fix: a slow answer to an approval still reaches the site (closes #540 )

Chrome stopped the background worker about six minutes after a site's request even with the approval window open, and the approval and the site's waiting request went with it. The approval window now posts an empty message on its approval port every 20 seconds while it is open; each one is an event, which keeps the worker running. tests/e2e/slowApproval.js, run by make test-e2e, leaves a transaction and a signature approval open for seven minutes and requires the site to receive both results. It drives Chromium over the DevTools pipe without Playwright, because Playwright keeps DevTools attached to the worker and Chrome then never stops it. Model: opus-5-5
2026-10-14 10:08:11 +00:00
15 changed files with 584 additions and 2495 deletions
@@ -35,10 +35,10 @@ on: [push]
 jobs:
    e2e-chrome:
        runs-on: ubuntu-latest
-        # Bounds the image build, a cold cache included, and both Chrome
+        # Bounds the image build, a cold cache included, and the three Chrome
        # programs, so a hung browser frees the shared runner. README.md
        # "In CI" has the measured times.
-        timeout-minutes: 20
+        timeout-minutes: 40
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons enrich-tokens apply-enrichment clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -111,18 +111,6 @@ vendor-blocklist:
 icons:
 	@node script/lib/icons.js
 # Fetch a name and a website for every token in src/shared/tokenList.js into
 # script/lib/token-enrichment.json. Run deliberately, land the diff: the names
 # come from live data, so a later run can return different ones.
 enrich-tokens:
 	@node script/lib/enrich-tokens.js
 # Write the names and websites in script/lib/token-enrichment.json into
 # src/shared/tokenList.js. Commit the result with the data file:
 # tests/applyEnrichment.test.js fails while the two disagree.
 apply-enrichment:
 	@node script/lib/apply-enrichment.js
 clean:
 	@rm -rf dist/ release/
@@ -250,13 +250,11 @@ provide:
  nowhere in the working tree or under `dist/` outside its documented
  exceptions: the pinned source reference in `script/vendor-blocklist`, the two
  provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
-  on-chain name in `src/shared/tokenList.js` and in
+  on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
-  `script/lib/token-enrichment.json`, the fetched data that file's names are
+  fails anywhere else. Run by the `lint` phase, so part of `make check`; it
-  written from. Each is scoped to the paths named and fails anywhere else. Run
+  inspects `dist/` when there is one and says loudly when there is not, and the
-  by the `lint` phase, so part of `make check`; it inspects `dist/` when there
+  build context of that phase never has one. `make build` re-runs it with
-  is one and says loudly when there is not, and the build context of that phase
+  `--require-dist`, so a build artifact is always covered
  never has one. `make build` re-runs it with `--require-dist`, so a build
  artifact is always covered
 - `script/package` — produce the release artifacts: `make build` first, so the
  archives can only ever be made from a `dist/` that has been verified against
  that build's own receipt as a RELEASE build, then one self-contained,
@@ -328,19 +326,6 @@ The Makefile shims to those. It also carries a few targets that have no
  that already holds the drawn image, the same IHDR and every pixel, is left
  untouched. Commit the files with the drawing: `make check` fails while their
  image differs from what it draws
 - `make enrich-tokens` — fetch the name of each token in
  `src/shared/tokenList.js` from CoinGecko's coin list and its website from the
  `ethereum-lists/tokens` repository, at a pinned commit, into
  `script/lib/token-enrichment.json`, by running `script/lib/enrich-tokens.js`.
  CoinGecko's list is live and has no fixed version, so a later run can return
  different names
 - `make apply-enrichment` — write the names and URLs in
  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, by running
  `script/lib/apply-enrichment.js`, taking a URL from the table of project
  websites in that script only where the fetched data has none. Commit the list
  with the data file: `make check` fails while the list differs from what this
  writes. Neither target changes which tokens are on the list, and no build runs
  either
 - `make clean` — remove `dist/` and `release/`
 - `make dev` — run the build `make build` runs, without the checks that follow
  it, then run it again after every change to a file under `src/`, `manifest/`
@@ -542,6 +527,24 @@ one profile yields a single extension id, not two: Chrome does not load a second
 copy of an id it already has. The assertions are annotated as observations, so a
 Chrome that ever changes this fails the run instead of passing it.
 Last, `make test-e2e` runs `tests/e2e/slowApproval.js`, which leaves a
 transaction approval and a signature approval open for seven minutes, then
 approves both and requires the site to receive the hash of the transaction the
 stub node received and a signature that recovers to the address. Before the
 approval window kept the background worker running, Chrome stopped it about six
 minutes in and neither request was ever answered
 ([#540](https://git.eeqj.de/sneak/AutistMask/issues/540)). It is its own program
 and does not use Playwright: Playwright keeps DevTools attached to the
 background worker, and Chrome never stops a worker DevTools is attached to, so
 no wait in the suite above can show the worker stopping. It starts Chromium
 itself, speaks the DevTools protocol over `--remote-debugging-pipe`, and
 attaches to pages only. Before raising the approvals it requires the worker to
 stop on its own with nothing pending, so a run in which something else keeps the
 worker running fails. The site is connected and the RPC endpoint set through the
 extension's own screens, against the Firefox suite's loopback dApp page and stub
 node (`tests/e2e/firefox/dapp.js`). Unlike the suite above, it does not fail on
 page errors.
 ### Firefox (`make test-e2e-firefox`)
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
@@ -722,11 +725,13 @@ installing Firefox, geckodriver and their system libraries. Both scripts now
 build their image with `--no-cache`, so every run pays the cold figure. Those
 `e2e-chrome` runs predate the cases that wait in real time for a receipt to end
 in error. `make test-e2e` took 3m51s locally with its image cached, so with the
-image rebuilt every run, an `e2e-chrome` run comes to about seven minutes.
+image rebuilt every run, an `e2e-chrome` run comes to about seven minutes. The
 approvals left open for seven minutes (`tests/e2e/slowApproval.js`) add about
 eight more, so about fifteen.
 Each e2e job has a `timeout-minutes` cap, so a hung build or browser ends the
 job instead of holding the shared runner: `e2e-firefox` 15 minutes and
-`e2e-chrome` 20, each over two and a half times the job's slowest cold run. A
+`e2e-chrome` 40, each over two and a half times the job's slowest cold run. A
 job that reaches its cap has hung; read it as a hang, not as a slow run to
 retry. The `check` job has no cap: `.gitea/workflows/check.yml` is the canonical
 copy from `sneak/prompts`, kept byte-identical.
