fix: a slow answer to an approval still reaches the site (closes #540)

Chrome stopped the background worker about six minutes after a site's
request even with the approval window open, and the approval and the
site's waiting request went with it. While any approval is pending, the
worker now calls runtime.getPlatformInfo() every 20 seconds; Chrome
counts each extension call as activity. The timer is the worker's own,
so a minimized window does not slow it, and it stops itself once nothing
is pending.

tests/e2e/slowApproval.js, run by make test-e2e, leaves a transaction
and a signature approval open for seven minutes in minimized windows and
requires the site to receive both results. It drives Chromium over the
DevTools pipe without Playwright, because Playwright keeps DevTools
attached to the worker and Chrome then never stops it.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -35,10 +35,10 @@ on: [push]
 jobs:
     e2e-chrome:
         runs-on: ubuntu-latest
-        # Bounds the image build, a cold cache included, and both Chrome
+        # Bounds the image build, a cold cache included, and the three Chrome
         # programs, so a hung browser frees the shared runner. README.md
         # "In CI" has the measured times.
-        timeout-minutes: 20
+        timeout-minutes: 40
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

README.md

@@ -479,9 +479,6 @@ papered over:
   forced by clicking Reveal and the settings gear in one page task, which a
   person cannot do; the case a person can hit, the first decrypt after the popup
   opens while libsodium is still loading, is not driven.
-- Approval windows open at 1280x720 whatever size the extension asks for, so
-  whether an approval screen fits its window is checked in the Firefox suite
-  only.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -545,6 +542,29 @@ one profile yields a single extension id, not two: Chrome does not load a second
 copy of an id it already has. The assertions are annotated as observations, so a
 Chrome that ever changes this fails the run instead of passing it.
 
+Last, `make test-e2e` runs `tests/e2e/slowApproval.js`, which leaves a
+transaction approval and a signature approval open for seven minutes with both
+windows minimized, then restores and approves both and requires the site to
+receive the hash of the transaction the stub node received and a signature that
+recovers to the address. Before the background worker kept itself running while
+an approval is pending, Chrome stopped it about six minutes in and neither
+request was ever answered
+([#540](https://git.eeqj.de/sneak/AutistMask/issues/540)). The windows are
+minimized through the DevTools protocol (`Browser.setWindowBounds`), and the run
+fails unless both pages then report themselves hidden: Chrome slows a hidden
+page's timers to once a minute, so anything the window did to keep the worker
+running would fail here. It is its own program and does not use Playwright:
+Playwright keeps DevTools attached to the background worker, and Chrome never
+stops a worker DevTools is attached to, so no wait in the suite above can show
+the worker stopping. It starts Chromium itself, speaks the DevTools protocol
+over `--remote-debugging-pipe`, and attaches to pages only. Before raising the
+approvals it requires the worker to stop on its own with nothing pending, so a
+run in which something else keeps the worker running fails. The site is
+connected and the RPC endpoint set through the extension's own screens, against
+the Firefox suite's loopback dApp page and stub node
+(`tests/e2e/firefox/dapp.js`). Unlike the suite above, it does not fail on page
+errors.
+
 ### Firefox (`make test-e2e-firefox`)
 
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
@@ -554,8 +574,7 @@ suite), wallet creation through the UI, the Add Token screen, and the dApp round
 trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
 rejected and then approved, `eth_sendTransaction`, and a closed approval window
 rejecting with EIP-1193 4001 — driven through the real content script,
-background page and approval windows. The `personal_sign` prompt is also
-required to fit its window without scrolling sideways.
+background page and approval windows.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -726,11 +745,13 @@ installing Firefox, geckodriver and their system libraries. Both scripts now
 build their image with `--no-cache`, so every run pays the cold figure. Those
 `e2e-chrome` runs predate the cases that wait in real time for a receipt to end
 in error. `make test-e2e` took 3m51s locally with its image cached, so with the
-image rebuilt every run, an `e2e-chrome` run comes to about seven minutes.
+image rebuilt every run, an `e2e-chrome` run comes to about seven minutes. The
+approvals left open for seven minutes (`tests/e2e/slowApproval.js`) add about
+eight more, so about fifteen.
 
 Each e2e job has a `timeout-minutes` cap, so a hung build or browser ends the
 job instead of holding the shared runner: `e2e-firefox` 15 minutes and
-`e2e-chrome` 20, each over two and a half times the job's slowest cold run. A
+`e2e-chrome` 40, each over two and a half times the job's slowest cold run. A
 job that reaches its cap has hung; read it as a hang, not as a slow run to
 retry. The `check` job has no cap: `.gitea/workflows/check.yml` is the canonical
 copy from `sneak/prompts`, kept byte-identical.
@@ -825,6 +846,20 @@ on the next event. Two consequences shape every recurring job in the background:
   service worker at all — the one remaining user of it, `src/shared/ens.js`,
   runs only in the popup and is marked as such.
 
