fix: AutistMask does not run in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own. A
popup there could save between the background's read and its write of the
stored record, and undo a network switch the background had saved.

manifest/firefox.json now sets "incognito": "not_allowed", so Firefox never
runs AutistMask in a private window. tests/manifest.test.js pins the key.
The README and five code comments no longer describe a private-window
exception to the lock.

Model: opus-5-5

README.md

@@ -512,10 +512,7 @@ window of its own, and the password is required to be absent from every message
 the approval window sends to the background — with the message that would carry
 it required to be present, so that check cannot pass by observing nothing. That
 last one is the standing floor under
-[#157](https://git.eeqj.de/sneak/AutistMask/issues/157). Closing a transaction
-or signature approval window is required to leave the dApp's request unanswered.
-The suite then opens that approval at the URL the toolbar button holds, and
-answers it there.
+[#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
 papered over:
@@ -524,9 +521,9 @@ papered over:
   network with real funds; that remains a human pass before 1.0.0.
 - The site-connection prompt is raised through `chrome.action.openPopup()`, and
   headless Chromium's browser-action popup is not a page Playwright can see or
-  click. So that prompt, and an approval reopened after its window closed, are
-  opened in a tab at the URL the extension puts on the action. Whether a real
-  toolbar click shows that page is not observable here.
+  click, so that one prompt is driven at the URL the extension itself puts on
+  the action — the same page and the same approval id, but whether a real
+  toolbar click shows it is not observable here.
 - Each site-connection request is made 1.5 seconds after the tab it will be
   driven in is opened (`APPROVAL_TAB_SETTLE_MS` in `tests/e2e/run.js`), because
   opening that tab closes the previous prompt's toolbar popup; a request made
@@ -645,24 +642,15 @@ above, it does not fail on page errors.
 
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
 real Firefox**, installed as an unpacked MV2 temporary add-on via geckodriver.
-It covers:
-
-- popup load
-- the StateRecovery screen, with the same cases as the Chrome suite
-- wallet creation through the UI
-- the Add Token screen
-- `eth_requestAccounts` from a dApp
-- `personal_sign` from a dApp
-- `wallet_switchEthereumChain` from a dApp, rejected and then approved
-- `eth_sendTransaction` from a dApp
-- an approval window closed without an answer, which leaves its request pending
-  until it is rejected
-
-Each dApp request runs through the real content script and background page, and
-opens a real approval window. The popup open all along is required to show the
-`[TESTNET]` banner once the switch to Sepolia is approved and to drop it once
-the switch back is. The `personal_sign` prompt is also required to fit its
-window without scrolling sideways, with the extension's pages at 170% zoom.
+It covers popup load, the StateRecovery screen (the same cases as the Chrome
+suite), wallet creation through the UI, the Add Token screen, and the dApp round
+trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
+rejected and then approved, `eth_sendTransaction`, and a closed approval window
+rejecting with EIP-1193 4001 — driven through the real content script,
+background page and approval windows. The popup open all along is required to
+show the `[TESTNET]` banner once the switch to Sepolia is approved and to drop
+it once the switch back is. The `personal_sign` prompt is also required to fit
+its window without scrolling sideways, with the extension's pages at 170% zoom.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -1493,9 +1481,7 @@ send-screen token selector, the address total and the remove-address warning
 (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
-zero balance" is on. While that setting is on, a token just added reads
-`quantity unknown` at an address with no entry for it, until a refresh has read
-its balance at every address (see AddToken).
+zero balance" is on.
 
 #### Stored state and its version
 
@@ -1508,16 +1494,16 @@ wrote last, the record says which build's shape it is in.
 Each write reads the record, changes it and writes it back, holding a lock from
 the read to the write: the browser's own (`navigator.locks`), taken through
 `withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
-background share it, except a page in a Firefox private window, which has locks
-of its own. `manifest/firefox.json` sets `"incognito": "not_allowed"`, so such a
-page cannot read or write extension storage. In Chrome, a page opened from an
-incognito window still runs outside incognito and shares the lock. The popup's
-`saveState()`, the background's `updateState()` and the StateRecovery reset all
-take it, so no write lands between another write's read and its write, where it
-would be lost. Chrome has it from version 69, older than any Chrome that runs a
-Manifest V3 extension, in pages and in the service worker; Firefox from version
-96, older than the 115 `manifest/firefox.json` declares. Where it is missing, a
-write fails rather than going ahead without it.
+background share it. `manifest/firefox.json` sets `"incognito": "not_allowed"`,
+so no page runs in a Firefox private window. Firefox would give a page there
+locks of its own. In Chrome, a page opened from an incognito window still runs
+outside incognito and shares the lock. The popup's `saveState()`, the
+background's `updateState()` and the StateRecovery reset all take it, so no
+write lands between another write's read and its write, where it would be lost.
+Chrome has it from version 69, older than any Chrome that runs a Manifest V3
+extension, in pages and in the service worker; Firefox from version 96, older
+than the 115 `manifest/firefox.json` declares. Where it is missing, a write
+fails rather than going ahead without it.
 
 Version 1 is the shape that shipped before versions existed, so a stored record
 with no `schemaVersion` is version 1 rather than a defect: it loads normally and
@@ -1679,13 +1665,6 @@ network switch (below). That popup then redraws its top screen as a reopened
 popup would. A screen that a reopened popup cannot render, such as Send, is
 replaced by Home.
 
-The popup refreshes balances every ten seconds while it is open
-(`doRefreshAndRender()` in `src/popup/index.js`). Each refresh that returns
-draws the wallet list again. When AddressDetail or AddressToken is up, the
-refresh also draws that screen's USD total and balance lines again, but not its
-transaction list. A refresh draws no other screen again, DeleteAddress and its
-balance lines included.
-
 A network switch leaves every screen on the page showing the previous network.
 The user makes it in Settings, or approves a site's request and the background
 saves it. Any other popup open meanwhile takes the switch from the stored
@@ -2242,15 +2221,7 @@ view would leave a wallet one click from deletion.
     - "Add" button
 - **Transitions**:
     - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
-      **AddressDetail**. Until a balance refresh on the token's network has read
-      the token's balance at every address, its line never reads `0.0000`. The
-      line reads `quantity unknown` instead, or is left out while "Show tracked
-      tokens with zero balance" is off. Where Blockscout already listed a
-      holding of the token, the line shows that holding. Until that refresh, the
-      tracked token's record carries `balanceNotFetched`, so the line still
-      reads `quantity unknown` after the popup closes and opens again. A refresh
-      that returns draws AddressDetail's balances again (see Navigation), so the
-      fetched balance shows without the screen being reopened
+      **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2551,9 +2522,7 @@ view would leave a wallet one click from deletion.
       add path
 - **Transitions**:
     - Any of the add paths shown, on success → adds the token and shows an
-      "Added SYMBOL" flash message (no screen change). Until a refresh has read
-      the token's balance at every address, its lines read as after "Add" on
-      AddToken
+      "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
@@ -2675,14 +2644,8 @@ view would leave a wallet one click from deletion.
       Data Model) → full-sentence error on the error line saying why, nothing
       signed (no screen change)
     - "Reject" → closes popup (returns rejection to background)
-    - "Reject" after "Confirm", while the transaction is being sent → the
-      background's message on the error line, no screen change
-    - Popup window closed without answering → the request stays pending, and the
-      site gets no answer. The browser can close this window when the user
-      clicks away from it, for example to copy the password from a password
-      manager. Until the request is answered, the toolbar button opens this
-      screen instead of the wallet. When several requests wait with their
-      windows closed, the toolbar button opens the oldest first.
+    - Popup window closed without answering → the request is rejected with
+      EIP-1193 code 4001
 
 #### SignApproval (`approve-sign`)
 
@@ -2771,11 +2734,8 @@ view would leave a wallet one click from deletion.
     - "Sign" (wrong password, or a signing failure) → error line, no screen
       change
     - "Reject" → closes popup (returns rejection to background)
-    - "Reject" after "Sign", while the signature is being checked → the
-      background's message on the error line, no screen change
-    - Popup window closed without answering → the request stays pending, as on
-      TxApproval. Until the request is answered, the toolbar button opens this
-      screen instead of the wallet.
+    - Popup window closed without answering → the request is rejected with
+      EIP-1193 code 4001
 
 #### NetworkApproval (`approve-network`)
 

docs/README.md

@@ -208,9 +208,6 @@ password.
 3. Click "Load Temporary Add-on".
 4. Select `dist/firefox/manifest.json`.
 
-AutistMask does not work in Firefox private windows. If Firefox is set to "Never
-remember history", every window is private, so AutistMask does not work at all.
-
 ## Getting Started
 
 ### Creating a New Wallet
@@ -353,13 +350,6 @@ enter your password and click "Confirm" to authorize it. Message and typed-data
 signature requests work the same way, with a "Sign" button, and also require
 your password.
 
