fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

README.md

@@ -422,12 +422,11 @@ captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
 stored network unchanged and send no `chainChanged` until it is approved, a
-network switch in Settings is required to send the page `chainChanged` with the
-new chain id, a prompt raised while another approval window has focus is
-required to open a window of its own, and the password is required to be absent
-from every message the approval window sends to the background — with the
-message that would carry it required to be present, so that check cannot pass by
-observing nothing. That last one is the standing floor under
+prompt raised while another approval window has focus is required to open a
+window of its own, and the password is required to be absent from every message
+the approval window sends to the background — with the message that would carry
+it required to be present, so that check cannot pass by observing nothing. That
+last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -1786,12 +1785,10 @@ view would leave a wallet one click from deletion.
       plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
       Timestamps" checkbox, and a Theme selector (System / Light / Dark)
-    - Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
+    - Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
+      resets the RPC and Blockscout endpoints to that network's defaults. The
       network changes only here, or when the user approves a site's request on
-      **NetworkApproval**; either way, switching restores the RPC and Blockscout
-      endpoints last used on that network, or that network's defaults if it has
-      none, and sends `chainChanged` with the new chain id to every open tab.
-      Choosing the network already active changes nothing and sends nothing
+      **NetworkApproval**
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2124,12 +2121,7 @@ view would leave a wallet one click from deletion.
       blocklist)
     - Site origin (bold, scheme and port included) + "wants you to sign a
       message"
-    - Warning box, shown for `eth_sign`: "This site used the older eth_sign
-      method. The data will be signed as a personal message." An `eth_sign`
-      request names the address first and the data second. Its data is signed
-      exactly as a `personal_sign` message is, as an EIP-191 personal message,
-      which is what the Ethereum JSON-RPC specification defines `eth_sign` to
-      return.
+    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
     - Type: "Personal message" or "Typed data (EIP-712)"
     - From: color dot + full address + etherscan link
     - Message: for `personal_sign` and `eth_sign`, the text the message's bytes
@@ -2205,9 +2197,8 @@ view would leave a wallet one click from deletion.
     - "Switch" / "Reject" buttons
 - **Transitions**:
     - "Switch" → closes popup; the background switches the network as
-      **Settings** does, restoring the RPC and Blockscout endpoints last used on
-      that network (or that network's defaults if it has none), sends
-      `chainChanged` to every open tab, and answers the site with success
+      **Settings** does, sends `chainChanged` to every open tab, and answers the
+      site with success
     - "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
       nothing changes
     - Popup window closed without answering → the same as "Reject"

TODO.md

@@ -2,9 +2,10 @@
 
 - `git pull` `next` and cut a branch from it — one branch per issue, named
   `issue-<N>-<slug>`. Never branch from `main`.
-- Do the work as one commit whose title ends with ` (closes #N)`.
-- Add no entry to Completed Steps. What landed is recorded on the tracker and in
-  `git log`, where each commit title names the issue it closes.
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
+  `TODO.md` update in that same commit.
+- Move Next Step to the top of Completed Steps; move the top item of Future
+  Steps into Next Step.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
   `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on
@@ -43,25 +44,6 @@ then continue tagging as milestones land.
 
 # Completed Steps
 
-- 2026-10-08: The browser suites no longer read a screen before the page has
-  shown it ([#502](https://git.eeqj.de/sneak/AutistMask/issues/502)). Their wait
-  for a screen used to pass as soon as the element laid out, which every view
-  does until the page's stylesheet has applied, so an approval test could read
-  the prompt's fields before the page's script had filled them. `visible()` in
-  `tests/e2e/harness.js` and `waitVisible()` in `tests/e2e/firefox/driver.js`
-  now also wait for the page to finish loading and for neither the element nor
-  anything around it to carry the `hidden` class that `showView()` puts on every
-  view but the current one. No caller changed.
-
-- 2026-10-08: Switching the network in Settings now tells open pages
-  ([#500](https://git.eeqj.de/sneak/AutistMask/issues/500)). Once the switch is
-  saved, Settings asks the background to send `chainChanged` with the new chain
-  id to every open tab, through the same function an approved site request uses.
-  Choosing the network already active changes nothing and sends nothing. Only
-  the extension's own pages can ask for this. `tests/chainSwitchGate.test.js`
-  drives the real Settings view against the background, and the Chrome suite
-  checks that the test page hears both switches.
-
 - 2026-10-07: A site can no longer switch the wallet's network by itself
   ([#408](https://git.eeqj.de/sneak/AutistMask/issues/408)). A connected site's
   `wallet_switchEthereumChain` request for the other supported network opens a

