fix: the typed data screen shows only the message fields that are signed (closes #539)

ethers signs only the fields a type declares and drops any other key, but
the Message section listed every key the site sent, so an added key read
as signed. The Message section now follows the signed type, at every level
of nesting and in the type's order. Typed data with other keys is not
refused: those keys are listed after the message under "Not part of the
signature", by their place in the message. README SignApproval says so.
The operator/spender test now also checks the Message section, and new
tests cover an added key in a nested struct and in a list item.

Model: opus-5-5

README.md

@@ -239,8 +239,12 @@ provide:
   `make check` stays non-mutating. Linting runs only in the container, because
   an ESLint result that depends on whichever ESLint the host happens to have is
   not a result, so docker is required to lint.
-- `script/fmt` — format all files (writes), on the host
+- `script/fmt` — format all files (writes), on the host, with the `prettier`
-- `script/fmt-check` — check formatting (read-only), on the host
+  that `script/bootstrap` installs in `node_modules/`; when that one is missing
+  it fails and says to run `script/bootstrap`, instead of using a `prettier`
+  from the `PATH`
+- `script/fmt-check` — check formatting (read-only), on the host, with the same
+  `prettier` and the same refusal
 - `script/check` — run `script/test`, `script/lint` and `script/fmt-check`
 - `script/check-censored` — assert the competitor name RULES.md bars appears
   nowhere in the working tree or under `dist/` outside its documented
@@ -1641,12 +1645,6 @@ view would leave a wallet one click from deletion.
       the contract's own answer is read at signing time only to be compared with
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
-    - "Sign & Send" after the active network was switched in Settings while this
-      screen was open → nothing is signed; "The active network changed after
-      this transaction was reviewed, so it was not sent. Please go back and
-      review it again." in the errors box, no screen change. The transaction
-      carries the chain id of the network the screen was shown for, so it cannot
-      be signed for another
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Back" → **Send**
@@ -2145,7 +2143,12 @@ view would leave a wallet one click from deletion.
       Bytes that are not UTF-8 are shown as "This message is not text." For
       typed data, formatted domain/type/message fields (EIP-712). The primary
       type shown is the one ethers signs, derived from the typed data's `types`,
-      not the type the site states.
+      not the type the site states. The message shows only the fields that type
+      declares, at every level of nesting and in the type's order: ethers signs
+      those and drops any other key. Typed data carrying other keys is not
+      refused; each such key is listed after the message under "Not part of the
+      signature", by its place in the message (`details.note`,
+      `details[1].note`) and its value.
     - Token permission warning, at the top of the message (typed data whose
       primary type is `Permit`, as in EIP-2612, or one of Permit2's signature
       types): "⚠️ TOKEN PERMISSION: Signing this lets the spender below take the
@@ -2665,7 +2668,8 @@ plaintext list of anyone's domain names.
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all
-parent domains (subdomain matching).
+parent domains (subdomain matching), and checks a hostname written with a
+trailing dot (`name.`) as `name`.
 
 #### Transaction Decoding
 

script/fmt

@@ -25,6 +25,13 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
+    # Without the repo's own prettier, yarn runs whatever prettier is on
+    # the PATH, which may be a version that formats files differently.
+    if [ ! -x node_modules/.bin/prettier ]; then
+        echo "fmt: this repo's prettier is not installed in node_modules/," \
+            "so run script/bootstrap first." >&2
+        exit 1
+    fi
     echo "Formatting..."
     run_yarn run fmt
 }

script/fmt-check

@@ -26,6 +26,13 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
+    # Without the repo's own prettier, yarn runs whatever prettier is on
+    # the PATH, which may be a version that formats files differently.
+    if [ ! -x node_modules/.bin/prettier ]; then
+        echo "fmt-check: this repo's prettier is not installed in" \
+            "node_modules/, so run script/bootstrap first." >&2
+        exit 1
+    fi
     echo "Checking formatting..."
     run_yarn run fmt-check
 }

src/background/index.js

@@ -633,8 +633,9 @@ function isExtensionSender(sender) {
 // had refused.
 //
 // TX and sign approvals do not decide here. They stay pending across a
-// disconnect — the user can reopen the toolbar popup — and are rejected by the
+// disconnect. When their window closes, the windows.onRemoved listener below
-// windows.onRemoved listener below.
+// rejects them, unless an approved attempt is still running, in which case
+// that attempt answers the page.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
@@ -662,7 +663,9 @@ runtime.onConnect.addListener((port) => {
             const approval = pendingApprovals[id];
             if (approval) {
                 if (approval.type === "tx" || approval.type === "sign") {
-                    // Keep pending — user can reopen the toolbar popup
+                    // When its window closes, windows.onRemoved rejects it,
+                    // unless an approved attempt is still running, in which
+                    // case that attempt answers the page.
                     return;
                 }
                 settleApproval(id, { approved: false, remember: false });

src/popup/views/approval.js

@@ -626,10 +626,38 @@ function permitWarningHtml(types, primaryType, domain, message) {
     return html;
 }
 
+// What ethers signs of a message value of type `type`: a struct keeps only
+// the fields its type declares, in the type's order, and a list is read item
+// by item. ethers drops every other key, so each one is added to `notSigned`
+// with its place in the message and its value, for the screen to list apart.
+function signedValue(types, type, value, path, notSigned) {
+    const itemType = type.replace(/\[\d*\]$/, "");
+    if (itemType !== type) {
+        if (!Array.isArray(value)) return value;
+        return value.map((item, i) =>
+            signedValue(types, itemType, item, `${path}[${i}]`, notSigned),
+        );
+    }
+    const fields = types[type];
+    if (!fields || !value || typeof value !== "object") return value;
+    const at = (name) => (path ? `${path}.${name}` : name);
+    for (const [key, val] of Object.entries(value)) {
+        if (!fields.some((f) => f.name === key)) notSigned.push([at(key), val]);
+    }
+    return Object.fromEntries(
+        fields.map((f) => [
+            f.name,
+            signedValue(types, f.type, value[f.name], at(f.name), notSigned),
+        ]),
+    );
+}
+
 // The typed data as the screen shows it. The primary type shown is the one
 // ethers signs, never the page's word for it; typedDataRefusal() keeps the two
-// from differing on anything that can be signed. Only typed data that cannot
+// from differing on anything that can be signed. The Message section shows
-// be read at all is shown as raw text, and typedDataRefusal() refuses it.
+// only what is signed, and any other key the page sent is listed after it as
+// not part of the signature. Only typed data that cannot be read at all is
+// shown as raw text, and typedDataRefusal() refuses it.
 function formatTypedDataHtml(jsonStr) {
     let data;
     let primaryType;
@@ -663,12 +691,30 @@ function formatTypedDataHtml(jsonStr) {
     html += `<div class="mb-2"><div class="text-muted">Primary type</div>`;
     html += `<div class="font-bold">${escapeHtml(primaryType)}</div></div>`;
 
+    const lineHtml = (key, val) =>
+        `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+
     if (data.message) {
+        const notSigned = [];
+        const message = signedValue(
+            data.types,
+            primaryType,
+            data.message,
+            "",
+            notSigned,
+        );
         html += `<div class="mb-2"><div class="text-muted">Message</div>`;
-        for (const [key, val] of Object.entries(data.message)) {
+        for (const [key, val] of Object.entries(message)) {
-            html += `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+            html += lineHtml(key, val);
         }
         html += `</div>`;
+        if (notSigned.length > 0) {
+            html += `<div class="mb-2"><div class="text-muted">Not part of the signature</div>`;
+            for (const [key, val] of notSigned) {
+                html += lineHtml(key, val);
+            }
+            html += `</div>`;
+        }
     }
 
     return html;

src/popup/views/confirmTx.js

@@ -101,10 +101,6 @@ function show(txInfo) {
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
-    // The network this screen is drawn for, and the only one it sends on:
-    // Settings can switch the active network while the screen is open. The
-    // wait, success and error screens label the amount by it too.
-    txInfo.chainId = currentNetwork().chainId;
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
@@ -494,12 +490,7 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
         );
         request = await contract.transfer.populateTransaction(tx.to, amount);
     }
-    // The chain id of the network the screen was drawn for: ethers refuses to
+    const populated = await connectedSigner.populateTransaction(request);
-    // populate it for a provider on any other network.
-    const populated = await connectedSigner.populateTransaction({
-        ...request,
-        chainId: tx.chainId,
-    });
     assertWithinCeilings(populated);
     return connectedSigner.sendTransaction(populated);
 }
@@ -556,17 +547,6 @@ function init(_ctx) {
             return;
         }
 
-        // Back from Settings only unhides this screen, still drawn for the
-        // network that was active when it was shown.
-        if (currentNetwork().chainId !== pendingTx.chainId) {
-            showSendError(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-            return;
-        }
-
         const password = $("confirm-tx-password").value;
         if (!password) {
             showError(
@@ -595,6 +575,10 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
+        // The network it is sent on. The wait, success and error screens
+        // label its amount by this, not by the network active when they draw.
+        pendingTx.chainId = currentNetwork().chainId;
+
         let tx;
         try {
             const signer = getSignerForAddress(

src/shared/phishingDomains.js

@@ -110,11 +110,14 @@ function hashListed(hash) {
  * Generate hostname variants for subdomain matching.
  * "sub.evil.com" yields ["sub.evil.com", "evil.com"].
  *
+ * A trailing dot is dropped: "evil.com." is the fully qualified spelling of
+ * "evil.com", and the browser loads the same site from either.
+ *
  * @param {string} hostname
  * @returns {string[]}
  */
 function hostnameVariants(hostname) {
-    const h = hostname.toLowerCase();
+    const h = hostname.toLowerCase().replace(/\.$/, "");
     const variants = [h];
     const parts = h.split(".");
     // Parent domains: a.b.c.d -> b.c.d, c.d

src/shared/walletDefects.js

@@ -36,11 +36,13 @@ const DEFECTS = {
                 "derivation path beneath that key instead of from a master " +
                 "key, so the addresses listed here are not the ones that key " +
                 "produces under the standard path.",
-            "Signing and sending are disabled for this wallet. The addresses " +
+            "Signing, sending and private key export are disabled for this " +
-                "do descend from the extended private key you imported, so " +
+                "wallet. Anything these addresses hold can be reached outside " +
-                "anything they hold is still reachable by software that " +
+                "this wallet with the extended private key you imported, if " +
-                "repeats the same non-standard derivation. Check them in a " +
+                "you kept a copy of it, or with the master extended private " +
-                "block explorer before deciding what to do.",
+                "key or recovery phrase it came from, in software that " +
+                "repeats the same non-standard derivation. Check the " +
+                "addresses in a block explorer before deciding what to do.",
             "To see the addresses this key produces under the standard path, " +
                 "import the master extended private key, or the recovery " +
                 "phrase it came from, as a new wallet. Nothing here has been " +

tests/confirmTxNetworkSwitch.test.js

@@ -1,259 +0,0 @@
-// A transfer is sent only on the network its confirmation screen was drawn for
-// (https://git.eeqj.de/sneak/AutistMask/issues/524).
-//
-// Settings is reachable from the confirmation screen, and Back from it only
-// unhides the screen, still labelled for the network it was drawn for. Sign &
-// Send used to take the network at the moment of the click, so 1 SepoliaETH
-// reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
-// Settings in between.
-//
-// Driven through the real confirmation screen, signer and chain switch, with
-// only the node and the DOM stubbed. The stub node is on the network its
-// provider was built for, so a broadcast records the network it went to.
-
-"use strict";
-
-// The signed transactions the stub node was handed, with its network's chain id.
-const mockNode = { broadcast: [] };
-
-jest.mock("ethers", () => {
-    const actual = jest.requireActual("ethers");
-    class StubProvider {
-        constructor(url, network) {
-            this.network = network;
-        }
-        async getNetwork() {
-            return this.network;
-        }
-        async getFeeData() {
-            return {
-                maxFeePerGas: 20000000000n,
-                maxPriorityFeePerGas: 1000000000n,
-                gasPrice: 10000000000n,
-            };
-        }
-        async estimateGas() {
-            return 21000n;
-        }
-        async getCode() {
-            return "0x";
-        }
-        async getTransactionCount() {
-            return 1;
-        }
-        async lookupAddress() {
-            return null;
-        }
-        async broadcastTransaction(signed) {
-            mockNode.broadcast.push({ chainId: this.network.chainId, signed });
-            return { hash: "0x" + "ab".repeat(32) };
-        }
-    }
-    return { ...actual, JsonRpcProvider: StubProvider };
-});
-
-jest.mock("../src/shared/log", () => ({
-    log: {
-        debugf: () => {},
-        infof: () => {},
-        warnf: () => {},
-        errorf: () => {},
-    },
-    debugFetch: jest.fn(async () => ({
-        ok: true,
-        status: 200,
-        json: async () => ({ items: [] }),
-    })),
-    urlOrigin: () => "",
-    setRuntimeDebug: () => {},
-    isDebug: () => false,
-}));
-
-// The wait screen polls for a receipt; these tests stop at the broadcast.
-jest.mock("../src/popup/views/txStatus", () => ({
-    showWait: jest.fn(),
-    showError: jest.fn(),
-}));
-
-global.fetch = jest.fn(() => {
-    throw new Error("tests must not perform network requests");
-});
-
-const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-
-// A stub DOM: every id resolves to a recording element.
-const elements = new Map();
-
-function makeEl(id) {
-    const handlers = new Map();
-    return {
-        id,
-        textContent: "",
-        innerHTML: "",
-        value: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        classList: {
-            add() {},
-            remove() {},
-            toggle() {},
-            contains: () => false,
-        },
-        handlers,
-        addEventListener(name, fn) {
-            handlers.set(name, fn);
-        },
-        querySelectorAll: () => [],
-        querySelector: () => null,
-        remove() {},
-        focus() {},
-    };
-}
-
-global.document = {
-    getElementById(id) {
-        if (!elements.has(id)) elements.set(id, makeEl(id));
-        return elements.get(id);
-    },
-    createElement: (tag) => makeEl(tag),
-    body: { prepend() {}, appendChild() {} },
-    addEventListener() {},
-};
-global.navigator = { clipboard: { writeText() {} } };
-
-const { BaseWallet, Transaction, Wallet } = require("ethers");
-const { encryptWithPassword } = require("../src/shared/vault");
-const { state, loadState } = require("../src/shared/state");
-const { onChainSwitch } = require("../src/shared/chainSwitch");
-const { NETWORKS } = require("../src/shared/networks");
-const txStatus = require("../src/popup/views/txStatus");
-const confirmTx = require("../src/popup/views/confirmTx");
-
-const PRIVATE_KEY = "0x" + "11".repeat(32);
-const HOLDER = new Wallet(PRIVATE_KEY).address;
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const PASSWORD = "correct horse battery staple";
-
-function el(id) {
-    return global.document.getElementById(id);
-}
-
-let encryptedSecret;
-let signTransaction;
-
-beforeAll(async () => {
-    await loadState();
-    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
-});
-
-beforeEach(() => {
-    elements.clear();
-    mockNode.broadcast = [];
-    txStatus.showWait.mockClear();
-    txStatus.showError.mockClear();
-    signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
-});
-
-afterEach(() => {
-    signTransaction.mockRestore();
-});
-
-// Show the confirmation screen for 1 of the native token on `networkId`, as
-// Review on the Send screen does, with its fee estimate settled.
-async function review(networkId) {
-    await onChainSwitch(networkId);
-    state.wallets = [
-        {
-            type: "key",
-            name: "Wallet 1",
-            encryptedSecret,
-            addresses: [{ address: HOLDER, balance: "5.0" }],
-        },
-    ];
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    confirmTx.init({});
-    confirmTx.show({
-        from: HOLDER,
-        to: RECIPIENT,
-        ensName: null,
-        amount: "1",
-        token: "ETH",
-        balance: "5.0",
-        tokenSymbol: null,
-        tokenBalance: null,
-        tokenDecimals: null,
-        max: false,
-    });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-}
-
-async function signAndSend() {
-    el("confirm-tx-password").value = PASSWORD;
-    await el("btn-confirm-send").handlers.get("click")();
-}
-
-test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () => {
-    await review("sepolia");
-    expect(el("confirm-type").textContent).toBe("Native SepoliaETH transfer");
-    expect(el("btn-confirm-send").disabled).toBe(false);
-    await signAndSend();
-    expect(mockNode.broadcast).toHaveLength(1);
-    expect(mockNode.broadcast[0].chainId).toBe(11155111n);
-    expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
-        11155111n,
-    );
-    expect(txStatus.showWait).toHaveBeenCalledTimes(1);
-});
-
-describe.each([
-    ["sepolia", "mainnet", "SepoliaETH"],
-    ["mainnet", "sepolia", "ETH"],
-])(
-    "a transfer reviewed on %s, with %s chosen in Settings before Sign & Send",
-    (reviewedOn, switchedTo, symbol) => {
-        test("is neither signed nor sent, and the screen says why", async () => {
-            await review(reviewedOn);
-            expect(el("confirm-type").textContent).toBe(
-                "Native " + symbol + " transfer",
-            );
-            // Settings' network select, then Back, which only unhides the
-            // screen as it was drawn.
-            await onChainSwitch(switchedTo);
-            await signAndSend();
-
-            expect(signTransaction).not.toHaveBeenCalled();
-            expect(mockNode.broadcast).toEqual([]);
-            expect(txStatus.showWait).not.toHaveBeenCalled();
-            expect(txStatus.showError).not.toHaveBeenCalled();
-            expect(el("confirm-errors").style.visibility).toBe("visible");
-            expect(el("confirm-errors").innerHTML).toContain(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-        });
-    },
-);
-
-// The check in the click handler tells the user; the send itself carries the
-// chain id the screen was drawn for, so a signer on another network's node
-// cannot sign it even if the network changes after that check.
-test("the send is refused by a signer on another network's node", async () => {
-    const { getProvider } = require("../src/shared/balances");
-    const signer = new Wallet(PRIVATE_KEY).connect(
-        getProvider("https://rpc.example.invalid", "mainnet"),
-    );
-    await expect(
-        confirmTx.populateVerifyAndSend(signer, {
-            token: "ETH",
-            to: RECIPIENT,
-            amount: "1",
-            chainId: NETWORKS.sepolia.chainId,
-        }),
-    ).rejects.toThrow("transaction chainId mismatch");
-    expect(signTransaction).not.toHaveBeenCalled();
-    expect(mockNode.broadcast).toEqual([]);
-});

tests/phishingDomains.test.js

@@ -89,6 +89,12 @@ describe("vendored blocklist", () => {
         expect(isPhishingDomain(LISTED[0].toUpperCase())).toBe(true);
     });
 
+    test("a hostname ending in a dot is the same host", () => {
+        expect(isPhishingDomain(LISTED[1] + ".")).toBe(true);
+        expect(isPhishingDomain("wallet." + LISTED[1] + ".")).toBe(true);
+        expect(isPhishingDomain(CLEAN[0] + ".")).toBe(false);
+    });
+
     test("returns false for an empty or missing hostname", () => {
         expect(isPhishingDomain("")).toBe(false);
         expect(isPhishingDomain(null)).toBe(false);
@@ -133,6 +139,13 @@ describe("hostnameVariants", () => {
     test("lowercases hostnames", () => {
         expect(hostnameVariants("Evil.COM")).toEqual(["evil.com"]);
     });
+
+    test("drops the trailing dot of a fully qualified hostname", () => {
+        expect(hostnameVariants("sub.evil.com.")).toEqual([
+            "sub.evil.com",
+            "evil.com",
+        ]);
+    });
 });
 
 describe("domain hashing", () => {

tests/typedDataPermit.test.js

@@ -233,6 +233,26 @@ function warningOf(data) {
     return html.slice(0, html.indexOf(">Domain<"));
 }
 
+const NOT_SIGNED = ">Not part of the signature<";
+
+// The Message section alone, without the keys listed after it as not part of
+// the signature.
+function messageOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const end = html.indexOf(NOT_SIGNED);
+    return html.slice(
+        html.indexOf(">Message<"),
+        end === -1 ? html.length : end,
+    );
+}
+
+// The keys listed as not part of the signature, or "" when there are none.
+function notSignedOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const start = html.indexOf(NOT_SIGNED);
+    return start === -1 ? "" : html.slice(start);
+}
+
 function request(data) {
     return { method: "eth_signTypedData_v4", typedData: JSON.stringify(data) };
 }
@@ -312,7 +332,8 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 
     // A Permit whose type names its spender `operator`; the page adds a
-    // `spender` key the type does not declare.
+    // `spender` key the type does not declare. The Message section names
+    // only the operator, and the added key is listed apart as not signed.
     test("an added key is not named as the spender", () => {
         const data = {
             ...PERMIT,
@@ -331,6 +352,10 @@ describe("the warning reads only the fields the signed type declares", () => {
         const warning = warningOf(data);
         expect(warning).toContain(WARNING);
         expect(warning).not.toContain(DECOY);
+        expect(messageOf(data)).toContain(SPENDER);
+        expect(messageOf(data)).not.toContain(DECOY);
+        expect(notSignedOf(data)).toContain("spender:");
+        expect(notSignedOf(data)).toContain(DECOY);
     });
 
     // The permit for a Uniswap v3 position NFT: a `Permit` with no amount
@@ -371,6 +396,47 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 });
 
+// ethers signs only the declared fields at every level of nesting, so an
+// added key inside a struct is not signed either. Such typed data is not
+// refused; the added key is listed apart, with where it sits in the message.
+describe("the Message section shows only the fields that are signed", () => {
+    const NOTE = "This signature only signs you in";
+
+    test("an added key inside a nested struct is listed as not signed", () => {
+        const data = {
+            ...PERMIT_SINGLE,
+            message: {
+                ...PERMIT_SINGLE.message,
+                details: { ...PERMIT_SINGLE.message.details, note: NOTE },
+            },
+        };
+        expect(messageOf(data)).toContain("expiration");
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details.note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+        expect(typedDataRefusal(request(data))).toBeNull();
+    });
+
+    test("an added key inside a list item is listed with its index", () => {
+        const [first, second] = PERMIT_BATCH.message.details;
+        const data = {
+            ...PERMIT_BATCH,
+            message: {
+                ...PERMIT_BATCH.message,
+                details: [first, { ...second, note: NOTE }],
+            },
+        };
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details[1].note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+    });
+
+    test("nothing is listed apart when every key is declared", () => {
+        expect(notSignedOf(PERMIT_SINGLE)).toBe("");
+        expect(notSignedOf(LOGIN)).toBe("");
+    });
+});
+
 describe("the primary type shown is the one ethers signs", () => {
     // A drain stated as a sign-in: the page says Login, the types say
     // PermitSingle, and ethers would sign PermitSingle.

tests/walletDefects.test.js

@@ -153,6 +153,18 @@ describe("the explanatory copy", () => {
         expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
     });
 
+    // The wallet holds the imported key but will not export it, so the copy
+    // must name every key the user may hold that reaches the addresses
+    // outside it.
+    test("it names the keys that reach the addresses outside this wallet", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toMatch(/private key export are disabled/);
+        expect(body).toMatch(
+            /with the extended private key you imported, if you kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation/,
+        );
+    });
+
     test("it says the wallet is not deleted and what the user can do", () => {
         const body = defect.paragraphs.join(" ");