+Pending approvals are the exception: an approval waiting for the user, and the
+site's request waiting on it, live only in the worker's memory, and only the
+worker that received the request can answer it. Left alone, Chrome stopped the
+worker about six minutes after a site's request even with the approval window
+still open, and the user's answer then reached nobody. So the worker keeps
+itself running while any approval is pending: raising an approval starts a
+`setInterval` that calls `runtime.getPlatformInfo()` every 20 seconds, and
+Chrome counts each extension call as activity. The timer stops itself once
+nothing is pending, and the worker then stops as it otherwise would. The timer
+is the worker's own, so it does not depend on the approval window being visible;
+a timer in the window would, because Chrome slows a hidden page's timers to once
+a minute. A worker that stops for another reason, a crash say, still loses the
+approvals open in it.
+
 The job also carries a freshness guard, and a guard must never be timed to the
 alarm period it gates. The guard is measured from the moment the last run
 finished, which is one run-duration after the alarm that started it, so a guard
@@ -912,13 +947,8 @@ discoverable.
   enough that vanilla JS with simple view switching is sufficient. A framework
   would add bundle size, build complexity, and attack surface for no benefit at
   this scale.
-- **396x600 popup**: The page is 396 pixels wide (`body` in
-  `src/popup/styles/main.css`), and 600 pixels is as tall as the browser lets
-  the toolbar popup grow. The UI is designed for this fixed viewport. The window
-  an approval opens in is given the same size. The browser counts the window's
-  frame in that width, and a screen taller than the window gives some of it to a
-  vertical scrollbar, so once the approval's screen is up the page widens its
-  window by however far it would scroll sideways, scaled by the browser's zoom.
+- **360x600 popup**: Standard browser extension popup dimensions. The UI is
+  designed for this fixed viewport.
 
 #### No Layout Shift
 

script/test-e2e

@@ -97,6 +97,18 @@ main() {
         -e HOME=/tmp \
         "$(cat "$IIDFILE")" \
         node tests/e2e/storagePartition.js
+
+    # Approvals left open for seven minutes in minimized windows, past the
+    # point where Chrome stopped the background worker when nothing kept it
+    # running. Its own program, without Playwright: Playwright keeps DevTools
+    # attached to the worker, and Chrome never stops a worker DevTools is
+    # attached to. It reaches nothing but its own loopback server.
+    echo "Running the approvals left open for seven minutes..."
+    docker run --rm \
+        --ipc=host \
+        -e HOME=/tmp \
+        "$(cat "$IIDFILE")" \
+        node tests/e2e/slowApproval.js
 }
 
 main "$@"

src/background/index.js

@@ -44,6 +44,7 @@ const {
 
 const {
     actionApi,
+    getPlatformInfo,
     runtimeApi,
     tabsQuery,
     tabsSendMessage,
@@ -67,6 +68,29 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, resolve } }
 const pendingApprovals = {};
 
+// An approval, and the site's request waiting on it, exist only in this
+// worker's memory. Left alone, Chrome stopped the worker about six minutes
+// after the site's request while the user was still deciding, and the approval
+// was lost with it. Chrome counts an extension call as activity, so while any
+// approval is pending this worker makes one every 20 seconds, inside Chrome's
+// 30-second idle limit. Each function below that raises an approval starts the
+// timer, and it stops itself once nothing is pending. It is the worker's own
+// timer, so it runs whether or not the approval window is visible.
+let keepRunningTimer = null;
+
+function keepRunningWhileApprovalsPending() {
+    if (keepRunningTimer) return;
+    keepRunningTimer = setInterval(() => {
+        if (Object.keys(pendingApprovals).length === 0) {
+            clearInterval(keepRunningTimer);
+            keepRunningTimer = null;
+            return;
+        }
+        // Only the call matters; its answer is not used.
+        getPlatformInfo().catch(() => {});
+    }, 20000);
+}
+
 // One transaction approval at a time, wallet-wide.
 //
 // The transaction a site asks for is populated before its approval window
@@ -423,10 +447,7 @@ function releaseApproval(approval) {
 // the result on the floor, so a rejection here would be unhandled.
 async function openApprovalWindow(id) {
     const popupUrl = runtime.getURL("src/popup/index.html?approval=" + id);
-    // As wide as the page: body in src/popup/styles/main.css. The browser
-    // counts the window's frame in this width; the page itself adds back
-    // whatever the frame takes (src/popup/index.js).
-    const popupWidth = 396;
+    const popupWidth = 360;
     const popupHeight = 600;
 
     let currentWin = null;
@@ -446,7 +467,7 @@ async function openApprovalWindow(id) {
     // Centred on a browser window only. The last focused window can be
     // another approval window still open, and centring on one can give a
     // position the browser refuses ("Bounds must be at least 50% within
-    // visible screen space"): headless Chrome reports this 396x600 popup as
+    // visible screen space"): headless Chrome reports this 360x600 popup as
     // 1280x720. The request then failed with no window at all. Over a popup,
     // the browser picks the position.
     if (currentWin && currentWin.type === "normal") {
@@ -518,6 +539,7 @@ function requestApproval(origin) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = { id, origin, resolve, type: "site" };
+        keepRunningWhileApprovalsPending();
 
         if (actionNs && typeof actionNs.openPopup === "function") {
             showInToolbarPopup(id);
@@ -569,6 +591,7 @@ function requestTxApproval(origin, approvedTx, approvedFrom, slot) {
             type: "tx",
         };
         if (slot) slot.approvalId = id;
+        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });
@@ -589,6 +612,7 @@ function requestSignApproval(origin, signParams, approvedFrom) {
             resolve,
             type: "sign",
         };
+        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });
@@ -609,6 +633,7 @@ function requestNetworkApproval(origin, currentNetworkId, requestedNetworkId) {
             resolve,
             type: "network",
         };
+        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });

src/popup/index.js

@@ -21,11 +21,6 @@ const {
     goBack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-const {
-    tabsGetZoom,
-    windowsGetCurrent,
-    windowsUpdate,
-} = require("../shared/browserApi");
 // Renders a view the popup lands on without having navigated to it forward:
 // on restore here, and on Back. Only the views that can be fully re-rendered
 // from persisted state (RESTORABLE_VIEWS, src/shared/restorableViews.js) go
@@ -168,27 +163,6 @@ function fallbackView() {
     showView("main");
 }
 
-// The background opens the approval window as wide as the page, but the
-// browser counts the window's frame in that width, and a screen taller than
-// the window takes a vertical scrollbar out of it too. So once the screen is
-// up, the window is widened by however far the page would scroll sideways.
-// That distance is in page pixels and the window's width in screen pixels:
-// at 150% zoom one page pixel is 1.5 screen pixels. The connection prompt can
-// also show in the toolbar popup, whose window is the user's browser window;
-// that one is left alone.
-async function widenApprovalWindow() {
-    const sideways =
-        document.documentElement.scrollWidth -
-        document.documentElement.clientWidth;
-    if (sideways <= 0) return;
-    const win = await windowsGetCurrent();
-    if (win.type !== "popup") return;
-    const zoom = await tabsGetZoom();
-    await windowsUpdate(win.id, {
-        width: win.width + Math.ceil(sideways * zoom),
-    });
-}
-
 async function init() {
     // First, before anything can save: showView() saves on every navigation
     // without awaiting, so a save that fails from here on has somewhere to be
@@ -265,8 +239,8 @@ async function init() {
         // the run on both harnesses (Playwright `pageerror`, and the Firefox
         // driver's console-service drain), so nothing is lost by leaving it
         // on that path. show() puts the approval's own screen up once the
-        // background has described it; the window is widened to fit it then.
-        approval.show(approvalId).then(widenApprovalWindow);
+        // background has described it.
+        approval.show(approvalId);
         return;
     }
 

src/shared/browserApi.js

@@ -145,6 +145,14 @@ function sendMessage(message) {
     return invoke(runtimeApi(), "sendMessage", message);
 }
 
+/**
+ * @returns {Promise<Object>} the operating system and processor the browser
+ *     runs on.
+ */
+function getPlatformInfo() {
+    return invoke(runtimeApi(), "getPlatformInfo");
+}
+
 /**
  * Send a message nobody is expected to answer, and swallow the fact that
  * nobody did.
@@ -235,14 +243,6 @@ function tabsSendMessage(tabId, message) {
     return invoke(tabsApi(), "sendMessage", tabId, message);
 }
 
-/**
- * @returns {Promise<number>} the zoom of the active tab in the calling page's
- *     window: 1.5 at 150%.
- */
-function tabsGetZoom() {
-    return invoke(tabsApi(), "getZoom");
-}
-
 /**
  * @param {Object} createData
  * @returns {Promise<Object>} the created window.
@@ -258,22 +258,6 @@ function windowsGetLastFocused() {
     return invoke(windowsApi(), "getLastFocused");
 }
 
-/**
- * @returns {Promise<Object>} the window the calling page is in.
- */
-function windowsGetCurrent() {
-    return invoke(windowsApi(), "getCurrent");
-}
-
-/**
- * @param {number} windowId
- * @param {Object} updateInfo
- * @returns {Promise<Object>} the updated window.
- */
-function windowsUpdate(windowId, updateInfo) {
-    return invoke(windowsApi(), "update", windowId, updateInfo);
-}
-
 /**
  * @param {number} windowId
  * @returns {Promise<void>}
@@ -286,6 +270,7 @@ module.exports = {
     actionApi,
     alarmsApi,
     extensionApi,
+    getPlatformInfo,
     hasBrowserNamespace,
     notify,
     runtimeApi,
@@ -295,13 +280,10 @@ module.exports = {
     storageRemove,
     storageSet,
     tabsApi,
-    tabsGetZoom,
     tabsQuery,
     tabsSendMessage,
     windowsApi,
     windowsCreate,
-    windowsGetCurrent,
     windowsGetLastFocused,
     windowsRemove,
-    windowsUpdate,
 };

tests/approvalWindow.test.js

@@ -45,77 +45,3 @@ test("the approval window shows no screen until the background describes the app
     expect(env.visibleViews()).toEqual(["approve-network"]);
     expect(env.pageErrors).toEqual([]);
 });
-
-// The background opens the approval window as wide as the page, but the
-// browser counts the window's frame in that width, and a screen taller than
-// the window takes a vertical scrollbar out of it too
-// (https://git.eeqj.de/sneak/AutistMask/issues/518). The browser suites run
-// without frames and at 100% zoom, so the widening is checked here.
-function windowsStub(type) {
-    const updates = [];
-    return {
-        updates,
-        getCurrent: (done) => done({ id: 7, type, width: 396 }),
-        update: (id, info, done) => {
-            updates.push({ id, info });
-            done({});
-        },
-    };
-}
-
-// An approval window at 150% zoom, whose background holds its answer until
-// the test gives it.
-async function bootZoomedApprovalWindow(windows) {
-    let answer = null;
-    const env = await bootPopup(unversionedValidProfile(), {
-        search: "?approval=approval-1",
-        runtime: {
-            connect: () => ({ postMessage: () => {} }),
-            sendMessage: (msg, reply) => {
-                if (msg.type === "AUTISTMASK_GET_APPROVAL") answer = reply;
-            },
-        },
-        windows,
-        tabs: { getZoom: (done) => done(1.5) },
-        // At 150% a window 396 screen pixels wide shows 264 page pixels.
-        documentElement: { scrollWidth: 396, clientWidth: 264 },
-    });
-    return { env, answer };
-}
-
-test("at 150% zoom the approval window widens by what its screen lacks, scrollbar included", async () => {
-    const windows = windowsStub("popup");
-    const { env, answer } = await bootZoomedApprovalWindow(windows);
-
-    // Not before there is a screen to fit.
-    expect(windows.updates).toEqual([]);
-
-    // The screen is taller than the window, so once it is up a vertical
-    // scrollbar takes 15 screen pixels, 10 page pixels at 150%.
-    env.document.documentElement.clientWidth = 254;
-    answer({
-        type: "network",
-        origin: "https://dapp.example",
-        currentNetworkId: "mainnet",
-        requestedNetworkId: "sepolia",
-        isPhishingDomain: false,
-    });
-    await settle();
-
-    // 396 - 254 = 142 page pixels short, which at 150% is 213 screen pixels.
-    expect(env.visibleViews()).toEqual(["approve-network"]);
-    expect(windows.updates).toEqual([{ id: 7, info: { width: 609 } }]);
-    expect(env.pageErrors).toEqual([]);
-});
-
-test("a connection prompt in the toolbar popup leaves the browser window alone", async () => {
-    const windows = windowsStub("normal");
-    const { env, answer } = await bootZoomedApprovalWindow(windows);
-
-    answer({ origin: "https://dapp.example", isPhishingDomain: false });
-    await settle();
-
-    expect(env.visibleViews()).toEqual(["approve-site"]);
-    expect(windows.updates).toEqual([]);
-    expect(env.pageErrors).toEqual([]);
-});

tests/backgroundApproval.test.js

@@ -264,6 +264,7 @@ function loadBackground(options) {
                     connectListener = fn;
                 },
             },
+            getPlatformInfo: jest.fn((cb) => cb({ os: "linux" })),
             lastError: null,
         },
         windows: {
@@ -878,6 +879,43 @@ describe("one transaction approval at a time", () => {
     });
 });
 
+// Chrome stops an idle worker, and the approvals in it go with it
+// (https://git.eeqj.de/sneak/AutistMask/issues/540). tests/e2e/slowApproval.js
+// shows the worker kept running in Chrome; this shows the calls stop once the
+// approval is answered, so the worker can stop again.
+describe("the worker keeps running while an approval is pending", () => {
+    test("an extension call every 20 seconds until the approval is answered", async () => {
+        const startTimer = jest
+            .spyOn(global, "setInterval")
+            .mockImplementation(() => 1);
+        const stopTimer = jest
+            .spyOn(global, "clearInterval")
+            .mockImplementation(() => {});
+        try {
+            const bg = loadBackground();
+            const calls = global.chrome.runtime.getPlatformInfo;
+            bg.requestTx();
+            await settle();
+            expect(startTimer).toHaveBeenCalledTimes(1);
+            expect(startTimer.mock.calls[0][1]).toBe(20000);
+            const tick = startTimer.mock.calls[0][0];
+
+            tick();
+            expect(calls).toHaveBeenCalledTimes(1);
+
+            // The user closes the approval window, which rejects it.
+            bg.closeWindow(1);
+            await settle();
+            tick();
+            expect(calls).toHaveBeenCalledTimes(1);
+            expect(stopTimer).toHaveBeenCalledWith(1);
+        } finally {
+            startTimer.mockRestore();
+            stopTimer.mockRestore();
+        }
+    });
+});
+
 // A page that asks again before the user has answered its last connection or
 // signature request is refused, instead of opening one more window per call.
 describe("one connection and one signature approval per site at a time", () => {
@@ -2854,7 +2892,7 @@ describe("where an approval window opens", () => {
         await settle();
 
         expect(bg.created).toHaveLength(1);
-        expect(bg.created[0]).toMatchObject({ left: 442, top: 60 });
+        expect(bg.created[0]).toMatchObject({ left: 460, top: 60 });
     });
 
     test("not centred on an approval window the user was last in", async () => {
@@ -2871,7 +2909,7 @@ describe("where an approval window opens", () => {
         bg.requestSign();
         await settle();
 
-        // Centred, it would be at left 882, the position the browser refused.
+        // Centred, it would be at left 900, the position the browser refused.
         expect(bg.created).toHaveLength(1);
         expect(bg.created[0].left).toBeUndefined();
         expect(bg.created[0].top).toBeUndefined();
@@ -2893,7 +2931,7 @@ describe("where an approval window opens", () => {
         await settle();
 
         expect(bg.created).toHaveLength(2);
-        expect(bg.created[0]).toMatchObject({ left: 1502, top: 750 });
+        expect(bg.created[0]).toMatchObject({ left: 1520, top: 750 });
         expect(bg.created[1].left).toBeUndefined();
         expect(bg.created[1].top).toBeUndefined();
 

tests/e2e/firefox/run.js

@@ -640,17 +640,6 @@ step(
         await d.switchToWindow(popup);
         await d.waitVisible("#view-approve-sign");
 
-        // The window is opened as wide as the page, and widened once the
-        // screen is up if it still scrolls sideways
-        // (https://git.eeqj.de/sneak/AutistMask/issues/518). This suite is
-        // where that is checked: the Chrome suite's approval windows open at
-        // 1280x720 whatever width the extension asks for.
-        await d.waitFor(
-            "the sign prompt to fit its window without scrolling sideways",
-            "return document.documentElement.scrollWidth <=" +
-                " document.documentElement.clientWidth;",
-        );
-
         const screen = await d.execute(
             `return {
              origin: document.getElementById("approve-sign-origin").textContent,

tests/e2e/slowApproval.js

@@ -0,0 +1,530 @@
+// A transaction approval and a signature approval the user leaves open for
+// seven minutes, their windows minimized, are still answered, and the site
+// receives both results (https://git.eeqj.de/sneak/AutistMask/issues/540).
+//
+// Both approvals, and the site's requests waiting on them, live only in the
+// background worker's memory. With nothing else going on, Chrome stopped that
+// worker about six minutes after the site's request, while the window was
+// still open, and the user's answer then reached nobody. While an approval is
+// pending, the worker now makes an extension call every 20 seconds, which
+// keeps it running (keepRunningWhileApprovalsPending() in
+// src/background/index.js). The windows are minimized for the wait because
+// Chrome slows a hidden page's timers to once a minute after a few minutes,
+// so anything the window itself did to keep the worker running would fail
+// here.
+//
+// A separate program from run.js, and not driven by Playwright: Playwright
+// keeps DevTools attached to the background worker, and Chrome never stops a
+// worker DevTools is attached to, so in run.js the worker outlives any wait
+// and a wait there proves nothing. This program starts Chromium itself and
+// speaks the DevTools protocol over the pipe Chromium opens for it
+// (--remote-debugging-pipe), attaching to pages only, never to the worker.
+// Before the approvals are raised it watches the worker stop on its own, so a
+// run in which something else keeps the worker running cannot pass.
+//
+// The dApp page and the stub node are the Firefox suite's loopback ones
+// (tests/e2e/firefox/dapp.js). The site is connected and the node chosen
+// through the extension's own screens, so nothing is written to its storage
+// from outside.
+//
+// Run through script/test-e2e, which builds the extension and the pinned
+// container.
+//
+//   node tests/e2e/slowApproval.js
+
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawn } = require("child_process");
+
+const { chromium } = require("playwright-core");
+const {
+    Transaction,
+    getAddress,
+    getBytes,
+    hexlify,
+    parseEther,
+    toQuantity,
+    toUtf8Bytes,
+    verifyMessage,
+} = require("ethers");
+
+const { PASSWORD } = require("./harness");
+const { STUB_COUNTERPARTY } = require("./network");
+const { startDappServer } = require("./firefox/dapp");
+
+const DIST_CHROME = path.resolve(__dirname, "..", "..", "dist", "chrome");
+
+// Chrome stopped the worker six minutes after the site's request when nothing
+// kept it running, so the approvals are left open for longer than that.
+const APPROVAL_WAIT_MS = 7 * 60 * 1000;
+
+// With nothing pending, Chrome stops the worker 30 seconds after its last
+// event; this is how long the program waits to see that.
+const IDLE_STOP_TIMEOUT_MS = 90000;
+
+const SIGN_HEX = hexlify(toUtf8Bytes("AutistMask e2e: a slow signature"));
+
+const checks = [];
+let failed = 0;
+
+function check(name, cond, detail) {
+    checks.push(name);
+    if (cond) {
+        console.log("ok " + checks.length + " - " + name);
+    } else {
+        failed += 1;
+        console.log("not ok " + checks.length + " - " + name);
+        if (detail) console.log("  " + detail);
+    }
+}
+
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// Poll `probe` until it returns something truthy, and return that.
+async function until(what, probe, timeout = 30000) {
+    const deadline = Date.now() + timeout;
+    for (;;) {
+        const value = await probe().catch(() => null);
+        if (value) return value;
+        if (Date.now() > deadline) {
+            throw new Error(
+                "gave up after " + timeout + "ms waiting for " + what,
+            );
+        }
+        await sleep(250);
+    }
+}
+
+// The DevTools protocol over Chromium's pipe: commands go to its fd 3, and
+// replies and events come back on its fd 4, each one JSON message ended by a
+// NUL byte. Events are not used and are dropped. Returns send(method, params,
+// sessionId), which resolves with the command's result.
+function devtools(browser) {
+    const waiting = new Map();
+    let nextId = 1;
+    let pending = "";
+    const replies = browser.stdio[4];
+    replies.setEncoding("utf8");
+    replies.on("data", (chunk) => {
+        pending += chunk;
+        let end;
+        while ((end = pending.indexOf("\0")) !== -1) {
+            const message = JSON.parse(pending.slice(0, end));
+            pending = pending.slice(end + 1);
+            const caller = waiting.get(message.id);
+            if (!caller) continue;
+            waiting.delete(message.id);
+            if (message.error) {
+                caller.reject(
+                    new Error(caller.method + ": " + message.error.message),
+                );
+            } else {
+                caller.resolve(message.result);
+            }
+        }
+    });
+    replies.on("close", () => {
+        for (const caller of waiting.values()) {
+            caller.reject(new Error("the browser exited"));
+        }
+        waiting.clear();
+    });
+    return (method, params = {}, sessionId) =>
+        new Promise((resolve, reject) => {
+            const id = nextId++;
+            waiting.set(id, { method, resolve, reject });
+            browser.stdio[3].write(
+                JSON.stringify({ id, method, params, sessionId }) + "\0",
+            );
+        });
+}
+
+// Attach to a page and return a function that evaluates an expression in it,
+// awaiting a promise it returns, and resolves with the value.
+async function attach(send, targetId) {
+    const { sessionId } = await send("Target.attachToTarget", {
+        targetId,
+        flatten: true,
+    });
+    return async (expression) => {
+        const r = await send(
+            "Runtime.evaluate",
+            { expression, awaitPromise: true, returnByValue: true },
+            sessionId,
+        );
+        if (r.exceptionDetails) {
+            throw new Error(
+                "evaluating " +
+                    expression.slice(0, 80) +
+                    " threw: " +
+                    JSON.stringify(r.exceptionDetails.exception || {}),
+            );
+        }
+        return r.result.value;
+    };
+}
+
+// Whether the page has loaded and shows the element with this id: the
+// `hidden` class showView() keeps on every other view is on neither it nor
+// anything around it.
+function shows(id) {
+    return (
+        "document.readyState === 'complete' &&" +
+        " !!document.getElementById(" +
+        JSON.stringify(id) +
+        ") && !document.getElementById(" +
+        JSON.stringify(id) +
+        ").closest('.hidden')"
+    );
+}
+
+// Set an input's value and fire the input event typing would fire.
+function typeInto(id, value) {
+    return (
+        "(() => { const el = document.getElementById(" +
+        JSON.stringify(id) +
+        "); el.value = " +
+        JSON.stringify(value) +
+        "; el.dispatchEvent(new Event('input', { bubbles: true })); })()"
+    );
+}
+
+function click(id) {
+    return "document.getElementById(" + JSON.stringify(id) + ").click()";
+}
+
+// The outcome of a request the dApp page started with __dapp.start(), or
+// {settled: "pending"} if it has not settled within `timeout`.
+function settled(key, timeout = 30000) {
+    return (
+        "Promise.race([window.__dapp.settle(" +
+        JSON.stringify(key) +
+        "), new Promise((r) => setTimeout(() => r({ settled: 'pending' }), " +
+        timeout +
+        "))])"
+    );
+}
+
+async function main() {
+    if (!fs.existsSync(path.join(DIST_CHROME, "manifest.json"))) {
+        console.error(
+            "slowApproval: no unpacked build at " +
+                DIST_CHROME +
+                " — run make build first",
+        );
+        process.exitCode = 1;
+        return;
+    }
+
+    const node = await startDappServer();
+    const profile = fs.mkdtempSync(
+        path.join(os.tmpdir(), "autistmask-slow-approval-"),
+    );
+    const browser = spawn(
+        chromium.executablePath(),
+        [
+            "--headless",
+            // The container runs unprivileged, as in harness.js.
+            "--no-sandbox",
+            "--remote-debugging-pipe",
+            "--user-data-dir=" + profile,
+            "--disable-extensions-except=" + DIST_CHROME,
+            "--load-extension=" + DIST_CHROME,
+            // Nothing but the loopback dApp page and stub node can be reached.
+            "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1",
+            "about:blank",
+        ],
+        { stdio: ["ignore", "ignore", "ignore", "pipe", "pipe"] },
+    );
+
+    try {
+        const send = devtools(browser);
+        const targets = async () =>
+            (await send("Target.getTargets")).targetInfos;
+
+        const worker = await until("the background worker", async () =>
+            (await targets()).find(
+                (t) =>
+                    t.type === "service_worker" &&
+                    t.url.startsWith("chrome-extension://"),
+            ),
+        );
+        // The extension id is the host of the worker's URL, as in harness.js.
+        const popupUrl =
+            "chrome-extension://" +
+            new URL(worker.url).host +
+            "/src/popup/index.html";
+        const workerRunning = async () =>
+            (await targets()).some((t) => t.url === worker.url);
+        const openPage = async (url) => {
+            const { targetId } = await send("Target.createTarget", { url });
+            return { targetId, evaluate: await attach(send, targetId) };
+        };
+        const approvalPages = async () =>
+            (await targets()).filter(
+                (t) => t.type === "page" && t.url.includes("?approval="),
+            );
+
+        // A wallet, through the popup's own screens, and the stub node as its
+        // RPC endpoint, through Settings.
+        const popup = await openPage(popupUrl);
+        await until("the welcome screen", () =>
+            popup.evaluate(shows("view-welcome")),
+        );
+        await popup.evaluate(click("btn-welcome-add"));
+        await until("the add wallet screen", () =>
+            popup.evaluate(shows("view-add-wallet")),
+        );
+        await popup.evaluate(click("btn-generate-phrase"));
+        await until("a generated recovery phrase", () =>
+            popup.evaluate(
+                "document.getElementById('wallet-mnemonic').value.trim()" +
+                    ".split(/\\s+/).length >= 12",
+            ),
+        );
+        await popup.evaluate(typeInto("add-wallet-password", PASSWORD));
+        await popup.evaluate(typeInto("add-wallet-password-confirm", PASSWORD));
+        await popup.evaluate(click("btn-add-wallet-confirm"));
+        await until(
+            "the main screen",
+            () => popup.evaluate(shows("view-main")),
+            60000,
+        );
+        await popup.evaluate(click("btn-settings"));
+        await until("the settings screen", () =>
+            popup.evaluate(shows("view-settings")),
+        );
+        await popup.evaluate(typeInto("settings-rpc", node.rpcUrl));
+        await popup.evaluate(click("btn-save-rpc"));
+        await until("the stub node saved as the RPC endpoint", () =>
+            popup.evaluate(
+                "new Promise((resolve) => chrome.storage.local.get(" +
+                    "'autistmask', (r) => resolve(r.autistmask.rpcUrl === " +
+                    JSON.stringify(node.rpcUrl) +
+                    ")))",
+            ),
+        );
+        await send("Target.closeTarget", { targetId: popup.targetId });
+
+        // The site, connected through the real prompt with "Remember", so
+        // the connection is stored rather than held by the worker.
+        const dapp = await openPage(node.url);
+        await until("the injected provider", () =>
+            dapp.evaluate("!!window.ethereum && !!window.__dapp"),
+        );
+        await dapp.evaluate(
+            "window.__dapp.start('accounts', 'eth_requestAccounts', [])",
+        );
+        const prompt = await until(
+            "the connection prompt",
+            async () => (await approvalPages())[0],
+        );
+        const inPrompt = await attach(send, prompt.targetId);
+        await until("the connection prompt's screen", () =>
+            inPrompt(shows("view-approve-site")),
+        );
+        await inPrompt(
+            "document.getElementById('approve-remember').checked = true",
+        );
+        // The prompt closes itself on the click.
+        await inPrompt(click("btn-approve")).catch(() => {});
+        const accounts = await dapp.evaluate(settled("accounts"));
+        if (accounts.settled !== "resolved") {
+            throw new Error(
+                "the site could not be connected: " + JSON.stringify(accounts),
+            );
+        }
+        const address = getAddress(accounts.result[0]);
+        console.log("# address " + address + ", site " + node.origin);
+
+        // The control: with nothing pending, the worker stops on its own.
+        // Were something else keeping it running, the wait below would
+        // prove nothing.
+        const idleStart = Date.now();
+        const stoppedWhenIdle = await until(
+            "the idle worker to stop",
+            async () => !(await workerRunning()),
+            IDLE_STOP_TIMEOUT_MS,
+        ).catch(() => false);
+        check(
+            "with nothing pending, Chrome stops the background worker on its own",
+            stoppedWhenIdle,
+            "the worker was still running " +
+                IDLE_STOP_TIMEOUT_MS / 1000 +
+                "s after its last event, so something other than the " +
+                "approval windows is keeping it running",
+        );
+        console.log(
+            "# idle worker stopped after " +
+                Math.round((Date.now() - idleStart) / 1000) +
+                "s",
+        );
+
+        // A transaction approval and a signature approval, both open at once.
+        await dapp.evaluate(
+            "window.__dapp.start('tx', 'eth_sendTransaction', [" +
+                JSON.stringify({
+                    from: address,
+                    to: STUB_COUNTERPARTY,
+                    value: toQuantity(parseEther("0.01")),
+                }) +
+                "])",
+        );
+        await until("the transaction approval window", async () =>
+            (await approvalPages()).length === 1 ? true : null,
+        );
+        await dapp.evaluate(
+            "window.__dapp.start('sign', 'personal_sign', [" +
+                JSON.stringify(SIGN_HEX) +
+                ", " +
+                JSON.stringify(address) +
+                "])",
+        );
+        const windows = await until("both approval windows", async () => {
+            const pages = await approvalPages();
+            return pages.length === 2 ? pages : null;
+        });
+        let txWindow = null;
+        let signWindow = null;
+        const windowIds = [];
+        for (const page of windows) {
+            const evaluate = await attach(send, page.targetId);
+            const view = await until("an approval screen", () =>
+                evaluate(
+                    "(" +
+                        shows("view-approve-tx") +
+                        ") ? 'tx' : (" +
+                        shows("view-approve-sign") +
+                        ") ? 'sign' : null",
+                ),
+            );
+            if (view === "tx") txWindow = evaluate;
+            if (view === "sign") signWindow = evaluate;
+            const { windowId } = await send("Browser.getWindowForTarget", {
+                targetId: page.targetId,
+            });
+            windowIds.push(windowId);
+        }
+        if (!txWindow || !signWindow) {
+            throw new Error("the two windows are not one of each kind");
+        }
+        const setWindowState = (windowState) =>
+            Promise.all(
+                windowIds.map((windowId) =>
+                    send("Browser.setWindowBounds", {
+                        windowId,
+                        bounds: { windowState },
+                    }),
+                ),
+            );
+
+        // The user minimizes both windows while deciding.
+        await setWindowState("minimized");
+        const bothHidden = await until(
+            "both approval pages hidden",
+            async () =>
+                (await txWindow("document.visibilityState")) === "hidden" &&
+                (await signWindow("document.visibilityState")) === "hidden",
+        ).catch(() => false);
+        check(
+            "both approval windows are minimized, and their pages are hidden",
+            bothHidden,
+            "a page still reports itself visible, so the wait below would " +
+                "not show what happens to a minimized approval",
+        );
+
+        // The user takes seven minutes. The worker is checked every two
+        // seconds, and the wait ends early if Chrome stops it.
+        const opened = Date.now();
+        let stoppedAfter = null;
+        while (Date.now() - opened < APPROVAL_WAIT_MS) {
+            if (!(await workerRunning())) {
+                stoppedAfter = Math.round((Date.now() - opened) / 1000);
+                break;
+            }
+            await sleep(2000);
+        }
+        check(
+            "the background worker keeps running while both approvals wait in minimized windows",
+            stoppedAfter === null,
+            "Chrome stopped the worker " +
+                stoppedAfter +
+                "s after the approvals opened",
+        );
+
+        // Back on screen to be answered.
+        await setWindowState("normal");
+        await txWindow(typeInto("approve-tx-password", PASSWORD));
+        await txWindow(click("btn-approve-tx"));
+        await signWindow(typeInto("approve-sign-password", PASSWORD));
+        // The window closes itself once the signature is handed over.
+        await signWindow(click("btn-approve-sign")).catch(() => {});
+
+        const tx = await dapp.evaluate(settled("tx"));
+        const broadcast = node.broadcast.map((raw) => Transaction.from(raw));
+        check(
+            "the transaction approved after seven minutes reaches the site",
+            tx.settled === "resolved" &&
+                broadcast.length === 1 &&
+                tx.result === broadcast[0].hash &&
+                getAddress(broadcast[0].from) === address,
+            "the page got " +
+                JSON.stringify(tx) +
+                " and the node received " +
+                broadcast.length +
+                " transaction(s)",
+        );
+
+        const sign = await dapp.evaluate(settled("sign"));
+        check(
+            "the signature approved after seven minutes reaches the site",
+            sign.settled === "resolved" &&
+                getAddress(verifyMessage(getBytes(SIGN_HEX), sign.result)) ===
+                    address,
+            "the page got " + JSON.stringify(sign),
+        );
+    } catch (e) {
+        failed += 1;
+        console.log("# ERROR: " + (e && e.stack ? e.stack : e));
+    } finally {
+        if (browser.exitCode === null && browser.signalCode === null) {
+            const exited = new Promise((resolve) =>
+                browser.once("exit", resolve),
+            );
+            browser.kill();
+            await exited;
+        }
+        await node.close();
+        // Chromium's helper processes can still be writing to the profile
+        // for a moment after the browser process itself has exited.
+        fs.rmSync(profile, { recursive: true, force: true, maxRetries: 5 });
+    }
+
+    console.log("1.." + checks.length);
+    if (checks.length === 0) {
+        console.log("# FAILED: this program asserted nothing");
+        process.exitCode = 1;
+        return;
+    }
+    console.log(
+        "# " +
+            (checks.length - failed) +
+            "/" +
+            checks.length +
+            " checks passed",
+    );
+    if (failed > 0) {
+        console.log("# FAILED");
+        process.exitCode = 1;
+    }
+}
+
+main().catch((e) => {
+    console.error("slowApproval: " + (e && e.stack ? e.stack : e));
+    process.exitCode = 1;
+});

tests/support/popupBoot.js

@@ -242,13 +242,6 @@ async function settle() {
  *     "?approval=" and an id for the popup opened as an approval window.
  * @param {object} [options.runtime] members of chrome.runtime that replace the
  *     stub's own, for a test that has to answer the background's messages.
- * @param {object} [options.windows] chrome.windows, for a test of the approval
- *     window resizing itself.
- * @param {object} [options.tabs] chrome.tabs, for the same test: the page's
- *     zoom.
- * @param {object} [options.documentElement] members of document.documentElement
- *     that replace the stub's own: scrollWidth and clientWidth, which are equal
- *     unless a test says otherwise, so the page does not scroll sideways.
  * @returns {Promise<object>} handles onto the booted page.
  */
 async function bootPopup(stored, options) {
@@ -284,11 +277,6 @@ async function bootPopup(stored, options) {
         (options && options.storage) ||
         makeStorageStub(stored === undefined ? {} : { autistmask: stored });
     const document = makeDocument(POPUP_HTML);
-    Object.assign(
-        document.documentElement,
-        { scrollWidth: 396, clientWidth: 396 },
-        options && options.documentElement,
-    );
     const reloads = [];
 
     globalThis.chrome = {
@@ -299,8 +287,6 @@ async function bootPopup(stored, options) {
             onMessage: { addListener: () => {} },
             ...(options && options.runtime),
         },
-        windows: options && options.windows,
-        tabs: options && options.tabs,
     };
     globalThis.document = document;
     globalThis.window = {