src/background/index.js

@@ -984,8 +984,9 @@ async function handleRpc(method, params, origin) {
 
         if (method === "eth_sign") {
             signParams.dangerWarning =
-                "This site used the older eth_sign method. " +
-                "The data will be signed as a personal message.";
+                "\u26a0\ufe0f DANGER: This site is requesting to sign a raw hash. " +
+                "This can be used to sign transactions that drain your funds. " +
+                "Only proceed if you fully understand what you are signing.";
         }
 
         if (findPendingApproval(origin, "sign")) {
@@ -1470,7 +1471,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         "AUTISTMASK_ADDRESSES_REMOVED",
         "AUTISTMASK_GET_CONNECTED_SITES",
         "AUTISTMASK_REMOVE_SITE",
-        "AUTISTMASK_NETWORK_CHANGED",
     ];
     if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
         sendResponse({ error: "Unauthorized sender" });
@@ -1854,13 +1854,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         broadcastSiteRemoved(msg.origin);
         return false;
     }
-
-    // Settings switched the network and has saved it. Open tabs are told the
-    // new chain id the same way as after a site's approved switch request.
-    if (msg.type === "AUTISTMASK_NETWORK_CHANGED") {
-        broadcastChainChanged(msg.chainId);
-        return false;
-    }
 });
 
 module.exports = { PROXY_METHODS };

src/popup/index.html

@@ -7,10 +7,9 @@
         <link rel="stylesheet" href="styles.css" />
     </head>
     <!-- Chrome gives extension pages a stylesheet of its own that sets the
-         font and its size on body, and a Tailwind class beats it only when
-         marked important: hence font-mono! and text-sm! rather than
-         font-mono and text-sm. -->
-    <body class="bg-bg text-fg font-mono! text-sm!">
+         font on body, and a Tailwind class beats it only when marked
+         important: hence font-mono! rather than font-mono. -->
+    <body class="bg-bg text-fg font-mono! text-sm">
         <div id="app" class="p-2 pr-5 overflow-x-hidden">
             <!-- ============ GLOBAL TITLE BAR ============ -->
             <div
@@ -88,14 +87,11 @@
 
                 <!-- Mnemonic form section -->
                 <div id="add-wallet-section-mnemonic">
-                    <!-- The die button shares the instruction's row: on a row
-                         of its own it pushes Import below the fold at
-                         360x600. -->
-                    <div class="mb-2 flex justify-between items-start gap-2">
-                        <p>
-                            Enter your 12 or 24 word recovery phrase below, or
-                            click the button to roll the die for a new one.
-                        </p>
+                    <p class="mb-2">
+                        Enter your 12 or 24 word recovery phrase below, or click
+                        the button to roll the die for a new one.
+                    </p>
+                    <div class="mb-1 flex justify-end">
                         <button
                             id="btn-generate-phrase"
                             class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"

src/popup/views/approval.js

@@ -721,7 +721,7 @@ function showSignApproval(details) {
             "This message is plain text, not hex, so it cannot be signed.";
     }
 
-    // The warning the background attaches to an eth_sign request.
+    // Display danger warning for eth_sign (raw hash signing)
     const warningEl = $("approve-sign-danger-warning");
     if (warningEl) {
         if (sp.dangerWarning) {

src/popup/views/settings.js

@@ -316,11 +316,7 @@ function init(ctx) {
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
         const newId = networkSelect.value;
-        if (newId === state.networkId) return;
         const net = await onChainSwitch(newId);
-        // Open pages are told by the background, as after a site's approved
-        // switch request.
-        notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
         showFlash("Switched to " + net.name + ".");

tests/backgroundApproval.test.js

@@ -1551,53 +1551,6 @@ describe("what the approval is verified against", () => {
     });
 });
 