-If a transaction or signature popup closes before you answer, for example when
-you click away to copy your password, the request stays open. Closing the popup
-does not turn the request down. Click the AutistMask icon in your browser
-toolbar to bring the request back. Until you answer, the icon opens the request
-instead of your wallet. If several requests are waiting this way, the oldest
-comes first.
-
 A connected site can also ask to switch the wallet's network. A popup shows the
 site's origin, the current network and the requested network. Nothing changes
 unless you click "Switch"; clicking "Reject" or closing the popup leaves

src/background/index.js

@@ -161,9 +161,9 @@ let txApprovalSlot = null;
 const APPROVAL_PENDING_CODE = -32002;
 
 // True at every moment this can be sent: the slot is taken immediately before
-// the transaction is populated, so the other request is being prepared, is on
-// screen, or waits with its window closed. It does not claim the other one is
-// displayed yet, because for the length of one network round trip it is not.
+// the transaction is populated, so the other request is either being prepared
+// or on screen. It does not claim the other one is displayed yet, because for
+// the length of one network round trip it is not.
 const TX_APPROVAL_PENDING_MESSAGE =
     "AutistMask handles one transaction at a time, and another one is" +
     " already in progress, so this one was not sent. Please finish that" +
@@ -383,26 +383,14 @@ async function proxyRpc(method, params) {
     return json.result;
 }
 
-// The approval the toolbar popup is set to open, or null while it opens the
-// wallet. Set only by updateToolbarPopup() and showInToolbarPopup().
+// The site-connection approval the toolbar popup is set to open, or null while
+// it opens the wallet. Set only by resetPopupUrl() and showInToolbarPopup().
 let toolbarPopupApprovalId = null;
 
-// Point the toolbar popup at the oldest pending approval whose window closed,
-// or at the wallet when there is none. The user can then answer that approval
-// from the toolbar popup. pendingApprovals lists approvals in the order they
-// were added, so the first one found is the oldest. An approval held by a
-// running attempt is skipped until that attempt ends.
-function updateToolbarPopup() {
-    const closed = Object.values(pendingApprovals).find(
-        (approval) => approval.windowClosed && !approval.attemptInFlight,
-    );
-    toolbarPopupApprovalId = closed ? closed.id : null;
+function resetPopupUrl() {
+    toolbarPopupApprovalId = null;
     if (actionNs && typeof actionNs.setPopup === "function") {
-        actionNs.setPopup({
-            popup: closed
-                ? "src/popup/index.html?approval=" + closed.id
-                : "src/popup/index.html",
-        });
+        actionNs.setPopup({ popup: "src/popup/index.html" });
     }
 }
 
@@ -432,16 +420,15 @@ function settleApproval(id, result, options) {
     // approval stops being alive.
     releaseTxApprovalSlotFor(id);
     approval.resolve(result);
-    updateToolbarPopup();
+    resetPopupUrl();
     return true;
 }
 
 // What a pending approval resolves to when it is given up on rather than
-// answered: a site-connection or network-switch window was closed, or the
-// window could not be opened at all. An address switch in the wallet gives up
-// pending approvals too. A tx or sign approval answers the requesting page in
-// EIP-1193 shape; a site-connection or network-switch approval answers its
-// handler in the shape the popup's decision has, as a refusal.
+// answered: the window was closed, or could not be opened at all. A tx or sign
+// approval answers the requesting page in EIP-1193 shape; a site-connection or
+// network-switch approval answers its handler in the shape the popup's
+// decision has, as a refusal.
 function abandonedResult(approval, code, message) {
     if (approval.type === "tx" || approval.type === "sign") {
         return { error: { code, message } };
@@ -449,9 +436,8 @@ function abandonedResult(approval, code, message) {
     return { approved: false, remember: false };
 }
 
-// A site-connection or network-switch window the user closed without answering
-// is a refusal by the user, which is 4001 and the wording every other rejection
-// path already uses.
+// A window the user closed without answering is a refusal by the user, which
+// is 4001 and the wording every other rejection path already uses.
 const APPROVAL_REJECTED_CODE = 4001;
 const APPROVAL_REJECTED_MESSAGE = "User rejected the request.";
 
@@ -479,16 +465,31 @@ const APPROVAL_WINDOW_FAILED_MESSAGE =
 function claimApproval(approval) {
     if (approval.attemptInFlight) return false;
     approval.attemptInFlight = true;
-    updateToolbarPopup();
     return true;
 }
 
 // Release an approval whose attempt failed in a way the user can retry.
-// Nothing was broadcast, so the next attempt may claim it. If the user closed
-// its window while the attempt ran, the toolbar popup opens it for that retry.
+// Nothing was broadcast, so the next attempt may claim it.
+//
+// Unless the window it would be retried in is already gone. The user closed it
+// while the attempt was running and settleApproval() declined then, correctly,
+// because the attempt still owned the approval; the attempt has now failed, so
+// nothing owns it and nothing can reach it. Left standing it would hold the
+// requesting page's promise open forever and, with it, the transaction
+// approval slot. It is settled here as the rejection the closed window
+// already meant.
 function releaseApproval(approval) {
     approval.attemptInFlight = false;
-    updateToolbarPopup();
+    if (approval.windowClosed) {
+        settleApproval(
+            approval.id,
+            abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            ),
+        );
+    }
 }
 
 // Open approval in a separate popup window, unless it is no longer pending.
@@ -711,7 +712,9 @@ function isExtensionSender(sender) {
 // had refused.
 //
 // TX and sign approvals do not decide here. They stay pending across a
-// disconnect, and across their window closing, until the user answers them.
+// disconnect. When their window closes, the windows.onRemoved listener below
+// rejects them, unless an approved attempt is still running, in which case
+// that attempt answers the page.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
@@ -739,7 +742,9 @@ runtime.onConnect.addListener((port) => {
             const approval = pendingApprovals[id];
             if (approval) {
                 if (approval.type === "tx" || approval.type === "sign") {
-                    // It stays pending until the user answers it.
+                    // When its window closes, windows.onRemoved rejects it,
+                    // unless an approved attempt is still running, in which
+                    // case that attempt answers the page.
                     return;
                 }
                 settleApproval(id, { approved: false, remember: false });
@@ -1292,7 +1297,7 @@ async function broadcastAccountsChanged() {
             windowsRemove(approval.windowId).catch(() => {});
         }
     }
-    updateToolbarPopup();
+    resetPopupUrl();
     // An address switch ends every connection allowed without "Remember". This
     // waits on storage, so it comes after the pending approvals above, which
     // are still rejected the moment the switch arrives.
@@ -1484,44 +1489,36 @@ if (runtime.onStartup) {
 }
 startBackgroundJobs();
 
-// The toolbar popup keeps its URL when the worker stops. A worker that starts
-// holds no approvals, so the toolbar popup is pointed back at the wallet.
-updateToolbarPopup();
-
-// A transaction or signature approval stays pending when its window closes.
-// The browser can close that window when the user clicks away from it, for
-// example to copy the password from a password manager. The approval is marked
-// as closed, so the toolbar popup can open it (see updateToolbarPopup()). An
-// attempt already running when the window closes goes on and reports its
-// outcome to the page.
+// When approval window is closed without a response, treat as rejection.
+// "Without a response" is the operative part: the popup stays open across the
+// verify and broadcast it is waiting on, so a user closing an apparently-hung
+// window is an ordinary event with an attempt already in flight behind it.
+// settleApproval() refuses those, which leaves the attempt to report its real
+// outcome to the page — and the window is recorded as gone, so that an attempt
+// which then fails retryably settles instead of waiting in a window that no
+// longer exists.
 //
-// This listener rejects a site-connection or network-switch approval whose
-// window closes before its popup connected its port. Once the port is
-// connected, the approval is left to the port. That popup approves and closes
-// in the same breath, and this event races the decision on a channel of its
-// own — the same race the port exists to end. Its port disconnect says the
-// same thing this event does, in an order that is defined, so the disconnect is
-// left to say it. The window closing before any port connected is the one case
-// with nothing else to speak for it, and is rejected here so the dApp is not
-// left waiting on a window that is gone.
+// A site-connection or network-switch approval whose popup connected its port
+// is not decided here. That popup approves and closes in the same breath, and
+// this event races the decision on a channel of its own — the same race the
+// port exists to end. Its port disconnect says the same thing this event does,
+// in an order that is defined, so the disconnect is left to say it. The window
+// closing before any port connected is the one case with nothing else to speak
+// for it, and is rejected here so the dApp is not left waiting on a window that
+// is gone.
 if (windowsNs && windowsNs.onRemoved) {
     windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            if (approval.type === "tx" || approval.type === "sign") {
-                approval.windowClosed = true;
-                updateToolbarPopup();
-                continue;
-            }
-            if (approval.portConnected) continue;
-            settleApproval(
-                id,
-                abandonedResult(
-                    approval,
-                    APPROVAL_REJECTED_CODE,
-                    APPROVAL_REJECTED_MESSAGE,
-                ),
+            const decidedOnPort =
+                approval.type !== "tx" && approval.type !== "sign";
+            if (decidedOnPort && approval.portConnected) continue;
+            const rejection = abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
             );
+            if (!settleApproval(id, rejection)) approval.windowClosed = true;
         }
     });
 }
@@ -1666,9 +1663,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            // The popup waits for this answer before it closes its window.
-            sendResponse(null);
-            return false;
+            return true;
         }
 
         // The popup signs; it reports back here when it could not. Keep the
@@ -1868,8 +1863,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            sendResponse(null);
-            return false;
+            return true;
         }
 