@@ -821,6 +826,16 @@ on the next event. Two consequences shape every recurring job in the background:
  service worker at all — the one remaining user of it, `src/shared/ens.js`,
  runs only in the popup and is marked as such.
 Pending approvals are the exception: an approval waiting for the user, and the
 site's request waiting on it, live only in the worker's memory, and only the
 worker that received the request can answer it. Chrome stopped the worker about
 six minutes after a site's request even with the approval window still open, and
 the user's answer then reached nobody. So while an approval window is open it
 posts an empty message on its approval port every 20 seconds, and each message
 is an event that keeps the worker running: an approval stays answerable however
 long the user takes. A worker that stops for another reason, a crash say, still
 loses the approvals open in it.
 The job also carries a freshness guard, and a guard must never be timed to the
 alarm period it gates. The guard is measured from the moment the last run
 finished, which is one run-duration after the alarm that started it, so a guard
@@ -2090,9 +2105,7 @@ view would leave a wallet one click from deletion.
  artifact can be compared with it field for field. A nonce the site supplies is
  ignored: the nonce is always the account's next nonce from the node, so a site
  cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is used
+  behind a gap. A request that cannot be populated — unreachable node, reverting
  in place of the node's estimate; a request giving both with different values
  is refused. A request that cannot be populated — unreachable node, reverting
  gas estimate — opens no window and is failed back to the site. Only one
  transaction approval exists at a time: populating fixes the nonce, so a second
  `eth_sendTransaction` arriving while one is unanswered is refused with
@@ -2791,7 +2804,7 @@ exact URL, the commit it is pinned to and the sha256 of the bytes that commit
 serves, because a source reference nobody can verify is not a source reference.
 `script/check-censored` reads the name back out of that one file and fails the
 build wherever else it appears, save for three shipped-code literals it cannot
-avoid — each permitted only at the paths that carry it, and listed in that
+avoid — each permitted only at the one path that carries it, and listed in that
 script's header.
 ## Author
@@ -18,8 +18,6 @@
 #     (src/shared/balances.js), and this contract's on-chain name is that
 #     string, so censoring the repo cannot stop the wallet displaying it.
 #     Dropping the entry instead would cost the user MUSD spoof detection.
 #     script/lib/token-enrichment.json, the fetched data tokenList.js's names
 #     are written from, carries the same name for the same reason.
 #
 # Everything else fails, in the working tree and under dist/. The last two are
 # literals rather than whole files, so they are enforced by counting, and each
@@ -104,8 +102,8 @@ allowed_literals_for() {
    src/content/inpage.js | dist/*/src/content/inpage.js)
        printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
        ;;
-    src/shared/tokenList.js | script/lib/token-enrichment.json | \
+    src/shared/tokenList.js | dist/*/src/background/index.js | \
-        dist/*/src/background/index.js | dist/*/src/popup/index.js)
+        dist/*/src/popup/index.js)
        printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
        ;;
    esac
@@ -1,180 +0,0 @@
 // Writes the names and URLs in script/lib/token-enrichment.json, which
 // script/lib/enrich-tokens.js fetches, into the matching entries of
 // src/shared/tokenList.js: the name and url an entry already has are replaced,
 // and an entry without them gets them after its decimals. Where the fetched
 // data has no URL for a token, EXTRA_URLS below supplies one if it lists the
 // token's address spelled exactly as tokenList.js spells it, capitals included.
 // An entry the data does not mention is left as it is. Run by
 // `make apply-enrichment`; no build runs it. tests/applyEnrichment.test.js
 // checks that the committed tokenList.js is exactly what this writes from the
 // committed data.
 "use strict";
 const fs = require("fs");
 const path = require("path");
 const TOKEN_LIST = path.join(__dirname, "..", "..", "src/shared/tokenList.js");
 // Project websites by token address. A token gets its URL here only where the
 // fetched data has none; an address the data has a URL for, or that is not on
 // the token list, is never used. An address matches only as tokenList.js spells
 // it, capitals included: the FLOKI, TURBO and MANA entries use other capitals
 // and never match, so FLOKI and TURBO have no URL.
 const EXTRA_URLS = {
    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
    "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",
    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": "https://www.bnbchain.org",
    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": "https://www.circle.com/usdc",
    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": "https://sky.money",
    "0x2AF5D2aD76741191D15Dfe7bF6aC92d4Bd912Ca3": "https://www.bitfinex.com",
    "0x514910771AF9Ca656af840dff83E8264EcF986CA": "https://chain.link",
    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": "https://ethena.fi",
    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d":
        "https://www.worldlibertyfinancial.com",
    "0x6B175474E89094C44Da98b954EedeAC495271d0F": "https://makerdao.com",
    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8":
        "https://www.paypal.com/us/digital-wallet/manage-money/crypto/pyusd",
    "0x95aD61b0a150d79219dCF64E1E6Cc01f0B64C4cE": "https://shibatoken.com",
    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6":
        "https://www.worldlibertyfinancial.com",
    "0xA0b73E1Ff0B80914AB6fe0444E65848C4C34450b": "https://crypto.com",
    "0x582d872A1B094FC48F5DE31D3B73F2D9bE47def1": "https://ton.org",
    "0x68749665FF8D2d112Fa859AA293F07A622782F38": "https://gold.tether.to",
    "0x196C20DA81Fbc324EcdF55501e95Ce9f0bD84d14": "https://polkadot.network",
    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": "https://uniswap.org",
    "0x45804880De22913dAFE09f4980848ECE6EcbAf78":
        "https://www.paxos.com/paxgold",