-// eth_sign names the address first and the data second, the reverse of
-// personal_sign, and is answered as the JSON-RPC specification defines it:
-// with an EIP-191 personal message signature over the data, the same
-// signature personal_sign returns
-// (https://git.eeqj.de/sneak/AutistMask/issues/409).
-describe("eth_sign", () => {
-    test("is read address first, and returns a personal message signature over the data", async () => {
-        const bg = loadBackground();
-        const page = bg.send(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "eth_sign",
-                params: [signer.address, MESSAGE],
-            },
-            { origin: ORIGIN },
-        );
-        await settle();
-        const id = approvalIdIn(bg.created.map((c) => c.url));
-
-        const details = bg.send(
-            { type: "AUTISTMASK_GET_APPROVAL", id },
-            { url: bg.fromPopup.url },
-        );
-        const { signParams } = details.sendResponse.mock.calls[0][0];
-        expect(signParams).toMatchObject({
-            method: "eth_sign",
-            message: MESSAGE,
-            from: signer.address,
-        });
-        expect(signParams.dangerWarning).toBe(
-            "This site used the older eth_sign method. " +
-                "The data will be signed as a personal message.",
-        );
-
-        const signature = await signer.signMessage(
-            Buffer.from(MESSAGE.slice(2), "hex"),
-        );
-        bg.send(
-            { type: "AUTISTMASK_SIGN_RESPONSE", id, approved: true, signature },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-
-        expect(page.sendResponse).toHaveBeenCalledWith({ result: signature });
-    });
-});
-
 // The interlock must not cost the retry the approval exists to allow.
 describe("the interlock releases a failed attempt", () => {
     test("a retryable failure before the broadcast leaves the approval usable", async () => {

tests/chainSwitchGate.test.js

@@ -16,9 +16,7 @@
 //
 // The endpoint half of #308 lives in tests/networkEndpoints.test.js, which
 // covers the popup's chain switch; this file covers the background's, which
-// goes through storage rather than the shared state singleton. The last block
-// covers what the background tells open tabs when the user switches the
-// network in Settings.
+// goes through storage rather than the shared state singleton.
 