         // The popup signs; it reports back here when it could not. Keep the

src/popup/index.js

@@ -6,7 +6,6 @@ const {
     saveState,
     onSaveFailure,
     takeStoredNetwork,
-    clearBalanceNotFetched,
     loadState,
 } = require("../shared/state");
 const { StateUnusableError } = require("../shared/stateSchema");
@@ -89,17 +88,6 @@ let refreshTimer = null;
 // removed meanwhile is left as it is. Blockscout may have answered before the
 // user turned "Use Blockscout" off. So the save drops every token the user has
 // not tracked if the stored setting is off by then.
-//
-// The save also deletes `balanceNotFetched` from each tracked token whose
-// balance this refresh read at every address. trackToken() in
-// src/popup/views/helpers.js sets that field. The save takes the field off the
-// matching tokens of the stored record (clearBalanceNotFetched() in
-// src/shared/state.js). The rest of the stored tracked token list stays as it
-// is.
-//
-// Once the save is done, the wallet list is drawn again. So are the balances
-// on AddressDetail or AddressToken when that screen is up. No other screen is
-// drawn again, DeleteAddress and its balance lines included.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
@@ -107,7 +95,7 @@ async function doRefreshAndRender() {
         await followStoredSettings();
         const networkId = state.networkId;
         const wallets = structuredClone(state.wallets);
-        const [, readTokens] = await Promise.all([
+        await Promise.all([
             refreshPrices(),
             refreshBalances(
                 wallets,
@@ -139,13 +127,10 @@ async function doRefreshAndRender() {
             if (!stored.useBlockscout) {
                 dropUntrackedTokens(state.wallets, stored.trackedTokens);
             }
-            clearBalanceNotFetched(stored, readTokens);
             state.lastBalanceRefresh = Date.now();
             return true;
         });
         renderWalletList();
-        if (state.currentView === "address") addressDetail.renderBalances();
-        if (state.currentView === "address-token") addressToken.renderBalance();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten
         // second interval, and eight views through ctx — so it must never
@@ -296,9 +281,9 @@ async function followStoredSettings() {
 // zoom it reports, 170% among them, so once the page has its new width (its
 // resize event) it is measured again, and the window widened again while the
 // page still falls short, three times at most. A window that cannot grow sends
-// no resize event, and the page stops there. An approval can also show in the
-// toolbar popup, whose window is the user's browser window; that one is left
-// alone.
+// no resize event, and the page stops there. The connection prompt can also
+// show in the toolbar popup, whose window is the user's browser window; that
+// one is left alone.
 async function widenApprovalWindow() {
     const page = document.documentElement;
     if (page.scrollWidth <= page.clientWidth) return;

src/popup/views/addToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -79,7 +72,7 @@ function init(ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, contractAddr);
-            trackToken({
+            state.trackedTokens.push({
                 address: contractAddr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/popup/views/addressDetail.js

@@ -66,27 +66,11 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
+    const usdTotal = formatAddressTotal(getAddressValue(addr));
+    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element
     ensEl.classList.add("hidden");
-    renderBalances();
-    // Only Blockscout reports the tokens the user has not tracked.
-    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
-    renderSendTokenSelect(addr);
-    $("tx-list").innerHTML =
-        '<div class="text-muted text-xs py-1">Loading...</div>';
-    showView("address");
-    loadTransactions(addr.address);
-}
-
-// The USD total and the balance list. Drawn again by each balance refresh
-// that returns while this screen is up (doRefreshAndRender() in
-// src/popup/index.js), which leaves the rest of the screen as it is.
-function renderBalances() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const usdTotal = formatAddressTotal(getAddressValue(addr));
-    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || "&nbsp;";
     $("address-balances").innerHTML = balanceLinesForAddress(
         addr,
         state.trackedTokens,
@@ -100,6 +84,13 @@ function renderBalances() {
                 ctx.showAddressToken();
             });
         });
+    // Only Blockscout reports the tokens the user has not tracked.
+    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
+    renderSendTokenSelect(addr);
+    $("tx-list").innerHTML =
+        '<div class="text-muted text-xs py-1">Loading...</div>';
+    showView("address");
+    loadTransactions(addr.address);
 }
 
 let loadedTxs = [];
@@ -296,4 +287,4 @@ function init(_ctx) {
     exportPrivkey.init();
 }
 
-module.exports = { init, show, renderBalances };
+module.exports = { init, show };

src/popup/views/addressToken.js

@@ -49,18 +49,37 @@ function show() {
     const addr = wallet.addresses[state.selectedAddress];
     const ai = state.selectedAddress;
     const tokenId = state.selectedToken;
+
+    // Determine token symbol and balance
+    let symbol, amount, price;
     const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
-    currentSymbol =
-        tokenId === "ETH"
-            ? nativeCurrency()
-            : resolveSymbol(tokenId, addr.tokenBalances, state.trackedTokens);
+    if (tokenId === "ETH") {
+        symbol = nativeCurrency();
+        amount = parseFloat(addr.balance || "0");
+        price = getPrice("ETH");
+    } else {
+        const tb = (addr.tokenBalances || []).find(
+            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
+        );
+        symbol = resolveSymbol(
+            tokenId,
+            addr.tokenBalances,
+            state.trackedTokens,
+        );
+        // null when the scale is unknown: no quantity to show, and none to
+        // price. balanceLine() states that rather than printing 0.0000.
+        amount = tb ? unknownableAmount(tb.balance) : 0;
+        price = getPrice(symbol);
+    }
+
+    currentSymbol = symbol;
 
     $("address-token-title").textContent =
         wallet.name +
         " \u2014 Address " +
         (ai + 1) +
         " \u2014 " +
-        displaySymbol(currentSymbol);
+        displaySymbol(symbol);
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -82,7 +101,13 @@ function show() {
     $("address-token-line").dataset.full = addr.address;
     attachCopyHandlers($("address-token-line"));
 
-    renderBalance();
+    // USD total for this token only
+    const usdVal = price && amount !== null ? amount * price : null;
+    const usdStr = formatUsd(usdVal);
+    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
+
+    // Single token balance line (no tokenId — not clickable here)
+    $("address-token-balance").innerHTML = balanceLine(symbol, amount, price);
 
     // Token contract details (ERC-20 only)
     const contractInfo = $("address-token-contract-info");
@@ -144,47 +169,6 @@ function show() {
     loadTransactions(addr.address, tokenId);
 }
 
-// The USD total and the balance line of the selected token. Drawn again by
-// each balance refresh that returns while this screen is up
-// (doRefreshAndRender() in src/popup/index.js), which leaves the rest of the
-// screen as it is.
-function renderBalance() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const tokenId = state.selectedToken;
-    let amount, price;
-    if (tokenId === "ETH") {
-        amount = parseFloat(addr.balance || "0");
-        price = getPrice("ETH");
-    } else {
-        const id = tokenId.toLowerCase();
-        const tb = (addr.tokenBalances || []).find(
-            (t) => t.address.toLowerCase() === id,
-        );
-        const tracked = state.trackedTokens.find(
-            (t) => t.address.toLowerCase() === id,
-        );
-        // null when the scale is unknown, or when no refresh has read the
-        // balance of a token just added: no quantity to show, and none to
-        // price. balanceLine() states that rather than printing 0.0000.
-        if (tb) amount = unknownableAmount(tb.balance);
-        else amount = tracked && tracked.balanceNotFetched ? null : 0;
-        price = getPrice(currentSymbol);
-    }
-
-    // USD total for this token only
-    const usdVal = price && amount !== null ? amount * price : null;
-    const usdStr = formatUsd(usdVal);
-    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
-
-    // Single token balance line (no tokenId — not clickable here)
-    $("address-token-balance").innerHTML = balanceLine(
-        currentSymbol,
-        amount,
-        price,
-    );
-}
-
 async function loadTransactions(address, tokenId) {
     try {
         const rawTxs = await fetchRecentTransactions(
@@ -364,4 +348,4 @@ function init(_ctx) {
     });
 }
 
-module.exports = { init, show, renderBalance };
+module.exports = { init, show };

src/popup/views/approval.js

@@ -55,7 +55,7 @@ const {
 } = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
-const { runtimeApi, sendMessage } = require("../../shared/browserApi");
+const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
 
 const erc20Iface = new Interface(ERC20_ABI);
 
@@ -1142,21 +1142,12 @@ function init(_ctx) {
         }
     });
 
-    // The window closes only once the background has the rejection. A message
-    // sent as the window closes can be lost, and a closed window does not
-    // reject the request. After Confirm, the background refuses a rejection
-    // while the transaction is being sent. The window then stays open and
-    // shows the background's message.
-    $("btn-reject-tx").addEventListener("click", async () => {
-        const response = await sendMessage({
+    $("btn-reject-tx").addEventListener("click", () => {
+        notify({
             type: "AUTISTMASK_TX_RESPONSE",
             id: approvalId,
             approved: false,
-        }).catch(() => null);
-        if (response && response.error) {
-            showError("approve-tx-error", response.error);
-            return;
-        }
+        });
         window.close();
     });
 
@@ -1279,18 +1270,12 @@ function init(_ctx) {
         if (outcome.retryable) setSignButtonBusy(false);
     });
 
-    // As for the transaction's Reject above. After Sign, the background
-    // refuses a rejection while the signature is being checked.
-    $("btn-reject-sign").addEventListener("click", async () => {
-        const response = await sendMessage({
+    $("btn-reject-sign").addEventListener("click", () => {
+        notify({
             type: "AUTISTMASK_SIGN_RESPONSE",
             id: approvalId,
             approved: false,
-        }).catch(() => null);
-        if (response && response.error) {
-            showError("approve-sign-error", response.error);
-            return;
-        }
+        });
         window.close();
     });
 }

src/popup/views/helpers.js

@@ -417,15 +417,6 @@ function balanceLine(symbol, amount, price, tokenId) {
     );
 }
 