    "0x3c3a81e81dc49A522A592e7622A7E711c06bf354": "https://www.mantle.xyz",
    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": "https://aave.com",
    "0x75231F58b43240C9718Dd58B4967c5114342a86c": "https://www.okx.com",
    "0x6982508145454Ce325dDbE47a25d4ec3d2311933": "https://www.pepe.vip",
    "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599": "https://wbtc.network",
    "0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84": "https://lido.fi",
    "0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32": "https://lido.fi",
    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": "https://ens.domains",
    "0x7D1AfA7B718fb893dB30A3aBc0Cfc608AaCfeBB0": "https://polygon.technology",
    "0x9f8F72aA9304c8B593d555F12eF6589cC3A579A2": "https://makerdao.com",
    "0xD533a949740bb3306d119CC777fa900bA034cd52": "https://curve.fi",
    "0x111111111117dC0aa78b770fA6A738034120C302": "https://1inch.io",
    "0x163f8C2467924be0ae7B5347228CABF260318753": "https://worldcoin.org",
    "0xba100000625a3754423978a60c9317c58a424e3D": "https://balancer.fi",
    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": "https://synthetix.io",
    "0x1a7e4e63778B4f12a199C062f3eFdD288afCBce8": "https://www.euler.finance",
    "0xBBbbCA6A901c926F240b89EacB641d8Aec7AEafD": "https://loopring.org",
    "0xC669928185DbCE49d2230CC9B0979BE6DC797957": "https://bitstable.finance",
    "0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0": "https://lido.fi",
    "0xBe9895146f7AF43049ca1c1AE358B0541Ea49704":
        "https://www.coinbase.com/cbeth",
    "0xfAbA6f8e4a5E8Ab82F62fe7C39859FA577269BE3": "https://ondo.finance",
    "0x0C10bF8FcB7Bf5412187A595ab97a3609160b5c6": "https://decentraland.org",
    "0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24": "https://www.render.com",
    "0x4a220E6096B25EADb88358cb44068A3248254675": "https://www.quant.network",
    "0xba5BDe662c17e2aDFF1075610382B9B691296350": "https://superrare.com",
    "0x15D4c048F83bd7e37d49eA4C83a07267Ec4203dA": "https://galxe.com",
    "0xc00e94Cb662C3520282E6f5717214004A7f26888": "https://compound.finance",
    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": "https://0x.org",
    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": "https://yearn.fi",
    "0x6fB3e0A217407EFFf7Ca062D46c26E5d60a14d69": "https://iotex.io",
    "0xD31a59c85aE9D8edEFec411D448f90841571b89c": "https://solana.com",
    "0xa1faa113cbE53436Df28FF0aEe54275c13B40975": "https://alphafinance.io",
    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": "https://immutable.com",
    "0x0f5D2fB29fb7d3CFeE444a200298f468908cC942": "https://decentraland.org",
    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": "https://www.sandbox.game",
    "0x4d224452801ACEd8B2F0aebE155379bb5D594381": "https://apecoin.com",
    "0x6810e776880C02933D47DB1b9fc05908e5386b96": "https://gnosis.io",
    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": "https://www.liquity.org",
    "0xd26114cd6EE289AccF82350c8d8487fedB8A0C07": "https://omg.network",
    "0x0D8775F648430679A709E98d2b0Cb6250d2887EF":
        "https://basicattentiontoken.org",
    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": "https://thegraph.com",
    "0x1985365e9f78359a9B6AD760e32412f4a445E862": "https://augur.net",
    "0x4E15361FD6b4BB609Fa63C81A2be19d873717870": "https://fantom.foundation",
    "0x853d955aCEf822Db058eb8505911ED77F175b99e": "https://frax.finance",
    "0x0000000000085d4780B73119b644AE5ecd22b376": "https://www.trueusd.com",
    "0x0cEC1A9154Ff802e7934Fc916Ed7Ca50bDE6844e": "https://polymesh.network",
    "0x956F47F50A910163D8BF957Cf5846D573E7f87CA": "https://fei.money",
    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": "https://frax.finance",
    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": "https://curve.fi",
    "0x0100546F2cD4C9D97f798fFC9755E47865FF7Ee6": "https://alchemix.fi",
    "0x808507121B80c02388fAd14726482e061B8da827": "https://pendle.finance",
    "0xCa14007Eff0dB1f8135f4C25B34De49AB0d42766": "https://starknet.io",
    "0x8457CA5040ad67fdebbCC8EdCE889A335Bc0fbFB": "https://alt.layer",
    "0x4C19596f5aAfF459fA38B0f7eD92F11AE6543784": "https://www.truflation.com",
    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": "https://arbitrum.io",
    "0x912CE59144191C1204E64559FE8253a0e49E6548": "https://arbitrum.io",
    "0x6985884C4392D348587B19cb9eAAf157F13271cd": "https://layerzero.network",
    "0xFe0c30065B384F05761f15d0CC899D4F9F9Cc0eB": "https://ethfi.org",
    "0x18084fbA666a33d37592fA2633fD49a74DD93a88": "https://tbtc.network",
    "0x9D39A5DE30e57443BfF2A8307A4256c8797A3497": "https://suilend.fi",
    "0x5283D291DBCF85356A21bA090E6db59121208b44": "https://blur.io",
    "0x43Dfc4159D86F3A37A5A4B3D4580b888ad7d4DDd": "https://dydx.exchange",
    "0xCf0C122c6b73ff809C693DB761e7BaeBe62b6a2E": "https://floki.com",
    "0xe53EC727dbDEB9E2d5456c3be40cFF031AB40A55": "https://superfarm.com",
    "0x32353A6C91143bfd6C7d363B546e62a9A2489A20": "https://www.agora.finance",
    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": "https://www.euro-coin.com",
    "0x1a03eF3d1a80b5f214e468ACD97F55714E049393": "https://gemspad.io",
    "0x7122985656e38BDC0302Db86685bb972b145bD3C": "https://stone.fi",
    "0xa35923162C49cF95e6BF26623385eb431ad920D3": "https://www.turbo-eth.com",
    "0xdBdb4d16EdA451D0503b854CF79D55697F90c8DF": "https://alchemix.fi",
    "0x08c32b0726C5684024ea6e141C50aDe9690bBdcc": "https://stratis.io",
    "0x65Ef703f5594D2573eb71Aaf55BC0CB548492df4": "https://multichain.org",
    "0x1151CB3d861920e07a38e03eEAd12C32178567F6": "https://bonk.com",
    "0x090185f2135308BaD17527004364eBcC2D37e5F6": "https://spell.club",
    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": "https://stargate.finance",
 };
 // Returns tokenList, the text of tokenList.js, with the name and url of each
 // token in enrichment, the parsed data file, written into its entry.
 function applyEnrichment(tokenList, enrichment) {
    let result = tokenList;
    for (const [addr, data] of Object.entries(enrichment)) {
        // Escape special regex characters in the address
        const escaped = addr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
        // Match the token block: { address: "...", symbol: "...", decimals: N, }
        // and the name: "...", url: "..." after decimals when it has them.
        // The closing }, may have trailing whitespace
        const blockRe = new RegExp(
            `(\\{\\s*address:\\s*"${escaped}",\\s*symbol:\\s*"[^"]+",\\s*decimals:\\s*\\d+)` +
                `(?:,\\s*name:\\s*"(?:[^"\\\\]|\\\\.)*",\\s*url:\\s*"(?:[^"\\\\]|\\\\.)*")?` +
                `,?(\\s*\\})`,
        );
        const match = result.match(blockRe);
        if (!match) {
            console.error(`WARNING: Could not find block for ${addr}`);
            continue;
        }
        // A URL from EXTRA_URLS only where the fetched data has none.
        const url = data.url || EXTRA_URLS[addr] || "";
        // Build replacement: original fields + name + url
        const nameEscaped = data.name
            .replace(/\\/g, "\\\\")
            .replace(/"/g, '\\"');
        const urlEscaped = url.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
        const replacement =
            match[1] +
            `,\n        name: "${nameEscaped}",` +
            `\n        url: "${urlEscaped}",` +
            match[2];
        // A function, so a "$" in a name is not read as a replacement pattern.
        result = result.replace(blockRe, () => replacement);
    }
    return result;
 }
 if (require.main === module) {
    const enrichment = JSON.parse(
        fs.readFileSync(path.join(__dirname, "token-enrichment.json"), "utf8"),
    );
    const original = fs.readFileSync(TOKEN_LIST, "utf8");
    fs.writeFileSync(TOKEN_LIST, applyEnrichment(original, enrichment));
 }
 module.exports = { applyEnrichment };
@@ -1,115 +0,0 @@
 // Fetches a name and a website for every token in src/shared/tokenList.js and
 // writes them, keyed by address, to script/lib/token-enrichment.json, which
 // script/lib/apply-enrichment.js then writes into tokenList.js. Run by
 // `make enrich-tokens`; no build runs it and nothing here is shipped.
 //
 // Names come from CoinGecko's coin list, fetched whole in one request, matched
 // on the token's Ethereum contract address. A token CoinGecko does not list
 // gets its symbol as its name. The list is live data with no fixed version, so
 // a later run can return different names.
 //
 // Websites come from the ethereum-lists/tokens repository, one file per token,
 // read at a pinned commit. Most tokens have no file there and get an empty URL.
 // A file that is missing is not an error; any other failed request stops the
 // run, so a network fault cannot quietly empty a URL.
 "use strict";
 const fs = require("fs");
 const path = require("path");
 const TOKEN_LIST = path.join(__dirname, "..", "..", "src/shared/tokenList.js");
 const OUTPUT = path.join(__dirname, "token-enrichment.json");
 const COINGECKO_LIST =
    "https://api.coingecko.com/api/v3/coins/list?include_platform=true";
 // ethereum-lists/tokens at its master of 2026-02-27, when the committed
 // token-enrichment.json was made.
 const ETHEREUM_LISTS =
    "https://raw.githubusercontent.com/ethereum-lists/tokens/c3560d499a380a38e94caa7c4968d59aeffde59a/tokens/eth";
 const CONCURRENT = 10;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function main() {
    const src = fs.readFileSync(TOKEN_LIST, "utf8");
    const tokens = [];
    const re =
        /\{\s*address:\s*"(0x[a-fA-F0-9]{40})",\s*symbol:\s*"([^"]+)",\s*decimals:\s*(\d+)/g;
    let m;
    while ((m = re.exec(src)) !== null) {
        tokens.push({ address: m[1], symbol: m[2], decimals: parseInt(m[3]) });
    }
    console.error(`Parsed ${tokens.length} tokens`);
    // --- Names from CoinGecko ---
    console.error("Fetching CoinGecko coins list...");
    const listResp = await fetch(COINGECKO_LIST);
    if (!listResp.ok) throw new Error(`CoinGecko list HTTP ${listResp.status}`);
    const coins = await listResp.json();
    const addrMap = new Map();
    for (const coin of coins) {
        const eth = (coin.platforms?.ethereum || "").toLowerCase().trim();
        if (eth && eth.startsWith("0x")) {
            addrMap.set(eth, { name: coin.name, id: coin.id });
        }
    }
    console.error(`CoinGecko map: ${addrMap.size} Ethereum tokens`);
    const enriched = new Map();
    let namesMatched = 0;
    for (const t of tokens) {
        const info = addrMap.get(t.address.toLowerCase());
        if (info) namesMatched++;
        enriched.set(t.address, { name: info?.name || t.symbol, url: "" });
    }
    console.error(`Matched ${namesMatched}/${tokens.length} names`);
    // --- Websites from ethereum-lists ---
    console.error("Fetching URLs from ethereum-lists GitHub...");
    let urlsFound = 0;
    for (let i = 0; i < tokens.length; i += CONCURRENT) {
        const batch = tokens.slice(i, i + CONCURRENT);
        await Promise.all(
            batch.map(async (t) => {
                const r = await fetch(`${ETHEREUM_LISTS}/${t.address}.json`);
                if (r.status === 404) return;
                if (!r.ok) {
                    throw new Error(
                        `ethereum-lists HTTP ${r.status} for ${t.address}`,
                    );
                }
                const data = await r.json();
                const website = (data.website || "").trim();
                if (website && website !== "https://") {
                    enriched.get(t.address).url = website;
                    urlsFound++;
                }
            }),
        );
        if (i % 100 === 0) {
            console.error(
                `  GitHub: ${Math.min(i + CONCURRENT, tokens.length)}/${tokens.length}, ${urlsFound} URLs`,
            );
        }
        await sleep(200);
    }
    console.error(`Found ${urlsFound} URLs in ethereum-lists`);
    // --- Output, in the layout prettier gives it ---
    const output = {};
    for (const [addr, e] of enriched) {
        output[addr] = { name: e.name, url: e.url };
    }
    fs.writeFileSync(OUTPUT, JSON.stringify(output, null, 4) + "\n");
    console.error(`Done! ${tokens.length} names, ${urlsFound} URLs.`);
 }
 main().catch((err) => {
    console.error(`enrich-tokens: ${err.message}`);
    process.exit(1);
 });
@@ -97,6 +97,18 @@ main() {
        -e HOME=/tmp \
        "$(cat "$IIDFILE")" \
        node tests/e2e/storagePartition.js
    # Approvals left open for seven minutes, past the point where Chrome
    # stopped the background worker before the approval window kept it
    # running. Its own program, without Playwright: Playwright keeps DevTools
    # attached to the worker, and Chrome never stops a worker DevTools is
    # attached to. It reaches nothing but its own loopback server.
    echo "Running the approvals left open for seven minutes..."
    docker run --rm \
        --ipc=host \
        -e HOME=/tmp \
        "$(cat "$IIDFILE")" \
        node tests/e2e/slowApproval.js
 }
 main "$@"
@@ -649,6 +649,9 @@ runtime.onConnect.addListener((port) => {
            pendingApprovals[id].portConnected = true;
        }
        port.onMessage.addListener((msg) => {
            // The window also posts an empty message every 20 seconds while
            // it is open, only so that Chrome keeps this worker, and the
            // approval in it, running (src/popup/views/approval.js, show()).
            if (!msg || msg.type !== "AUTISTMASK_APPROVAL_DECISION") return;
            if (!isExtensionSender(port.sender)) return;
            const approval = pendingApprovals[id];
@@ -784,6 +784,22 @@ async function show(id) {
    approvalId = id;
    approvalPort = runtimeApi().connect({ name: "approval:" + id });
    // The approval this window answers, and the site's request waiting on it,
    // exist only in the background worker's memory. Chrome stops that worker
    // about six minutes after the site's request even while the user is still
    // deciding, and the approval is lost with it. A message on this port is an
    // event, and an event keeps the worker running, so one is sent every 20
    // seconds for as long as this window is open. The background ignores it.
    const port = approvalPort;
    const timer = setInterval(() => {
        try {
            port.postMessage({});
        } catch {
            // The worker is gone anyway, and the port with it.
            clearInterval(timer);
        }
    }, 20000);
    let details = null;
    try {
        details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
@@ -1,14 +1,13 @@
 // Preparation of the transaction an approval screen displays.
 //
-// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
+// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
-// sometimes the gas limit. The nonce, the fees, and the gas limit when the
+// The nonce, the gas limit and the fees have to be filled in from the network
-// site gives none have to be filled in from the network before anything can
+// before anything can be signed, and whoever fills them in decides what the
-// be signed, and whoever fills them in decides what the user is shown. That
+// user is shown. That work used to happen in the popup, after the user had
-// work used to happen in the popup, after the user had already approved: the
+// already approved: the numbers on the approval screen came from the popup and
-// numbers on the approval screen came from the popup and were compared against
+// were compared against nothing, so a compromised popup could display one fee
-// nothing, so a compromised popup could display one fee and sign another, and
+// and sign another, and the ceilings in approvalVerify.js were all that stood
-// the ceilings in approvalVerify.js were all that stood between the user and a
+// between the user and a fee that hands the validator the balance.
 // fee that hands the validator the balance.
 //
 // So it happens here instead, in the background, before the approval window is
 // opened. The background populates the transaction, shows that object, and
@@ -32,7 +31,6 @@ const {
    VoidSigner,
    accessListify,
    getAddress,
    getBigInt,
    getBytes,
    hexlify,
    toQuantity,
@@ -49,11 +47,10 @@ const {
 // minutes long, which is not a wait anyone will sit through.
 const POPULATE_TIMEOUT_MS = 20000;
-// The request fields taken from the page, plus `gas`, which requestFrom()
+// The request fields taken from the page. Anything else is dropped rather than
-// takes as the gas limit. Anything else is dropped rather than passed to
+// passed to ethers: the object is page-controlled, and a future ethers that
-// ethers: the object is page-controlled, and a future ethers that learns to
+// learns to carry a new transaction field must not start picking one up out of
-// carry a new transaction field must not start picking one up out of it
+// it without this module knowing.
 // without this module knowing.
 //
 // The nonce is not taken from the page; it is always the account's next nonce
 // from the network. A page that chose it could replace one of the user's
@@ -87,16 +84,6 @@ function present(v) {
    return v !== null && v !== undefined && v !== "";
 }
 // Whether two quantities from the page are the same number. One that is not a
 // number matches nothing.
 function sameQuantity(a, b) {
    try {
        return getBigInt(a) === getBigInt(b);
    } catch {
        return false;
    }
 }
 // These strings reach the user through the requesting page, so they are full
 // sentences even when the tail of one came from ethers or from the node.
 function sentence(text) {
@@ -124,20 +111,6 @@ function requestFrom(txParams, from) {
    for (const key of REQUEST_FIELDS) {
        if (present(txParams[key])) request[key] = txParams[key];
    }
    // JSON-RPC calls the gas limit `gas`, and that is the name sites send.
    // ethers only reads `gasLimit`: left as `gas` it would be dropped and an
    // estimate signed in its place.
    if (present(txParams.gas)) {
        if (
            present(request.gasLimit) &&
            !sameQuantity(request.gasLimit, txParams.gas)
        ) {
            throw fail(
                "The site asked for two different gas limits for this transaction.",
            );
        }
        request.gasLimit = txParams.gas;
    }
    if (
        present(request.type) &&
        !ALLOWED_TX_TYPES.includes(Number(request.type))
@@ -1,19 +0,0 @@
 // The token names and URLs in src/shared/tokenList.js are written from
 // script/lib/token-enrichment.json by script/lib/apply-enrichment.js
 // (`make apply-enrichment`). The committed list must be exactly what it writes
 // from the committed data, so the list, the data and the script cannot drift
 // apart.
 const fs = require("fs");
 const path = require("path");
 const enrichment = require("../script/lib/token-enrichment.json");
 const { applyEnrichment } = require("../script/lib/apply-enrichment");
 test("src/shared/tokenList.js is what make apply-enrichment writes from the committed data", () => {
    const committed = fs.readFileSync(
        path.join(__dirname, "..", "src/shared/tokenList.js"),
        "utf8",
    );
    expect(applyEnrichment(committed, enrichment)).toBe(committed);
 });
@@ -9,7 +9,7 @@
 // requesting page or the RPC node can say turns it into an approval that
 // should never have been raised.
-const { Network, Transaction, Wallet, toQuantity } = require("ethers");
+const { Network, Wallet } = require("ethers");
 const {
    prepareApprovalTx,
    serializeApprovedTx,
@@ -138,43 +138,6 @@ describe("prepareApprovalTx", () => {
        expect(approved.maxFeePerGas).toBe("0x12a05f200");
    });
    // `gas` is the JSON-RPC name for the gas limit and the one sites send.
    // The node would estimate 21000; the site's 200000 is what is shown and
    // what is signed.
    test("uses the gas limit a site sends as gas", async () => {
        const approved = await prepareApprovalTx(
            providerWith(),
            signer.address,
            { ...TX_PARAMS, gas: "0x30d40" },
        );
        expect(approved.gasLimit).toBe("0x30d40");
        const signed = Transaction.from(
            await signer.signTransaction({ ...approved }),
        );
        expect(signed.gasLimit).toBe(200000n);
    });
    test("accepts gas and gasLimit that name the same number", async () => {
        const approved = await prepareApprovalTx(
            providerWith(),
            signer.address,
            { ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
        );
        expect(approved.gasLimit).toBe("0x30d40");
    });
    test("refuses gas and gasLimit that disagree", async () => {
        await expect(
            prepareApprovalTx(providerWith(), signer.address, {
                ...TX_PARAMS,
                gas: "0x30d40",
                gasLimit: "0x5208",
            }),
        ).rejects.toThrow(
            "The site asked for two different gas limits for this transaction.",
        );
    });
    test("carries an access list the request asked for", async () => {
        const approved = await prepareApprovalTx(
            providerWith(),
@@ -249,15 +212,6 @@ describe("prepareApprovalTx", () => {
        ).rejects.toThrow(/gas limit no network this wallet supports/);
    });
    test("refuses a gas limit the site sent above the ceiling", async () => {
        await expect(
            prepareApprovalTx(providerWith(), signer.address, {
                ...TX_PARAMS,
                gas: toQuantity(MAX_GAS_LIMIT + 1n),
            }),
        ).rejects.toThrow(/gas limit no network this wallet supports/);
    });
    // The combined bound at population: a gas limit and a fee that are each
    // under their own ceiling but multiply to thousands of ETH is refused
    // before the approval window opens, so the user is never shown a
@@ -58,6 +58,7 @@ const TX_PARAMS = {
    to: RECIPIENT,
    value: "0x2386f26fc10000",
    data: "0xdeadbeef",
    gas: "0x5208",
 };
 // The values populateTransaction() fills in when the dApp fixed none of them.
@@ -0,0 +1,495 @@
 // A transaction approval and a signature approval the user leaves open for
 // seven minutes are still answered, and the site receives both results
 // (https://git.eeqj.de/sneak/AutistMask/issues/540).
 //
 // Both approvals, and the site's requests waiting on them, live only in the
 // background worker's memory. With nothing else going on, Chrome stopped that
 // worker about six minutes after the site's request, while the window was
 // still open, and the user's answer then reached nobody. The approval window
 // now posts on its approval port every 20 seconds, which keeps the worker
 // running (src/popup/views/approval.js, show()).
 //
 // A separate program from run.js, and not driven by Playwright: Playwright
 // keeps DevTools attached to the background worker, and Chrome never stops a
 // worker DevTools is attached to, so in run.js the worker outlives any wait
 // and a wait there proves nothing. This program starts Chromium itself and
 // speaks the DevTools protocol over the pipe Chromium opens for it
 // (--remote-debugging-pipe), attaching to pages only, never to the worker.
 // Before the approvals are raised it watches the worker stop on its own, so a
 // run in which something else keeps the worker running cannot pass.
 //
 // The dApp page and the stub node are the Firefox suite's loopback ones
 // (tests/e2e/firefox/dapp.js). The site is connected and the node chosen
 // through the extension's own screens, so nothing is written to its storage
 // from outside.
 //
 // Run through script/test-e2e, which builds the extension and the pinned
 // container.
 //
 //   node tests/e2e/slowApproval.js
 "use strict";
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const { spawn } = require("child_process");
 const { chromium } = require("playwright-core");
 const {
    Transaction,
    getAddress,
    getBytes,
    hexlify,
    parseEther,
    toQuantity,
    toUtf8Bytes,
    verifyMessage,
 } = require("ethers");
 const { PASSWORD } = require("./harness");
 const { STUB_COUNTERPARTY } = require("./network");
 const { startDappServer } = require("./firefox/dapp");
 const DIST_CHROME = path.resolve(__dirname, "..", "..", "dist", "chrome");
 // Chrome stopped the worker six minutes after the site's request when nothing
 // kept it running, so the approvals are left open for longer than that.
 const APPROVAL_WAIT_MS = 7 * 60 * 1000;
 // With nothing pending, Chrome stops the worker 30 seconds after its last
 // event; this is how long the program waits to see that.
 const IDLE_STOP_TIMEOUT_MS = 90000;
 const SIGN_HEX = hexlify(toUtf8Bytes("AutistMask e2e: a slow signature"));
 const checks = [];
 let failed = 0;
 function check(name, cond, detail) {
    checks.push(name);
    if (cond) {
        console.log("ok " + checks.length + " - " + name);
    } else {
        failed += 1;
        console.log("not ok " + checks.length + " - " + name);
        if (detail) console.log("  " + detail);
    }
 }
 function sleep(ms) {
    return new Promise((resolve) => setTimeout(resolve, ms));
 }
 // Poll `probe` until it returns something truthy, and return that.
 async function until(what, probe, timeout = 30000) {
    const deadline = Date.now() + timeout;
    for (;;) {
        const value = await probe().catch(() => null);
        if (value) return value;
        if (Date.now() > deadline) {
            throw new Error(
                "gave up after " + timeout + "ms waiting for " + what,
            );
        }
        await sleep(250);
    }
 }
 // The DevTools protocol over Chromium's pipe: commands go to its fd 3, and
 // replies and events come back on its fd 4, each one JSON message ended by a
 // NUL byte. Events are not used and are dropped. Returns send(method, params,
 // sessionId), which resolves with the command's result.
 function devtools(browser) {
    const waiting = new Map();
    let nextId = 1;
    let pending = "";
    const replies = browser.stdio[4];
    replies.setEncoding("utf8");
    replies.on("data", (chunk) => {
        pending += chunk;
        let end;
        while ((end = pending.indexOf("\0")) !== -1) {
            const message = JSON.parse(pending.slice(0, end));
            pending = pending.slice(end + 1);
            const caller = waiting.get(message.id);
            if (!caller) continue;
            waiting.delete(message.id);
            if (message.error) {
                caller.reject(
                    new Error(caller.method + ": " + message.error.message),
                );
            } else {
                caller.resolve(message.result);
            }
        }
    });
    replies.on("close", () => {
        for (const caller of waiting.values()) {
            caller.reject(new Error("the browser exited"));
        }
        waiting.clear();
    });
    return (method, params = {}, sessionId) =>
        new Promise((resolve, reject) => {
            const id = nextId++;
            waiting.set(id, { method, resolve, reject });
            browser.stdio[3].write(
                JSON.stringify({ id, method, params, sessionId }) + "\0",
            );
        });
 }
 // Attach to a page and return a function that evaluates an expression in it,
 // awaiting a promise it returns, and resolves with the value.
 async function attach(send, targetId) {
    const { sessionId } = await send("Target.attachToTarget", {
        targetId,
        flatten: true,
    });
    return async (expression) => {
        const r = await send(
            "Runtime.evaluate",
            { expression, awaitPromise: true, returnByValue: true },
            sessionId,
        );
        if (r.exceptionDetails) {
            throw new Error(
                "evaluating " +
                    expression.slice(0, 80) +
                    " threw: " +
                    JSON.stringify(r.exceptionDetails.exception || {}),
            );
        }
        return r.result.value;
    };
 }
 // Whether the page has loaded and shows the element with this id: the
 // `hidden` class showView() keeps on every other view is on neither it nor
 // anything around it.
 function shows(id) {
    return (
        "document.readyState === 'complete' &&" +
        " !!document.getElementById(" +
        JSON.stringify(id) +
        ") && !document.getElementById(" +
        JSON.stringify(id) +
        ").closest('.hidden')"
    );
 }
 // Set an input's value and fire the input event typing would fire.
 function typeInto(id, value) {
    return (
        "(() => { const el = document.getElementById(" +
        JSON.stringify(id) +
        "); el.value = " +
        JSON.stringify(value) +
        "; el.dispatchEvent(new Event('input', { bubbles: true })); })()"
    );
 }
 function click(id) {
    return "document.getElementById(" + JSON.stringify(id) + ").click()";
 }
 // The outcome of a request the dApp page started with __dapp.start(), or
 // {settled: "pending"} if it has not settled within `timeout`.
 function settled(key, timeout = 30000) {
    return (
        "Promise.race([window.__dapp.settle(" +
        JSON.stringify(key) +
        "), new Promise((r) => setTimeout(() => r({ settled: 'pending' }), " +
        timeout +
        "))])"
    );
 }
 async function main() {
    if (!fs.existsSync(path.join(DIST_CHROME, "manifest.json"))) {
        console.error(
            "slowApproval: no unpacked build at " +
                DIST_CHROME +
                " — run make build first",
        );
        process.exitCode = 1;
        return;
    }
    const node = await startDappServer();
    const profile = fs.mkdtempSync(
        path.join(os.tmpdir(), "autistmask-slow-approval-"),
    );
    const browser = spawn(
        chromium.executablePath(),
        [
            "--headless",
            // The container runs unprivileged, as in harness.js.
            "--no-sandbox",
            "--remote-debugging-pipe",
            "--user-data-dir=" + profile,
            "--disable-extensions-except=" + DIST_CHROME,
            "--load-extension=" + DIST_CHROME,
            // Nothing but the loopback dApp page and stub node can be reached.
            "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1",
            "about:blank",
        ],
        { stdio: ["ignore", "ignore", "ignore", "pipe", "pipe"] },
    );
    try {
        const send = devtools(browser);
        const targets = async () =>
            (await send("Target.getTargets")).targetInfos;
        const worker = await until("the background worker", async () =>
            (await targets()).find(
                (t) =>
                    t.type === "service_worker" &&
                    t.url.startsWith("chrome-extension://"),
            ),
        );
        // The extension id is the host of the worker's URL, as in harness.js.
        const popupUrl =
            "chrome-extension://" +
            new URL(worker.url).host +
            "/src/popup/index.html";
        const workerRunning = async () =>
            (await targets()).some((t) => t.url === worker.url);
        const openPage = async (url) => {
            const { targetId } = await send("Target.createTarget", { url });
            return { targetId, evaluate: await attach(send, targetId) };
        };
        const approvalPages = async () =>
            (await targets()).filter(
                (t) => t.type === "page" && t.url.includes("?approval="),
            );
        // A wallet, through the popup's own screens, and the stub node as its
        // RPC endpoint, through Settings.
        const popup = await openPage(popupUrl);
        await until("the welcome screen", () =>
            popup.evaluate(shows("view-welcome")),
        );
        await popup.evaluate(click("btn-welcome-add"));
        await until("the add wallet screen", () =>
            popup.evaluate(shows("view-add-wallet")),
        );
        await popup.evaluate(click("btn-generate-phrase"));
        await until("a generated recovery phrase", () =>
            popup.evaluate(
                "document.getElementById('wallet-mnemonic').value.trim()" +
                    ".split(/\\s+/).length >= 12",
            ),
        );
        await popup.evaluate(typeInto("add-wallet-password", PASSWORD));
        await popup.evaluate(typeInto("add-wallet-password-confirm", PASSWORD));
        await popup.evaluate(click("btn-add-wallet-confirm"));
        await until(
            "the main screen",
            () => popup.evaluate(shows("view-main")),
            60000,
        );
        await popup.evaluate(click("btn-settings"));
        await until("the settings screen", () =>
            popup.evaluate(shows("view-settings")),
        );
        await popup.evaluate(typeInto("settings-rpc", node.rpcUrl));
        await popup.evaluate(click("btn-save-rpc"));
        await until("the stub node saved as the RPC endpoint", () =>
            popup.evaluate(
                "new Promise((resolve) => chrome.storage.local.get(" +
                    "'autistmask', (r) => resolve(r.autistmask.rpcUrl === " +
                    JSON.stringify(node.rpcUrl) +
                    ")))",
            ),
        );
        await send("Target.closeTarget", { targetId: popup.targetId });
        // The site, connected through the real prompt with "Remember", so
        // the connection is stored rather than held by the worker.