 const { networkById } = require("../src/shared/networks");
 const { makeStorageStub } = require("./support/storageStub");
@@ -227,14 +225,6 @@ function loadBackground() {
         answerPrompt,
         closePrompt,
         opened,
-        // A message to the background from `sender`, and its answer.
-        send: (msg, sender) => {
-            let reply = null;
-            messageListener(msg, sender, (r) => {
-                reply = r;
-            });
-            return reply;
-        },
         walletState: () => storage.read("autistmask"),
         chainChangedEvents: () =>
             toTabs.filter((m) => m.eventName === "chainChanged"),
@@ -400,109 +390,3 @@ describe("only the user switches the network", () => {
         expect(bg.walletState().rpcUrl).toBe(CUSTOM_RPC);
     });
 });
-
-// Switching the network in Settings tells open pages, as an approved site
-// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). These drive
-// the real Settings view over the background's storage, with what it sends
-// delivered to the background from the extension's own page.
-describe("switching the network in Settings tells every open tab", () => {
-    const POPUP = { url: EXT_URL + "src/popup/index.html" };
-
-    // A stand-in for one DOM node: enough of an element for init() to set
-    // properties on it and hang listeners off it.
-    function fakeElement() {
-        return {
-            value: "",
-            checked: false,
-            textContent: "",
-            style: {},
-            dataset: {},
-            classList: { add() {}, remove() {} },
-            listeners: {},
-            addEventListener(event, handler) {
-                this.listeners[event] = handler;
-            },
-            querySelectorAll: () => [],
-        };
-    }
-
-    // Settings, opened the way the popup opens it. Returns its network
-    // selector.
-    async function openSettings(bg) {
-        const elements = {};
-        const element = (id) => (elements[id] ||= fakeElement());
-        jest.doMock("../src/popup/views/helpers", () => ({
-            $: element,
-            showView: () => {},
-            updateDebugBanner: () => {},
-            showFlash: () => {},
-            escapeHtml: (s) => s,
-            flashCopyFeedback: () => {},
-            goBack: () => {},
-            pushCurrentView: () => {},
-            onViewLeave: () => {},
-            VIEWS: [],
-        }));
-        global.chrome.runtime.sendMessage = (msg) => {
-            bg.send(msg, POPUP);
-        };
-        await require("../src/shared/state").loadState();
-        require("../src/popup/views/settings").init({
-            pageClosed: new AbortController().signal,
-        });
-        const select = element("settings-network");
-        select.value = "mainnet";
-        return select;
-    }
-
-    // The user picks `networkId` in the selector.
-    async function choose(select, networkId) {
-        select.value = networkId;
-        await select.listeners.change();
-        await settle();
-    }
-
-    afterEach(() => {
-        jest.dontMock("../src/popup/views/helpers");
-    });
-
-    test("switching to the other network sends chainChanged once, with its chain id", async () => {
-        const bg = loadBackground();
-        const select = await openSettings(bg);
-
-        await choose(select, "sepolia");
-
-        expect(bg.walletState().networkId).toBe("sepolia");
-        expect(bg.chainChangedEvents()).toEqual([
-            {
-                type: "AUTISTMASK_EVENT",
-                eventName: "chainChanged",
-                data: SEPOLIA.chainId,
-            },
-        ]);
-    });
-
-    test("choosing the network already active changes nothing and sends nothing", async () => {
-        const bg = loadBackground();
-        const select = await openSettings(bg);
-        const before = bg.walletState();
-
-        await choose(select, "mainnet");
-
-        expect(bg.walletState()).toEqual(before);
-        expect(bg.chainChangedEvents()).toEqual([]);
-    });
-
-    test("a page cannot make the background send chainChanged", async () => {
-        const bg = loadBackground();
-
-        const reply = bg.send(
-            { type: "AUTISTMASK_NETWORK_CHANGED", chainId: SEPOLIA.chainId },
-            { url: CONNECTED_ORIGIN + "/" },
-        );
-        await settle();
-
-        expect(reply).toEqual({ error: "Unauthorized sender" });
-        expect(bg.chainChangedEvents()).toEqual([]);
-    });
-});

tests/e2e/firefox/driver.js

@@ -279,18 +279,12 @@ class Driver {
 
     // Shown means shown: in the popup a view is switched by toggling a
     // "hidden" class, and an element that is present but collapsed is not
-    // the thing a test means by visible. Until the page's stylesheet has
-    // applied that class hides nothing and every view lays out, so the page
-    // must also have finished loading, which it does only after its
-    // stylesheet, and neither the element nor anything enclosing it may
-    // carry the class (https://git.eeqj.de/sneak/AutistMask/issues/502).
+    // the thing a test means by visible.
     async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
         return this.waitFor(
             "selector " + selector + " to be visible",
             `const el = document.querySelector(arguments[0]);
-             if (document.readyState !== "complete" || !el) return false;
-             if (el.closest(".hidden")) return false;
-             if (getComputedStyle(el).visibility !== "visible") return false;
+             if (!el) return false;
              const r = el.getBoundingClientRect();
              return r.width > 0 && r.height > 0;`,
             [selector],

tests/e2e/firefox/run.js

@@ -128,18 +128,6 @@ step("the popup is drawn in the monospace font it declares", async (env) => {
     );
 });
 
-// The same check as the Chrome suite's (#456), so both browsers are held to
-// the same size.
-step("the popup's text is drawn at the 14px text-sm declares", async (env) => {
-    const size = await env.driver.execute(
-        "return getComputedStyle(document.body).fontSize;",
-    );
-    assert(
-        size === "14px",
-        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
-    );
-});
-
 // The recovery screen (#361): the Chrome suite's four cases, run before any
 // wallet exists for the same reason. With no wallet nothing saves on a timer,
 // so no save can write a good record over the unreadable one. The last of them

tests/e2e/harness.js

@@ -333,33 +333,8 @@ async function launch(routeOpts) {
 
 const PASSWORD = "e2e-harness-password";
 