-// Tracks `token` on the active network, as every add path on AddToken and
-// SettingsAddToken does. The tracked record carries `balanceNotFetched: true`
-// until a balance refresh has read the token's balance at every address
-// (doRefreshAndRender() in src/popup/index.js). Until then, an address with no
-// balance row for the token shows `quantity unknown` for it, not 0.0000.
-function trackToken(token) {
-    state.trackedTokens.push({ ...token, balanceNotFetched: true });
-}
-
 function balanceLinesForAddress(addr, trackedTokens, showZero) {
     let html = balanceLine(
         nativeCurrency(),
@@ -458,7 +449,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
             if (seen.has(t.address.toLowerCase())) continue;
             html += balanceLine(
                 t.symbol,
-                t.balanceNotFetched ? null : 0,
+                0,
                 getPrice(t.symbol),
                 t.address.toLowerCase(),
             );
@@ -838,7 +829,6 @@ module.exports = {
     flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
-    trackToken,
     addressHoldsFunds,
     keyMaterialName,
     unknownableAmount,

src/popup/views/settingsAddToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -50,7 +43,7 @@ function renderTop10() {
                     decimals: parseInt(btn.dataset.decimals, 10),
                     name: btn.dataset.name || btn.dataset.symbol,
                 };
-                trackToken(token);
+                state.trackedTokens.push(token);
                 await saveState();
                 showFlash("Added " + token.symbol);
                 renderTop10();
@@ -117,7 +110,7 @@ function init(_ctx) {
             decimals: parseInt(opt.dataset.decimals, 10),
             name: opt.dataset.name || opt.dataset.symbol,
         };
-        trackToken(token);
+        state.trackedTokens.push(token);
         await saveState();
         showFlash("Added " + token.symbol);
         renderTop10();
@@ -163,7 +156,7 @@ function init(_ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, addr);
-            trackToken({
+            state.trackedTokens.push({
                 address: addr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/shared/balances.js

@@ -247,11 +247,7 @@ async function fetchTokenBalances(
 // it has none. The failure is logged. A balance of zero gets no entry, as a
 // zero Blockscout reports gets none: the balance lists take a tracked token's
 // zero from the tracked list. A token whose symbol the spoof rule refuses gets
-// no entry either, as in fetchTokenBalances(), and its balance is not read.
-//
-// Resolves with `rows`, the entries, and `unread`, the tracked tokens whose
-// balance was not read, as lowercased contract addresses. A token is unread
-// when the spoof rule refuses it or its balanceOf fails.
+// no entry either, as in fetchTokenBalances().
 //
 // `signal` is as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
@@ -292,16 +288,12 @@ async function fetchTrackedTokenBalances(
     const reported = explorerRows ?? previous;
 
     const rows = [];
-    const unread = trackedTokens
-        .filter((token) => !listed.includes(token))
-        .map((token) => token.address.toLowerCase());
     listed.forEach((token, i) => {
         const lower = token.address.toLowerCase();
         const entryIn = (list) =>
             list.find((row) => String(row.address).toLowerCase() === lower);
         const raw = balances[i];
         if (raw === null) {
-            unread.push(lower);
             const kept = entryIn(previous) || entryIn(explorerRows || []);
             if (kept) rows.push(kept);
             return;
@@ -322,15 +314,12 @@ async function fetchTrackedTokenBalances(
             holders: entry ? entry.holders : null,
         });
     });
-    return { rows, unread };
+    return rows;
 }
 
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
 // `trackedTokens` are the tokens tracked on the active network. `signal` is as
 // for fetchTokenBalances().
-//
-// Resolves with the lowercased contract addresses of the tracked tokens whose
-// balance it read at every address.
 async function refreshBalances(
     wallets,
     rpcUrl,
@@ -343,8 +332,6 @@ async function refreshBalances(
     const provider = getProvider(rpcUrl, networkId);
     const tracked = trackedTokens || [];
     const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
-    // The tracked tokens whose balance was not read at some address.
-    const unread = new Set();
     const updates = [];
 
     for (const wallet of wallets) {
@@ -419,14 +406,12 @@ async function refreshBalances(
                         signal,
                     ),
                     explorerRequest,
-                ]).then(([trackedResult, explorerRows]) => {
-                    for (const lower of trackedResult.unread) unread.add(lower);
+                ]).then(([trackedRows, explorerRows]) => {
                     const untrackedRows = (explorerRows ?? previous).filter(
                         (row) =>
                             !trackedSet.has(String(row.address).toLowerCase()),
                     );
-                    addr.tokenBalances =
-                        trackedResult.rows.concat(untrackedRows);
+                    addr.tokenBalances = trackedRows.concat(untrackedRows);
                     log.debugf(
                         "Token balances",
                         addr.address,
@@ -440,7 +425,6 @@ async function refreshBalances(
 
     await Promise.all(updates);
     log.debugf("refreshBalances done");
-    return [...trackedSet].filter((lower) => !unread.has(lower));
 }
 
 // Drops the balance of each token not in `trackedTokens` from every address.

src/shared/state.js

@@ -128,9 +128,8 @@ function currentNetwork() {
 // The persisted fields as this page held them when its last loadState()
 // finished, or when its last successful saveState() began, with any network
 // switch saved elsewhere that this page has taken since (takeStoredNetwork()).
-// `baseline` also lacks any `balanceNotFetched` field that a balance refresh has
-// deleted since (clearBalanceNotFetched()). saveState() diffs the live state
-// against this to find only the fields THIS page changed since.
+// saveState() diffs the live state against this to find only the fields THIS
+// page changed since.
 //
 // Deep-cloned, not a reference: callers mutate persisted objects and arrays
 // in place (state.wallets.push(...)), and a reference baseline would mutate
@@ -614,27 +613,6 @@ function takeStoredNetwork(stored) {
     copyChainSwitchFields(baseline, structuredClone(stored));
 }
 
-// Deletes `balanceNotFetched` from each tracked token whose lowercased
-// contract address is in `addresses`. The field goes from `stored`, from
-// `state` and from `baseline` alike. `stored` is the record a save of this
-// page has just read (doRefreshAndRender() in src/popup/index.js calls this
-// from `beforeWrite`). So the deletion is not a change this page made to its
-// tracked tokens. Unless this page has changed its tracked tokens itself, the
-// save then writes the stored list with only the field gone.
-function clearBalanceNotFetched(stored, addresses) {
-    for (const list of [
-        stored.trackedTokens,
-        rawState.trackedTokens,
-        baseline.trackedTokens,
-    ]) {
-        for (const token of list) {
-            if (addresses.includes(token.address.toLowerCase())) {
-                delete token.balanceNotFetched;
-            }
-        }
-    }
-}
-
 // Rejects with StateUnusableError for a stored record this build cannot make
 // sense of. Nothing is assigned and `loaded` stays false in that case, so a
 // caller that ignores the rejection gets StateNotLoadedError on the first
@@ -681,7 +659,6 @@ module.exports = {
     saveState,
     onSaveFailure,
     takeStoredNetwork,
-    clearBalanceNotFetched,
     loadState,
     currentAddress,
     currentNetwork,