        const dapp = await openPage(node.url);
        await until("the injected provider", () =>
            dapp.evaluate("!!window.ethereum && !!window.__dapp"),
        );
        await dapp.evaluate(
            "window.__dapp.start('accounts', 'eth_requestAccounts', [])",
        );
        const prompt = await until(
            "the connection prompt",
            async () => (await approvalPages())[0],
        );
        const inPrompt = await attach(send, prompt.targetId);
        await until("the connection prompt's screen", () =>
            inPrompt(shows("view-approve-site")),
        );
        await inPrompt(
            "document.getElementById('approve-remember').checked = true",
        );
        // The prompt closes itself on the click.
        await inPrompt(click("btn-approve")).catch(() => {});
        const accounts = await dapp.evaluate(settled("accounts"));
        if (accounts.settled !== "resolved") {
            throw new Error(
                "the site could not be connected: " + JSON.stringify(accounts),
            );
        }
        const address = getAddress(accounts.result[0]);
        console.log("# address " + address + ", site " + node.origin);
        // The control: with nothing pending, the worker stops on its own.
        // Were something else keeping it running, the wait below would
        // prove nothing.
        const idleStart = Date.now();
        const stoppedWhenIdle = await until(
            "the idle worker to stop",
            async () => !(await workerRunning()),
            IDLE_STOP_TIMEOUT_MS,
        ).catch(() => false);
        check(
            "with nothing pending, Chrome stops the background worker on its own",
            stoppedWhenIdle,
            "the worker was still running " +
                IDLE_STOP_TIMEOUT_MS / 1000 +
                "s after its last event, so something other than the " +
                "approval windows is keeping it running",
        );
        console.log(
            "# idle worker stopped after " +
                Math.round((Date.now() - idleStart) / 1000) +
                "s",
        );
        // A transaction approval and a signature approval, both open at once.
        await dapp.evaluate(
            "window.__dapp.start('tx', 'eth_sendTransaction', [" +
                JSON.stringify({
                    from: address,
                    to: STUB_COUNTERPARTY,
                    value: toQuantity(parseEther("0.01")),
                }) +
                "])",
        );
        await until("the transaction approval window", async () =>
            (await approvalPages()).length === 1 ? true : null,
        );
        await dapp.evaluate(
            "window.__dapp.start('sign', 'personal_sign', [" +
                JSON.stringify(SIGN_HEX) +
                ", " +
                JSON.stringify(address) +
                "])",
        );
        const windows = await until("both approval windows", async () => {
            const pages = await approvalPages();
            return pages.length === 2 ? pages : null;
        });
        let txWindow = null;
        let signWindow = null;
        for (const page of windows) {
            const evaluate = await attach(send, page.targetId);
            const view = await until("an approval screen", () =>
                evaluate(
                    "(" +
                        shows("view-approve-tx") +
                        ") ? 'tx' : (" +
                        shows("view-approve-sign") +
                        ") ? 'sign' : null",
                ),
            );
            if (view === "tx") txWindow = evaluate;
            if (view === "sign") signWindow = evaluate;
        }
        if (!txWindow || !signWindow) {
            throw new Error("the two windows are not one of each kind");
        }
        // The user takes seven minutes. The worker is checked every two
        // seconds, and the wait ends early if Chrome stops it.
        const opened = Date.now();
        let stoppedAfter = null;
        while (Date.now() - opened < APPROVAL_WAIT_MS) {
            if (!(await workerRunning())) {
                stoppedAfter = Math.round((Date.now() - opened) / 1000);
                break;
            }
            await sleep(2000);
        }
        check(
            "the background worker keeps running while both approvals are open",
            stoppedAfter === null,
            "Chrome stopped the worker " +
                stoppedAfter +
                "s after the approvals opened",
        );
        await txWindow(typeInto("approve-tx-password", PASSWORD));
        await txWindow(click("btn-approve-tx"));
        await signWindow(typeInto("approve-sign-password", PASSWORD));
        // The window closes itself once the signature is handed over.
        await signWindow(click("btn-approve-sign")).catch(() => {});
        const tx = await dapp.evaluate(settled("tx"));
        const broadcast = node.broadcast.map((raw) => Transaction.from(raw));
        check(
            "the transaction approved after seven minutes reaches the site",
            tx.settled === "resolved" &&
                broadcast.length === 1 &&
                tx.result === broadcast[0].hash &&
                getAddress(broadcast[0].from) === address,
            "the page got " +
                JSON.stringify(tx) +
                " and the node received " +
                broadcast.length +
                " transaction(s)",
        );
        const sign = await dapp.evaluate(settled("sign"));
        check(
            "the signature approved after seven minutes reaches the site",
            sign.settled === "resolved" &&
                getAddress(verifyMessage(getBytes(SIGN_HEX), sign.result)) ===
                    address,
            "the page got " + JSON.stringify(sign),
        );
    } catch (e) {
        failed += 1;
        console.log("# ERROR: " + (e && e.stack ? e.stack : e));
    } finally {
        if (browser.exitCode === null && browser.signalCode === null) {
            const exited = new Promise((resolve) =>
                browser.once("exit", resolve),
            );
            browser.kill();
            await exited;
        }
        await node.close();
        // Chromium's helper processes can still be writing to the profile
        // for a moment after the browser process itself has exited.
        fs.rmSync(profile, { recursive: true, force: true, maxRetries: 5 });
    }
    console.log("1.." + checks.length);
    if (checks.length === 0) {
        console.log("# FAILED: this program asserted nothing");
        process.exitCode = 1;
        return;
    }
    console.log(
        "# " +
            (checks.length - failed) +
            "/" +
            checks.length +
            " checks passed",
    );
    if (failed > 0) {
        console.log("# FAILED");
        process.exitCode = 1;
    }
 }
 main().catch((e) => {
    console.error("slowApproval: " + (e && e.stack ? e.stack : e));
    process.exitCode = 1;
 });