-// Waits until the page shows `selector`, not only until it lays out. Until the
-// page's stylesheet has applied, the `hidden` class that showView() keeps on
-// every view but the current one hides nothing and every view lays out, so a
-// test could read a screen before the page's script had filled it
-// (https://git.eeqj.de/sneak/AutistMask/issues/502). So the page must also
-// have finished loading, which it does only after its stylesheet, and neither
-// the element nor anything enclosing it may carry `hidden`. Polled on a timer:
-// animation frames are not guaranteed to a window that is not in front.
 async function visible(page, selector, timeout = 15000) {
-    await page
-        .waitForFunction(
-            (sel) => {
-                const el = document.querySelector(sel);
-                if (document.readyState !== "complete" || !el) return false;
-                if (el.closest(".hidden")) return false;
-                if (getComputedStyle(el).visibility !== "visible") return false;
-                const r = el.getBoundingClientRect();
-                return r.width > 0 && r.height > 0;
-            },
-            selector,
-            { polling: 50, timeout },
-        )
-        .catch((e) => {
-            throw new Error(
-                "the page did not show " + selector + ": " + e.message,
-            );
-        });
+    await page.waitForSelector(selector, { state: "visible", timeout });
 }
 
 // An empty WebAssembly module: magic number and version header, no

tests/e2e/run.js

@@ -113,18 +113,6 @@ test("the popup is drawn in the monospace font it declares (#418)", async (env)
     );
 });
 
-// The same stylesheet sets the size on body to 75%, which would draw the
-// popup at 12px.
-test("the popup's text is drawn at the 14px text-sm declares (#456)", async (env) => {
-    const size = await env.page.evaluate(
-        () => getComputedStyle(document.body).fontSize,
-    );
-    assert(
-        size === "14px",
-        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
-    );
-});
-
 // The empirical half of #182. The manifest change is only a claim about
 // what the CSP permits; this is the observation. Two things have to hold
 // together, and the run covers both: the popup realm compiles WASM (here),
@@ -4550,42 +4538,6 @@ test("a site's network switch changes nothing until the user approves it (#408)"
     );
 });
 
-// Switching the network in Settings tells the page too, as an approved site
-// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). The wallet
-// goes back to mainnet the same way at the end.
-test("a network switch in Settings tells the page (#500)", async (env) => {
-    const { mainnet, sepolia } = NETWORKS;
-    const before = await storedNetwork(env.page);
-    assert(
-        before.networkId === "mainnet",
-        "this test starts on mainnet, not on " + before.networkId,
-    );
-    const eventsBefore = (await chainChangedEvents(env.dapp)).length;
-    await openSettings(env.page);
-
-    await env.page.selectOption("#settings-network", "sepolia");
-    let events = await chainChangedEvents(env.dapp, eventsBefore + 1);
-    assert(
-        events.length === eventsBefore + 1 &&
-            events[events.length - 1].data === sepolia.chainId,
-        "the page was not told of the switch to Sepolia: " +
-            JSON.stringify(events),
-    );
-
-    await env.page.selectOption("#settings-network", "mainnet");
-    events = await chainChangedEvents(env.dapp, eventsBefore + 2);
-    assert(
-        events.length === eventsBefore + 2 &&
-            events[events.length - 1].data === mainnet.chainId,
-        "the page was not told of the switch back to mainnet: " +
-            JSON.stringify(events),
-    );
-    assert(
-        isDeepStrictEqual(await storedNetwork(env.page), before),
-        "switching back did not restore the mainnet network and endpoints",
-    );
-});
-
 // The closing pass over both boundaries at once. Every message the section
 // put on either channel is re-read here and required to be free of the
 // password — and required to be there at all, method by method, so the