tests/addedTokenBalance.test.js

@@ -1,441 +0,0 @@
-// After "Add" on AddToken, AddressDetail lists the new token. Its line reads
-// `quantity unknown`, not 0.0000, until a balance refresh has read the token's
-// balance at every address, even if the popup closes and opens again
-// meanwhile. A token added on SettingsAddToken reads the same wherever it is
-// listed. A refresh that returns draws the balances on AddressDetail or
-// AddressToken again, so the fetched balance shows without the screen being
-// reopened (https://git.eeqj.de/sneak/AutistMask/issues/516).
-//
-// The tracked token's record carries `balanceNotFetched` until a refresh has
-// read the token's balance. Removing the token removes that record. A network
-// switch keeps each network's records apart. A refresh takes the field off the
-// stored record's tokens and keeps another page's changes to the stored list.
-//
-// Driven through the real popup over a stored profile on Ethereum Mainnet,
-// with "Show tracked tokens with zero balance" on, as it is by default.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-// Tracked by nobody until a test adds it.
-const NEW_TOKEN = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-
-// A holding of a million NEW_TOKEN, as refreshBalances() stores it.
-const MILLION = {
-    address: NEW_TOKEN,
-    name: "New Token",
-    symbol: "NEW",
-    decimals: 18,
-    balance: "1000000.0",
-    holders: 3,
-};
-
-// NEW_TOKEN as "Add" on AddToken tracks it, once a refresh has read its
-// balance.
-const NEW_TRACKED = {
-    address: NEW_TOKEN,
-    symbol: "NEW",
-    name: "New Token",
-    decimals: 18,
-};
-
-// A token that another popup page tracks.
-const OTHER_TOKEN = {
-    address: "0xCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC",
-    symbol: "OTH",
-    name: "Other Token",
-    decimals: 18,
-};
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressDetail for the one address.
-function bootOnAddress(extra) {
-    return bootPopup(
-        unversionedValidProfile({
-            currentView: "address",
-            selectedWallet: 0,
-            selectedAddress: 0,
-            ...extra,
-        }),
-    );
-}
-
-// Holds the next balance refresh open. The returned function lets it finish
-// with the address's ETH balance at 2 and `tokenBalances` as its token
-// entries, having read the balance of every token tracked when it started.
-// Given null, it finishes having read no token's balance, as when every
-// balanceOf fails, and leaves the token entries as they were.
-function holdNextRefresh(page) {
-    const { refreshBalances } = require("../src/shared/balances");
-    let release;
-    refreshBalances.mockImplementationOnce(
-        async (wallets, rpcUrl, explorerUrl, trackedTokens) => {
-            const read = trackedTokens.map((t) => t.address.toLowerCase());
-            const tokenBalances = await new Promise((resolve) => {
-                release = resolve;
-            });
-            wallets[0].addresses[0].balance = "2.0";
-            if (tokenBalances === null) return [];
-            wallets[0].addresses[0].tokenBalances = tokenBalances;
-            return read;
-        },
-    );
-    return async (tokenBalances) => {
-        release(tokenBalances);
-        await page.settle();
-    };
-}
-
-// Runs the ten-second refresh to the end, finishing it as holdNextRefresh()
-// does with `tokenBalances`.
-async function refreshOnce(page, tokenBalances) {
-    const finish = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-    await finish(tokenBalances);
-    await ticking;
-}
-
-// "+ Token", NEW_TOKEN typed in, and "Add", with the contract lookup
-// answering at once.
-async function addNewToken(page) {
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-    await page.click("btn-add-token");
-    page.node("add-token-address").value = NEW_TOKEN;
-    await page.click("btn-add-token-confirm");
-}
-
-// Settings' "+ Add token", NEW_TOKEN typed in, and "Add", with the contract
-// lookup answering at once. It ends on SettingsAddToken.
-async function addOnSettingsAddToken(page) {
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-    await page.click("btn-settings-add-token");
-    page.node("settings-addtoken-address").value = NEW_TOKEN;
-    await page.click("btn-settings-addtoken-manual");
-}
-
-// The "[x]" button Settings draws beside the first tracked token. The page
-// stub does not turn the markup Settings draws into elements. So the list
-// hands Settings a stand-in for that button each time it is drawn, and
-// `press()` presses the last one drawn. Call it before Settings opens.
-function firstRemoveButton(page) {
-    const button = { press: null };
-    page.node("settings-tracked-tokens").querySelectorAll = () => [
-        {
-            dataset: { idx: "0" },
-            addEventListener: (name, fn) => {
-                button.press = fn;
-            },
-        },
-    ];
-    return button;
-}
-
-// Picks `networkId` in the Settings network selector, as the user does.
-async function chooseNetwork(page, networkId) {
-    const select = page.node("settings-network");
-    select.value = networkId;
-    for (const fn of select.listeners.change) await fn();
-    await page.settle();
-}
-
-// Another popup page saves `trackedTokens` as the tracked token list. This
-// page is not told of the write.
-function anotherPageTracks(page, trackedTokens) {
-    page.storage.write("autistmask", {
-        ...page.storage.read("autistmask"),
-        trackedTokens,
-    });
-}
-
-// NEW_TOKEN's row in the balance list in element `id`, AddressDetail's unless
-// another is named, as markup.
-function newTokenRow(page, id = "address-balances") {
-    return page
-        .node(id)
-        .innerHTML.split("<div ")
-        .find((row) =>
-            row.includes('data-token="' + NEW_TOKEN.toLowerCase() + '"'),
-        );
-}
-
-// AddressDetail for the one address opened from Home, as its `[info]` button
-// does.
-async function openAddress(page) {
-    const { state } = require("../src/shared/state");
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressDetail").show();
-    await page.settle();
-}
-
-// AddressToken for `token` opened from AddressDetail, as tapping the token's
-// row there does.
-async function openToken(page, token) {
-    const { state } = require("../src/shared/state");
-    state.selectedToken = token;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressToken").show();
-    await page.settle();
-}
-
-test("until the refresh Add started returns, the new token's line reads quantity unknown", async () => {
-    const page = await bootOnAddress();
-    expect(page.pageErrors).toEqual([]);
-    const finish = holdNextRefresh(page);
-
-    await addNewToken(page);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-    await finish([MILLION]);
-});
-
-test("once that refresh returns, AddressDetail shows the fetched balance without being reopened", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-    // Stands for the transactions on the screen, which only show() replaces.
-    page.node("tx-list").innerHTML = "transactions on the screen";
-
-    await finish([MILLION]);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(newTokenRow(page)).toContain("1000000.0000");
-    // Only the balances are drawn again, not the transaction list.
-    expect(page.node("tx-list").innerHTML).toBe("transactions on the screen");
-});
-
-test("a refresh already running when the token is added does not count as reading its balance", async () => {
-    const page = await bootOnAddress();
-    const finishRunning = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-
-    await addNewToken(page);
-    await finishRunning([]);
-    await ticking;
-
-    expect(newTokenRow(page)).toContain("quantity unknown");
-
-    // The next one reads the token's balance, which is zero.
-    await refreshOnce(page, []);
-
-    expect(newTokenRow(page)).toContain("0.0000");
-});
-
-test("closed and opened again before any refresh has read its balance, the new token's line still reads quantity unknown", async () => {
-    const closed = await bootOnAddress();
-    holdNextRefresh(closed);
-    await addNewToken(closed);
-    cleanupPopup();
-
-    // The refresh this boot starts reads no token's balance: the boot's stub
-    // of refreshBalances() reads none.
-    const page = await bootPopup(undefined, { storage: closed.storage });
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-
-    await refreshOnce(page, [MILLION]);
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh that could not read the new token's balance leaves its line quantity unknown", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await finish(null);
-
-    // Drawn again: the ETH balance it fetched is shown.
-    expect(page.node("address-balances").innerHTML).toContain("2.0000");
-    expect(newTokenRow(page)).toContain("quantity unknown");
-});
-
-test("AddressToken for the new token reads quantity unknown until the refresh returns, then the fetched balance", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await openToken(page, NEW_TOKEN.toLowerCase());
-
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    const before = page.node("address-token-balance").innerHTML;
-    expect(before).toContain("quantity unknown");
-    expect(before).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(page.node("address-token-balance").innerHTML).toContain(
-        "1000000.0000",
-    );
-});
-
-test("a token added by contract address on SettingsAddToken reads quantity unknown until the refresh returns", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.visibleViews()).toEqual(["main"]);
-    const finish = holdNextRefresh(page);
-
-    await page.click("btn-settings");
-    await addOnSettingsAddToken(page);
-    await page.click("btn-settings-addtoken-back");
-    await page.click("btn-settings-back");
-    expect(page.visibleViews()).toEqual(["main"]);
-    const onHome = newTokenRow(page, "wallet-list");
-    expect(onHome).toContain("quantity unknown");
-    expect(onHome).not.toContain("0.0000");
-
-    await openAddress(page);
-    const onAddress = newTokenRow(page);
-    expect(onAddress).toContain("quantity unknown");
-    expect(onAddress).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh that returns while AddressToken is up draws its balance again", async () => {
-    const page = await bootPopup(
-        unversionedValidProfile({
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            selectedToken: "ETH",
-        }),
-    );
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    expect(page.node("address-token-balance").innerHTML).toContain("1.5000");
-
-    await refreshOnce(page, null);
-
-    expect(page.node("address-token-balance").innerHTML).toContain("2.0000");
-});
-
-test("a token removed before any refresh has read its balance leaves nothing stored, and adding it again tracks it once", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    const removeButton = firstRemoveButton(page);
-    const stored = () => page.storage.read("autistmask");
-
-    await page.click("btn-settings");
-    await addOnSettingsAddToken(page);
-    // Settings opened again from Home draws its list with the token in it.
-    await page.click("btn-settings-addtoken-back");
-    await page.click("btn-settings-back");
-    await page.click("btn-settings");
-    await removeButton.press();
-    await page.settle();
-
-    expect(stored().trackedTokens).toEqual([]);
-    // Nothing in the stored record names the token any more.
-    expect(JSON.stringify(stored()).toLowerCase()).not.toContain(
-        NEW_TOKEN.toLowerCase(),
-    );
-
-    await addOnSettingsAddToken(page);
-    // A second add of the same token is refused.
-    page.node("settings-addtoken-address").value = NEW_TOKEN;
-    await page.click("btn-settings-addtoken-manual");
-
-    const added = { address: NEW_TOKEN, symbol: "NEW", decimals: 18 };
-    expect(stored().trackedTokens).toEqual([
-        { ...added, name: "New Token", balanceNotFetched: true },
-    ]);
-
-    await refreshOnce(page, []);
-
-    expect(stored().trackedTokens).toEqual([{ ...added, name: "New Token" }]);
-});
-
-test("a refresh on another network leaves the new token reading quantity unknown on its own", async () => {
-    // Sepolia tracks a token at the same contract address, also just added.
-    const sepoliaToken = {
-        address: NEW_TOKEN,
-        symbol: "SEP",
-        name: "Sepolia Token",
-        decimals: 18,
-    };
-    const page = await bootOnAddress({
-        networkTrackedTokens: {
-            sepolia: [{ ...sepoliaToken, balanceNotFetched: true }],
-        },
-    });
-    const finishMainnet = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await page.click("btn-settings");
-    await chooseNetwork(page, "sepolia");
-    // The refresh Add started returns after the switch and writes nothing.
-    await finishMainnet([MILLION]);
-    // Sepolia's refresh reads the balance of its own token.
-    await refreshOnce(page, []);
-
-    const stored = page.storage.read("autistmask");
-    expect(stored.trackedTokens).toEqual([sepoliaToken]);
-    expect(stored.networkTrackedTokens.mainnet[0].balanceNotFetched).toBe(true);
-
-    await chooseNetwork(page, "mainnet");
-    await page.click("btn-settings-back");
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(newTokenRow(page)).toContain("quantity unknown");
-
-    await refreshOnce(page, [MILLION]);
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh keeps a token that another page added after this page loaded", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-    const otherAdded = { ...OTHER_TOKEN, balanceNotFetched: true };
-    anotherPageTracks(page, [
-        { ...NEW_TRACKED, balanceNotFetched: true },
-        otherAdded,
-    ]);
-
-    await finish([MILLION]);
-
-    expect(page.storage.read("autistmask").trackedTokens).toEqual([
-        NEW_TRACKED,
-        otherAdded,
-    ]);
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh does not bring back a token that another page removed after this page loaded", async () => {
-    const page = await bootOnAddress({ trackedTokens: [OTHER_TOKEN] });
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-    anotherPageTracks(page, [{ ...NEW_TRACKED, balanceNotFetched: true }]);
-
-    await finish([MILLION]);
-
-    expect(page.storage.read("autistmask").trackedTokens).toEqual([
-        NEW_TRACKED,
-    ]);
-});

tests/approvalWindow.test.js

@@ -12,7 +12,6 @@ const {
     cleanupPopup,
     settle,
     unversionedValidProfile,
-    ADDRESS,
 } = require("./support/popupBoot");
 
 afterEach(cleanupPopup);
@@ -175,136 +174,3 @@ test("a connection prompt in the toolbar popup leaves the browser window alone",
     expect(windows.updates).toEqual([]);
     expect(env.pageErrors).toEqual([]);
 });
-
-// Each row holds a transaction or signature approval as the background
-// describes it, plus the element ids of the screen that shows it. `refusal` is
-// the message the background refuses a Reject with.
-const TX_AND_SIGN_APPROVALS = [
-    {
-        kind: "transaction",
-        view: "approve-tx",
-        reject: "btn-reject-tx",
-        error: "approve-tx-error",
-        type: "AUTISTMASK_TX_RESPONSE",
-        refusal: "This transaction is already being sent.",
-        approval: {
-            type: "tx",
-            approvedFrom: ADDRESS,
-            approvedTx: {
-                chainId: 1,
-                to: ADDRESS,
-                value: "0",
-                data: "0x",
-                gasLimit: "21000",
-                maxFeePerGas: "1000000000",
-                maxPriorityFeePerGas: "1000000000",
-                nonce: 0,
-            },
-        },
-    },
-    {
-        kind: "signature",
-        view: "approve-sign",
-        reject: "btn-reject-sign",
-        error: "approve-sign-error",
-        type: "AUTISTMASK_SIGN_RESPONSE",
-        refusal: "This request is already being signed.",
-        approval: {
-            type: "sign",
-            approvedFrom: ADDRESS,
-            signParams: {
-                method: "personal_sign",
-                message: "0x48656c6c6f",
-                from: ADDRESS,
-            },
-        },
-    },
-];
-
-// A closed transaction or signature window leaves its request pending
-// (https://git.eeqj.de/sneak/AutistMask/issues/673). So Reject closes the
-// window only once the background has the rejection. A message sent as the
-// window closes can be lost, and the request would stay pending although the
-// user rejected it.
-test.each(TX_AND_SIGN_APPROVALS)(
-    "Reject on a $kind approval closes the window only once the background has answered",
-    async ({ view, reject, type, approval }) => {
-        let describeApproval = null;
-        let answerReject = null;
-        const sent = [];
-        const env = await bootPopup(unversionedValidProfile(), {
-            search: "?approval=approval-1",
-            runtime: {
-                connect: () => ({ postMessage: () => {} }),
-                sendMessage: (msg, reply) => {
-                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                        describeApproval = reply;
-                    }
-                    if (msg.type === type) {
-                        sent.push(msg);
-                        answerReject = reply;
-                    }
-                },
-            },
-        });
-        describeApproval({
-            ...approval,
-            origin: "https://dapp.example",
-            isPhishingDomain: false,
-        });
-        await settle();
-        expect(env.visibleViews()).toEqual([view]);
-        const close = jest.fn();
-        globalThis.window.close = close;
-
-        const clicked = env.click(reject);
-        await settle();
-        expect(sent).toEqual([{ type, id: "approval-1", approved: false }]);
-        expect(close).not.toHaveBeenCalled();
-
-        answerReject(null);
-        await clicked;
-        expect(close).toHaveBeenCalledTimes(1);
-        expect(env.pageErrors).toEqual([]);
-    },
-);
-
-// After Confirm or Sign, the background refuses a Reject while the transaction
-// is being sent or the signature checked. The request is not rejected then, so
-// the window stays open and shows the background's message.
-test.each(TX_AND_SIGN_APPROVALS)(
-    "Reject on a $kind approval that the background refuses shows the background's message and keeps the window open",
-    async ({ view, reject, error, type, refusal, approval }) => {
-        let describeApproval = null;
-        let answerReject = null;
-        const env = await bootPopup(unversionedValidProfile(), {
-            search: "?approval=approval-1",
-            runtime: {
-                connect: () => ({ postMessage: () => {} }),
-                sendMessage: (msg, reply) => {
-                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                        describeApproval = reply;
-                    }
-                    if (msg.type === type) answerReject = reply;
-                },
-            },
-        });
-        describeApproval({
-            ...approval,
-            origin: "https://dapp.example",
-            isPhishingDomain: false,
-        });
-        await settle();
-        const close = jest.fn();
-        globalThis.window.close = close;
-
-        const clicked = env.click(reject);
-        await settle();
-        answerReject({ error: refusal, retryable: false });
-        await clicked;
-        expect(close).not.toHaveBeenCalled();
-        expect(env.visibleViews()).toEqual([view]);
-        expect(env.text(error)).toBe(refusal);
-        expect(env.pageErrors).toEqual([]);
-    },
-);

tests/backgroundApproval.test.js

@@ -241,11 +241,10 @@ function loadBackground(options) {
     let connectListener = null;
     const created = [];
     const removed = [];
-    // Every URL the background put on the browser action. When a test gives
-    // the URL the action holds before the worker starts, that URL comes
-    // first. A site approval raised through action.openPopup() opens no
-    // window at all, so this is the only place its id appears.
-    const actionPopups = opts.toolbarPopup ? [opts.toolbarPopup] : [];
+    // Every URL the background put on the browser action. A site approval
+    // raised through action.openPopup() opens no window at all, so this is
+    // the only place its id appears.
+    const actionPopups = [];
     const openPopup = jest.fn(() => Promise.resolve());
 
     global.chrome = {
@@ -775,9 +774,10 @@ describe("one transaction approval at a time", () => {
 
     // The user closes an approval window that looks hung while the attempt
     // behind it is still running, and that attempt then fails in a way that
-    // leaves the approval standing for a retry. The toolbar popup opens it, so
-    // the user can still retry it, and answering it frees the slot.
-    test("an approval whose window closed under a failed attempt is retried from the toolbar popup, and frees the next request", async () => {
+    // would normally leave the approval standing for a retry. There is no
+    // window left to retry in, so leaving it standing answers the requesting
+    // page never — and holds the slot for the life of the worker with it.
+    test("an approval whose window closed under a failed attempt is answered, and frees the next request", async () => {
         const stalled = deferred();
         const bg = loadBackground();
 
@@ -808,28 +808,11 @@ describe("one transaction approval at a time", () => {
 
         stalled.resolve();
         await settle();
-        expect(first.result()).toBeNull();
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
-            "src/popup/index.html?approval=" + first.id(),
-        );
+        expect(first.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
 
         bg.setStateReadHook(null);
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: first.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(first.result()).toEqual({ result: "0xfeed" });
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
-            "src/popup/index.html",
-        );
-
         const second = bg.requestTx();
         await settle();
         expect(second.result()).toBeNull();
@@ -870,10 +853,8 @@ describe("one transaction approval at a time", () => {
         const first = bg.requestTx();
         await settle();
 
-        bg.send(
-            { type: "AUTISTMASK_TX_RESPONSE", id: first.id(), approved: false },
-            { url: bg.fromPopup.url },
-        );
+        // The user closes the approval window, which rejects it.
+        bg.closeWindow(1);
         await settle();
         expect(first.result()).toEqual({
             error: { code: 4001, message: "User rejected the request." },
@@ -916,7 +897,7 @@ describe("the worker keeps running while an approval is pending", () => {
         try {
             const bg = loadBackground();
             const calls = global.chrome.runtime.getPlatformInfo;
-            const pending = bg.requestTx();
+            bg.requestTx();
             await settle();
             expect(startTimer).toHaveBeenCalledTimes(1);
             expect(startTimer.mock.calls[0][1]).toBe(20000);
@@ -925,23 +906,11 @@ describe("the worker keeps running while an approval is pending", () => {
             tick();
             expect(calls).toHaveBeenCalledTimes(1);
 
-            // A closed window leaves the approval pending, so the calls go on.
+            // The user closes the approval window, which rejects it.
             bg.closeWindow(1);
             await settle();
             tick();
-            expect(calls).toHaveBeenCalledTimes(2);
-
-            bg.send(
-                {
-                    type: "AUTISTMASK_TX_RESPONSE",
-                    id: pending.id(),
-                    approved: false,
-                },
-                { url: bg.fromPopup.url },
-            );
-            await settle();
-            tick();
-            expect(calls).toHaveBeenCalledTimes(2);
+            expect(calls).toHaveBeenCalledTimes(1);
             expect(stopTimer).toHaveBeenCalledWith(1);
         } finally {
             startTimer.mockRestore();
@@ -1872,237 +1841,6 @@ describe("the interlock releases a failed attempt", () => {
     });
 });
 
-// A transaction or signature approval stays pending when its window closes.
-// The browser can close that window when the user clicks away from it, for
-// example to copy the password from a password manager. The toolbar popup then
-// opens the approval, and the user answers it there
-// (https://git.eeqj.de/sneak/AutistMask/issues/673).
-describe("a closed approval window leaves the request pending", () => {
-    // The URL the toolbar popup opens now.
-    function toolbarPopup(bg) {
-        return bg.actionPopups[bg.actionPopups.length - 1];
-    }
-
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
-    test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("Reject in the toolbar popup answers 4001, and the toolbar popup opens the wallet again", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSign();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        const reject = bg.send(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: pending.id(),
-                approved: false,
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        // The popup closes its window only once this answer arrives.
-        expect(reject.sendResponse).toHaveBeenCalledWith(null);
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("with two closed, the toolbar popup opens the older one first, then the other", async () => {
-        const bg = loadBackground();
-        const sign = bg.requestSign();
-        await settle();
-        const signId = sign.id();
-        const tx = bg.requestTx();
-        await settle();
-
-        // The signature request is in window 1 and the transaction in window
-        // 2. The newer window is closed first.
-        bg.closeWindow(2);
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + signId,
-        );
-
-        bg.send(
-            { type: "AUTISTMASK_SIGN_RESPONSE", id: signId, approved: false },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + tx.id(),
-        );
-
-        const reject = bg.send(
-            { type: "AUTISTMASK_TX_RESPONSE", id: tx.id(), approved: false },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(tx.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        expect(reject.sendResponse).toHaveBeenCalledWith(null);
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    // The user can close the window while the attempt after Confirm runs. That
-    // attempt answers the request, so meanwhile the toolbar popup opens the
-    // wallet. Opened from the toolbar, the approval would look unanswered.
-    test("when the window closes during an attempt that sends, the toolbar popup keeps opening the wallet", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        const inFlight = deferred();
-        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        inFlight.resolve({ hash: "0xfeed" });
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("when the window closes during an attempt that fails retryably, the toolbar popup opens the wallet until the attempt ends, then the approval", async () => {
-        const stalled = deferred();
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        bg.setStateReadHook(async () => {
-            await stalled.promise;
-            throw new Error("The wallet data could not be read.");
-        });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        stalled.resolve();
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        // A retry from the toolbar popup holds the approval again, so the
-        // toolbar popup opens the wallet while that retry runs.
-        bg.setStateReadHook(null);
-        const inFlight = deferred();
-        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        inFlight.resolve({ hash: "0xfeed" });
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("an address switch still rejects a closed approval", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-
-        bg.send(
-            { type: "AUTISTMASK_ACTIVE_CHANGED" },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    // The worker can stop while an approval waits with its window closed. The
-    // approval is lost with the worker, but the toolbar popup keeps its URL.
-    // The next worker points the toolbar popup back at the wallet.
-    test("a worker that starts points the toolbar popup back at the wallet", () => {
-        const bg = loadBackground({
-            toolbarPopup: "src/popup/index.html?approval=lost-approval",
-        });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-});
-
 // The claim is what makes one approval one broadcast, so it has to hold
 // against everything else that retires an approval, not just against a second
 // AUTISTMASK_TX_RESPONSE. Each of these paths used to resolve the waiting
@@ -2223,6 +1961,20 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 
     // The refusals above must not cost the rejection its ordinary meaning.
+    test("with no attempt running, closing the window still rejects", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.closeWindow(1);
+        await settle();
+
+        expect(pending.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+    });
+
     test("with no attempt running, an active-address switch still rejects and closes", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();
@@ -2832,12 +2584,15 @@ describe("a site connection decided as the popup closes", () => {
         });
     });
 
-    // That skip must not reach a tx or sign approval. The popup connects its
-    // port in show() before it knows the approval's type, and the background
-    // sets portConnected without looking at the type either, so a tx approval
-    // carries the flag too. If the window event skipped it, windowClosed would
-    // never be set, and the toolbar popup would never open the approval.
-    test("a tx window closed with the port connected is still opened by the toolbar popup", async () => {
+    // The `isSite &&` half of that skip, which is what keeps it from reaching
+    // a tx or sign approval. The popup connects its port in show() before it
+    // knows the approval's type, and the background sets portConnected without
+    // looking at the type either, so a tx approval in the fallback window
+    // carries the flag too. Without the conjunct the window event would skip
+    // it, windowClosed would never be set, releaseApproval() would never settle
+    // it, and the page would hang — the #271 regression this guard is written
+    // around.
+    test("a tx window closed with the port connected still rejects", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();
         await settle();
@@ -2845,10 +2600,9 @@ describe("a site connection decided as the popup closes", () => {
         await settle();
         bg.closeWindow(1);
         await settle();
-        expect(pending.result()).toBeNull();
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
+        expect(pending.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
     });
 });
 
@@ -3240,14 +2994,13 @@ describe("where an approval window opens", () => {
         expect(bg.created[1].left).toBeUndefined();
         expect(bg.created[1].top).toBeUndefined();
 
-        // The request waits on the second window rather than failing. Once
-        // that window closes, the toolbar popup opens the request.
+        // The request waits on the second window rather than failing:
+        // closing that window is refusing the prompt.
         expect(sign.result()).toBeNull();
         bg.closeWindow(2);
         await settle();
-        expect(sign.result()).toBeNull();
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
-            "src/popup/index.html?approval=" + sign.id(),
-        );
+        expect(sign.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
     });
 });

tests/balanceRefreshNetworkSwitch.test.js

@@ -41,7 +41,6 @@ async function holdRefresh(page) {
                 holders: null,
             },
         ];
-        return [];
     });
     const ticking = page.tick();
     await page.settle();

tests/blockscoutEtherscanSettings.test.js

@@ -720,7 +720,6 @@ describe("the popup", () => {
                 tokenRow(TRACKED, "TRK"),
                 tokenRow(UNTRACKED, "TST"),
             ];
-            return [];
         });
         const ticking = page.tick();
         await page.settle();
@@ -765,7 +764,6 @@ describe("the popup", () => {
                 addr.tokenBalances = after
                     ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
                     : [tokenRow(TRACKED, "TRK")];
-                return [];
             });
 
             anotherPageSaves(page, { useBlockscout: after });

tests/e2e/firefox/run.js

@@ -1035,14 +1035,11 @@ step(
     },
 );
 
-// A closed approval window leaves its request pending, and the toolbar button
-// opens it (https://git.eeqj.de/sneak/AutistMask/issues/673). WebDriver cannot
-// see the toolbar popup, so its page is opened in a tab, at the URL the
-// extension put on the button.
 step(
-    "a closed approval window leaves the request pending until it is rejected",
+    "closing an approval window rejects the request with 4001",
     async (env) => {
         const d = env.driver;
+        const before = env.server.broadcast.length;
 
         await d.switchToWindow(env.dappWindow);
         await startRequest(d, "sign-closed", "personal_sign", [
@@ -1056,45 +1053,15 @@ step(
 
         // Closed, not rejected: this is the windows.onRemoved path, which can
         // only fire if windows.create() handed back a window id for the
-        // approval to be matched against. Without that id the toolbar button
-        // never opens the approval, and this step fails.
+        // approval to be matched against — call site 4 in the issue, and the
+        // reason suppressing that write-back turns this step red.
         await d.closeWindow(env.dappWindow);
-        const outcome = await settleRequest(d, "sign-closed", 2000);
+
+        await assertUserRejection(d, "sign-closed", "a closed approval window");
         assert(
-            outcome.settled === "pending",
-            "closing the approval window answered the page: " +
-                JSON.stringify(outcome),
+            env.server.broadcast.length === before,
+            "a closed approval window still put a transaction on the node",
         );
-
-        await d.switchToWindow(env.popupWindow);
-        const url = await d.executeAsync(
-            `const done = arguments[arguments.length - 1];
-             browser.browserAction.getPopup({}).then(done, (e) => done(String(e)));`,
-        );
-        assert(
-            url.includes("?approval="),
-            "the toolbar button does not open the pending approval: " + url,
-        );
-        const reopened = await d.newWindow("tab");
-        await d.switchToWindow(reopened);
-        await d.navigate(url);
-        await d.waitVisible("#view-approve-sign");
-        await d.click("#btn-reject-sign");
-
-        await d.switchToWindow(env.dappWindow);
-        await assertUserRejection(
-            d,
-            "sign-closed",
-            "the signature request rejected from the toolbar button",
-        );
-
-        // A page may close only a window a script opened, so the tab can
-        // still be open.
-        const left = await d.findWindow((u) => u.includes("?approval="));
-        if (left) {
-            await d.switchToWindow(left);
-            await d.closeWindow(env.dappWindow);
-        }
     },
 );
 

tests/e2e/run.js

@@ -969,8 +969,7 @@ test("a token added by its contract address is listed on the address screen (#15
     await visible(env.page, "#view-address");
 
     // No wait: the confirm renders the balance list before it shows the
-    // screen. The refresh it starts draws the list again, with the row still
-    // in it.
+    // screen, and nothing renders the list again while the screen is up.
     const row = env.page.locator(
         '#address-balances [data-token="' + STUB_TOKEN.address + '"]',
         { hasText: STUB_TOKEN.symbol },
@@ -4111,12 +4110,11 @@ async function waitForApprovalWindow(ctx, timeout = 30000) {
 // reservation exists.
 // How long the tab creation above is given to take effect before the request
 // that raises the next prompt is issued. Dismissing a browser-action popup
-// disconnects its port, and src/background/index.js calls
-// updateToolbarPopup() on that disconnect; issued too early, the next
-// request's setPopup() is undone by the previous popup's teardown,
-// chrome.action.openPopup() then rejects, and the fallback window it opens
-// dismisses the popup that was just raised — which settles the fresh approval
-// as a rejection before it can be seen.
+// disconnects its port, and src/background/index.js calls resetPopupUrl() on
+// that disconnect; issued too early, the next request's setPopup() is undone
+// by the previous popup's teardown, chrome.action.openPopup() then rejects,
+// and the fallback window it opens dismisses the popup that was just raised —
+// which settles the fresh approval as a rejection before it can be seen.
 // Every one of those steps was observed. 1.5s is comfortably past it.
 const APPROVAL_TAB_SETTLE_MS = 1500;
 
@@ -4142,17 +4140,6 @@ async function reserveApprovalTab(env) {
     return env.approvalTab;
 }
 
-// The URL the extension has put on the action: the page the toolbar button
-// opens.
-function toolbarPopupUrl(env) {
-    return env.page.evaluate(
-        () =>
-            new Promise((resolve) => {
-                chrome.action.getPopup({}, (u) => resolve(String(u)));
-            }),
-    );
-}
-
 // The site-connection prompt: the window the extension opened if it managed
 // to open one, and the reserved tab at the action's approval URL otherwise.
 async function openSiteApprovalPopup(env, timeout = 30000) {
@@ -4163,7 +4150,12 @@ async function openSiteApprovalPopup(env, timeout = 30000) {
             .find((p) => !p.isClosed() && p.url().includes("?approval="));
         if (existing) return existing;
 
-        const url = await toolbarPopupUrl(env);
+        const url = await env.page.evaluate(
+            () =>
+                new Promise((resolve) => {
+                    chrome.action.getPopup({}, (u) => resolve(String(u)));
+                }),
+        );
         if (url.includes("?approval=")) {
             await env.approvalTab.goto(url);
             return env.approvalTab;
@@ -5035,116 +5027,6 @@ test("eth_sendTransaction rejected broadcasts nothing (#183)", async (env) => {
     );
 });
 
-// A transaction or signature approval stays pending when its window closes.
-// The browser can close that window when the user clicks away from it, for
-// example to copy the password from a password manager. The toolbar button then
-// opens the approval, and the user answers it there
-// (https://git.eeqj.de/sneak/AutistMask/issues/673).
-//
-// This closes the approval window of request `key` and checks that the page
-// has no answer. It then opens the approval again from the toolbar button.
-// Playwright cannot click that button, so its page is opened in a tab, at the
-// URL the extension put on the button.
-async function closeAndReopen(env, key, view) {
-    const approvalWindow = await waitForApprovalWindow(env.ctx);
-    await visible(approvalWindow, view);
-    await approvalWindow.close();
-
-    const outcome = await settleRequest(env.dapp, key, 2000);
-    assert(
-        outcome.settled === "pending",
-        "closing the approval window answered the page: " +
-            JSON.stringify(outcome),
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        url.includes("?approval="),
-        "the toolbar button does not open the pending approval: " + url,
-    );
-    const reopened = await env.ctx.newPage();
-    await reopened.goto(url);
-    await visible(reopened, view);
-    return reopened;
-}
-
-// The stub node answers every nonce request with 0, and the wallet refuses a
-// nonce it has already broadcast. A run can therefore approve one dApp
-// transaction only, so here the signature is approved and the transaction
-// rejected.
-test("a closed signature approval is signed from the toolbar button (#673)", async (env) => {
-    await startRequest(env.dapp, "sign-closed", "personal_sign", [
-        SIGN_HEX,
-        env.expectedAddress,
-    ]);
-    const popup = await closeAndReopen(
-        env,
-        "sign-closed",
-        "#view-approve-sign",
-    );
-    let outcome;
-    try {
-        await popup.fill("#approve-sign-password", PASSWORD);
-        await clickAndClose(popup, "#btn-approve-sign");
-        outcome = await settleRequest(env.dapp, "sign-closed");
-    } finally {
-        await closeApprovalPages(env.ctx);
-    }
-    assert(
-        outcome.settled === "resolved",
-        "personal_sign did not resolve: " + JSON.stringify(outcome),
-    );
-    const recovered = getAddress(
-        verifyMessage(getBytes(SIGN_HEX), outcome.result),
-    );
-    assert(
-        recovered === env.expectedAddress,
-        "the personal_sign signature recovers to " +
-            recovered +
-            ", not to the approved address " +
-            env.expectedAddress,
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        !url.includes("?approval="),
-        "the toolbar button still opens the answered approval: " + url,
-    );
-});
-
-test("a closed transaction approval is rejected from the toolbar button (#673)", async (env) => {
-    const before = env.routeOpts.broadcastTransactions.length;
-    await startRequest(env.dapp, "tx-closed", "eth_sendTransaction", [
-        {
-            from: env.expectedAddress,
-            to: STUB_COUNTERPARTY,
-            value: toQuantity(TX_VALUE_WEI),
-            data: TX_DATA,
-        },
-    ]);
-    const popup = await closeAndReopen(env, "tx-closed", "#view-approve-tx");
-    try {
-        await clickAndClose(popup, "#btn-reject-tx");
-        await assertUserRejection(
-            env.dapp,
-            "tx-closed",
-            "the transaction rejected from the toolbar button",
-        );
-    } finally {
-        await closeApprovalPages(env.ctx);
-    }
-    assert(
-        env.routeOpts.broadcastTransactions.length === before,
-        "a rejected transaction still reached the RPC",
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        !url.includes("?approval="),
-        "the toolbar button still opens the answered approval: " + url,
-    );
-});
-
 // The extension used to centre every approval window on the last focused
 // window. Centred on another approval window, the new one landed where the
 // browser refused to create it, and the request failed with no window at all
@@ -5188,8 +5070,8 @@ test("a prompt raised while another approval window has focus opens its own (#29
     });
     await visible(txWindow, "#view-approve-tx");
 
-    await clickAndClose(txWindow, "#btn-reject-tx");
-    await clickAndClose(signWindow, "#btn-reject-sign");
+    // Closing a window is refusing its prompt, so both answer 4001.
+    await closeApprovalPages(env.ctx);
     await assertUserRejection(env.dapp, "focus-tx", "the transaction prompt");
     await assertUserRejection(env.dapp, "focus-sign", "the sign prompt");
 });
@@ -5796,11 +5678,9 @@ async function main() {
         // for the new one. After a test that passed, its windows get five
         // seconds to close, and one still open then fails the test: it should
         // have closed itself, and closing it here unreported would hide that.
-        // After a test that already failed, they are closed unreported. That
-        // rejects a site-connection or network-switch prompt it left
-        // unanswered, so the prompt does not refuse the next one from its
-        // site. A transaction or signature approval stays pending, and can
-        // fail the tests after it.
+        // After a test that already failed, they are closed unreported, so
+        // that a prompt it left unanswered does not refuse the next one from
+        // its site.
         if (!failure) {
             const deadline = Date.now() + 5000;
             let open;

tests/firstWalletRefresh.test.js

@@ -48,7 +48,6 @@ async function boot(stored) {
         for (const wallet of wallets) {
             for (const addr of wallet.addresses) addr.balance = chainBalance;
         }
-        return [];
     });
     return { page, refreshBalances };
 }

tests/flashLine.test.js

@@ -88,7 +88,6 @@ describe.each([
             showFlash: (msg) => flashes.push(msg),
             escapeHtml: (s) => s,
             goBack: () => {},
-            trackToken: () => {},
         }));
 
         require("../src/popup/views/" + view).init({

tests/manifest.test.js

@@ -169,7 +169,7 @@ describe("declared icons", () => {
 // save could land between the background's read and its write (README,
 // "Stored state and its version").
 describe("private windows", () => {
-    test("a page in a firefox private window cannot read or write extension storage", () => {
+    test("firefox never runs AutistMask in a private window", () => {
         expect(readManifest("firefox").incognito).toBe("not_allowed");
     });
 });

tests/support/popupBoot.js

@@ -279,11 +279,10 @@ async function bootPopup(stored, options) {
         getAddressValue: () => ({ usd: null, partial: false }),
     }));
     // scanForAddresses() answers in the real one's shape, a scan that found
-    // no used address: AddWallet reads `addresses` from it. refreshBalances()
-    // answers as a refresh that read no tracked token's balance.
+    // no used address: AddWallet reads `addresses` from it.
     jest.doMock("../../src/shared/balances", () => ({
         fetchTokenBalances: jest.fn(async () => []),
-        refreshBalances: jest.fn(async () => []),
+        refreshBalances: jest.fn(async () => {}),
         dropUntrackedTokens: jest.requireActual("../../src/shared/balances")
             .dropUntrackedTokens,
         lookupTokenInfo: jest.fn(async () => null),

tests/trackedTokenBalances.test.js

@@ -307,31 +307,3 @@ test("a tracked token wearing a known symbol from another contract is not listed
     );
     expect(first.tokenBalances).toEqual([]);
 });
-
-test("the refresh resolves with each tracked token whose balance it read at every address", async () => {
-    const flaky = "0x9999999999999999999999999999999999999999";
-    holdings[TOKEN] = { [FIRST]: 2000000n, [SECOND]: 0n };
-    // balanceOf answers at FIRST and fails at SECOND.
-    holdings[flaky] = { [FIRST]: 2000000n };
-    const read = await refreshBalances(
-        [
-            {
-                addresses: [
-                    { address: FIRST, tokenBalances: [] },
-                    { address: SECOND, tokenBalances: [] },
-                ],
-            },
-        ],
-        RPC_URL,
-        EXPLORER_URL,
-        [
-            TRACKED,
-            { address: flaky, symbol: "FLK", name: "Flaky", decimals: 6 },
-            // A known symbol from another contract: its balance is not read.
-            { address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 },
-        ],
-        "mainnet",
-        new AbortController().signal,
-    );
-    expect(read).toEqual([TOKEN]);
-});

tests/trackedTokensPerNetwork.test.js

@@ -159,9 +159,7 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
         "sepolia",
         expect.anything(),
     );
-    // No refresh has read the new token's balance yet.
-    const added = { ...SEPOLIA_TOKEN, balanceNotFetched: true };
-    expect(stored().trackedTokens).toEqual([added]);
+    expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
 
     await boot.click("btn-settings");
     await chooseNetwork(boot, "mainnet");
@@ -173,7 +171,7 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
 
     await chooseNetwork(boot, "sepolia");
     expect(stored().networkId).toBe("sepolia");
-    expect(stored().trackedTokens).toEqual([added]);
+    expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
     const onSepolia = boot.node("settings-tracked-tokens").innerHTML;
     expect(onSepolia).toContain("TST");
     expect(onSepolia).not.toContain("DAI");