dependencies:
-    p-limit "^3.0.2"
-
 p-try@^2.0.0:
   version "2.2.0"
   resolved "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz"
@@ -2905,11 +2562,6 @@ pnglib@0.0.1:
   resolved "https://registry.npmjs.org/pnglib/-/pnglib-0.0.1.tgz"
   integrity sha512-95ChzOoYLOPIyVmL+Y6X+abKGXUJlvOVLkB1QQkyXl7Uczc6FElUy/x01NS7r2GX6GRezloO/ecCX9h4U9KadA==
 
-prelude-ls@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
-  integrity sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==
-
 prettier@^3.8.1:
   version "3.8.1"
   resolved "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz"
@@ -2924,11 +2576,6 @@ pretty-format@30.2.0:
     ansi-styles "^5.2.0"
     react-is "^18.3.1"
 
-punycode@^2.1.0:
-  version "2.3.1"
-  resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
-  integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
-
 pure-rand@^7.0.0:
   version "7.0.1"
   resolved "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz"
@@ -3175,13 +2822,6 @@ tslib@^2.8.1:
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.8.1.tgz#612efe4ed235d567e8aba5f2a5fab70280ade83f"
   integrity sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==
 
-type-check@^0.4.0, type-check@~0.4.0:
-  version "0.4.0"
-  resolved "https://registry.yarnpkg.com/type-check/-/type-check-0.4.0.tgz#07b8203bfa7056c0657050e3ccd2c37730bab8f1"
-  integrity sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==
-  dependencies:
-    prelude-ls "^1.2.1"
-
 type-detect@4.0.8:
   version "4.0.8"
   resolved "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz"
@@ -3232,13 +2872,6 @@ update-browserslist-db@^1.2.0:
     escalade "^3.2.0"
     picocolors "^1.1.1"
 
-uri-js@^4.2.2:
-  version "4.4.1"
-  resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
-  integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==
-  dependencies:
-    punycode "^2.1.0"
-
 v8-to-istanbul@^9.0.1:
   version "9.3.0"
   resolved "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz"
@@ -3267,11 +2900,6 @@ which@^2.0.1:
   dependencies:
     isexe "^2.0.0"
 
-word-wrap@^1.2.5:
-  version "1.2.5"
-  resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.5.tgz#d2c45c6dd4fbce621a66f136cbe328afd0410b34"
-  integrity sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==
-
 "wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
   version "7.0.0"
   resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz"