docs: second rework of the release procedure after review

Apply the five wording findings of the second review verbatim: the owner's
rule as one lead-in with three acts, the yarn source without a pronoun, the
workflow definition with its file first, the two e2e jobs named with their
scripts, and the manifest version tied to step 2. The same three faults
were fixed elsewhere: pronouns with two candidates, phrases that arrive
after the words they belong to, and terms used before they were defined.

Model: fable-5-1

Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .

README.md

@@ -1188,12 +1188,11 @@ The wallet takes the `decimals` from these sources, in this order
   "Use Blockscout" is on (`tokenSourcesByChainId()` in
   `src/popup/views/helpers.js`).
 
-The token's name comes from the same sources. The bundled token list is used
-only for a token on Ethereum Mainnet. While "Use Blockscout" is off, a token
-gets a line under it when the bundled list and the tracked tokens lack its name
-or decimals. The line says "Blockscout's report of your balances is not used to
-name this token, because "Use Blockscout" is off in Settings." These screens
-show the line:
+The token's name comes from the same sources. While "Use Blockscout" is off, a
+token gets a line under it when the bundled list and the tracked tokens lack its
+name or decimals. The line says "Blockscout's report of your balances is not
+used to name this token, because "Use Blockscout" is off in Settings." These
+screens show the line:
 
 - TxApproval and SignApproval
 - WaitTx, SuccessTx and ErrorTx, which follow TxApproval
@@ -1474,20 +1473,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. On Ethereum Mainnet, a token that claims a bundled token's symbol
-from another contract is always dropped, tracked or not. On every network, a
-token claiming a label of the native asset is always dropped. Those labels are
-`"ETH"` and each network's `nativeCurrency`, such as `"SepoliaETH"`. The balance
-list applies all three rules whatever the settings say. The "Hide tokens with
-fewer than 1,000 holders" setting governs only the transaction history and the
-send-screen token selector. A token's holder count is unknown when the explorer
-reports none, or reports anything other than a whole number written in digits
-alone, such as `1,000` or `1e3` (`parseHoldersCount()` in
-`src/shared/holders.js`). This list does not take an unknown count as 1,000 or
-more, so such a token is shown only when it is on the bundled list or tracked.
-Every nonzero holding of a token shown is stored exactly, however small, but a
-holding below 0.000001 is left out of the balance lists, the send-screen token
-selector, the address total and the remove-address warning
+more holders. A token claiming a symbol from the bundled list from any other
+contract address is always dropped, tracked or not, and so is any token claiming
+a symbol that belongs to the native asset and therefore has no legitimate
+contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens with fewer than 1,000 holders" setting governs the transaction history
+and the send-screen token selector, not this list. A token's holder count is
+unknown when the explorer reports none, or reports anything other than a whole
+number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+or more, so such a token is shown only when it is on the bundled list or
+tracked. Every nonzero holding of a token shown is stored exactly, however
+small, but a holding below 0.000001 is left out of the balance lists, the
+send-screen token selector, the address total and the remove-address warning
 (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
@@ -2054,15 +2053,21 @@ view would leave a wallet one click from deletion.
       fee estimate and the contract and never-sent recipient checks ask that
       network's RPC endpoint, and the Etherscan label check asks that network's
       explorer
-    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
-      total fee the RPC endpoint fills in at signing is over its bound in
-      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
-      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
-      is more than this wallet will sign for, so it was not sent. Please go back
-      and try again." in its own box, the same sentence for all three, no screen
-      change
-    - "Sign & Send" (wrong password) → "Wrong password." on the password error
-      line, no screen change
+    - "Sign & Send" (correct password) when the gas limit or a fee is over its
+      bound → nothing is signed; "The gas limit or fee the RPC endpoint quoted
+      for this transaction is more than this wallet will sign for, so it was not
+      sent. Please go back and try again." in its own box, no screen change. For
+      an ETH amount that Send's "Max" filled in, the gas limit and fees are
+      those of this screen's own fee estimate (see Amount above). For any other
+      send, the RPC endpoint fills in the gas limit and fees at signing. Just
+      before signing, `assertWithinCeilings()` (`src/shared/approvalVerify.js`)
+      refuses the send when any of these is over its bound:
+        - the gas limit
+        - each fee per gas the transaction sets
+        - the total fee: the gas limit times `maxFeePerGas`, or times `gasPrice`
+          when the transaction has no `maxFeePerGas`
+    - "Sign & Send" (wrong password) → "That password is incorrect. Please try
+      again." on the password error line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
       selected: the two are saved separately, so the popup can reopen onto this
       screen with another address selected. When the selected wallet does not
@@ -2234,6 +2239,8 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
+    - "Add", then the contract lookup answers while another screen shows, or
+      after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
       answers → nothing is tracked; "The active network changed before the
       lookup finished, so the token was not added." flash message, no screen
@@ -3199,25 +3206,26 @@ indexes it as a real token transfer.
   Ethereum mainnet ERC-20s taken from the CoinGecko API, with decimals verified
   on-chain and addresses EIP-55 checksummed; `TOKENS` in
   `src/shared/tokenList.js` is the authoritative set. It is bundled at build
-  time and only changes when that file is regenerated. On Ethereum Mainnet, a
-  token that claims a symbol from this list, such as "USDT" or "USDC", is a
-  spoof unless its contract is the listed one. The wallet hides it. The fake
-  "Ethereum" token in the attack above used symbol "ETH" from contract
-  `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`. No contract may bear "ETH", so
-  that token is a spoof. Detecting a spoof is also what adds a contract to the
-  fraud contract blocklist below; that is the only thing that populates it. In
-  the transaction history the check is the "Hide fake tokens impersonating a
-  known symbol" setting, on by default; with it off, spoofed transfers are shown
-  and no new blocklist entries are learned from them. The send-screen token
-  selector and the balance list apply the same check unconditionally, because
-  they decide which tokens the user can act on and what the user believes they
-  own rather than what the history displays. All three surfaces read the rule
-  from `src/shared/symbolSpoof.js`, so they cannot answer the question
-  differently. A symbol the list maps to no contract at all — the native asset's
-  labels: `"ETH"` and every network's `nativeCurrency`, such as `"SepoliaETH"`,
-  on every network — may be borne by no contract, so every ERC-20 claiming it is
-  a spoof on all three. The user's real ETH balance is not an ERC-20 and is read
-  over RPC, so the rule never sees it.
+  time and only changes when that file is regenerated. Any token transfer
+  claiming a symbol from this list (e.g. "ETH", "USDT", "USDC") but originating
+  from an unrecognized contract address is identified as a spoof and filtered
+  from display. The fake "Ethereum" token in the attack above used symbol "ETH"
+  from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not
+  match the known WETH contract — so it would be caught by this check. Detecting
+  a spoof is also what adds a contract to the fraud contract blocklist below;
+  that is the only thing that populates it. In the transaction history the check
+  is the "Hide fake tokens impersonating a known symbol" setting, on by default;
+  with it off, spoofed transfers are shown and no new blocklist entries are
+  learned from them. The send-screen token selector and the balance list apply
+  the same check unconditionally, because they decide which tokens the user can
+  act on and what the user believes they own rather than what the history
+  displays. All three surfaces read the rule from `src/shared/symbolSpoof.js`,
+  so they cannot answer the question differently. A symbol the list maps to no
+  contract at all — the native asset's labels: `"ETH"` and every network's
+  `nativeCurrency`, such as `"SepoliaETH"`, on every network — may be borne by
+  no contract, so every ERC-20 claiming it is a spoof on all three. The user's
+  real ETH balance is not an ERC-20 and is read over RPC, so the rule never sees
+  it.
 
 - **Low-holder token filtering**: Token transfers from ERC-20 contracts with
   fewer than 1,000 holders are hidden from transaction history by default.

docs/README.md

@@ -377,15 +377,13 @@ point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
 at build time and updated only when a new release ships a newer snapshot. If a
 transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
 but comes from an unrecognized contract, it is identified as a spoof and hidden.
-On Sepolia, only "ETH" and "SepoliaETH" count as known symbols, because the
-bundled list holds Ethereum Mainnet tokens. In your transaction history the
-check is the "Hide fake tokens impersonating a known symbol" setting, which you
-can switch off; doing so also stops new entries being added to the fraud
-contract blocklist below, since detecting a spoof is what fills it. The send
-token list always applies the check. Your balances apply it too, with one
-exception: a token claiming the symbol "ETH" is not filtered there, so a fake
-"ETH" token can still show up in your balance list even though it is hidden from
-your transaction history and from the send token list.
+In your transaction history this is the "Hide fake tokens impersonating a known
+symbol" setting, which you can switch off; doing so also stops new entries being
+added to the fraud contract blocklist below, since detecting a spoof is what
+fills it. The send token list always applies the check. Your balances apply it
+too, with one exception: a token claiming the symbol "ETH" is not filtered
+there, so a fake "ETH" token can still show up in your balance list even though
+it is hidden from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your

docs/RELEASE.md

@@ -1,87 +1,228 @@
 # Releasing AutistMask
 
-This is the procedure that turns a green `main` into a tagged, packaged release.
-It gathers into one place what is otherwise spread across the `Makefile` and
-three `README.md` sections, so the person cutting a release does not have to
-reconstruct the order from them.
+A release is a tagged commit on the `main` branch and the two archives that
+`make package` writes from that commit. This file is the procedure, in order.
 
-There is one version, declared in three files (`package.json`,
-`manifest/chrome.json`, `manifest/firefox.json`), and `make package` builds and
-packages but publishes nothing. `make build` and `make package` can be run by
-anyone; tagging, signing, packing a CRX and any upload need credentials only the
-owner ([@sneak](https://sneak.berlin)) holds and are marked **owner-only**
-below. Releases are tagged from `main` (see the Workflow section of `TODO.md`),
-so the "release commit" throughout is the `main` commit the milestone PR merged.
+Only the owner ([@sneak](https://sneak.berlin)):
+
+- decides whether and when a release is tagged;
+- creates, moves or deletes a tag;
+- decides where the archives are published.
+
+Anyone can run steps 1 to 4. No script in this repository uploads or publishes
+the archives. None signs them, and none packs a CRX (Chrome's packaged extension
+file).
+
+## Terms
+
+- The tracker is the repository's Gitea site (Gitea is the software that hosts
+  the repository): https://git.eeqj.de/sneak/AutistMask. The tracker's Actions
+  page, https://git.eeqj.de/sneak/AutistMask/actions, lists the workflow runs.
+- A workflow is a file under `.gitea/workflows/` that lists jobs. The tracker
+  runs every workflow on each push. Each job runs one script on the tracker's
+  runner (the machine that runs jobs).
+- The release commit is a commit on `main`. Releases are tagged from `main` only
+  (`TODO.md`, Workflow).
+- A clean checkout is a working tree (the checked-out files) at the release
+  commit where `git status --porcelain` prints nothing. The build stamps the
+  commit hash (the commit's id) into the extension and appends `-dirty` when the
+  tree has local changes.
+- A tag is a name that git attaches to one commit. Release tags read `vX.Y.Z`,
+  such as `v0.1.0`.
+- A digest is the sha256 hash of a file (a fixed-length fingerprint of its
+  bytes), written as 64 hexadecimal characters.
+
+## What you need
+
+- A clean checkout of the release commit.
+- `make`.
+- Docker (a tool that runs programs in containers), for `script/cibuild` in
+  step 1. `make package` needs no Docker.
+- Node and yarn. Both come from the system when present. Otherwise
+  `script/bootstrap` installs Node through a pinned (fixed-version) install of
+  nvm, a Node version manager. `script/bootstrap` installs yarn through corepack
+  (Node's package manager installer). When no corepack is found,
+  `script/bootstrap` installs yarn through `npm` (Node's package manager).
 
 ## Procedure
 
-1. **Confirm `main` is green in CI.** The `check` workflow
-   (`.gitea/workflows/check.yml`) runs `script/cibuild`, which runs
-   `script/check` and then builds the image uncached, so a green `check` run is
-   a green `make check`. Find the run for the exact release commit on the
-   tracker's Actions view. _Check:_ that commit's `check` run succeeded; running
-   `make check` on a clean checkout of the commit reproduces it and exits 0.
+### 1. Confirm the release commit is green
 
-2. **Confirm the version matches the intended tag.** `package.json`,
-   `manifest/chrome.json` and `manifest/firefox.json` must all declare the same
-   `X.Y.Z`. `make build` fails when they disagree, but nothing checks that they
-   equal the tag you mean to create — that is this manual step. _Check:_ all
-   three files read the same `X.Y.Z`, and it is the version you intend to tag
-   `vX.Y.Z`.
+The `check` workflow (`.gitea/workflows/check.yml`) runs `script/cibuild` on
+every push. `script/cibuild` runs:
 
-3. **Build and package from a clean checkout of that commit.** From a fresh
-   clone, or a working tree with no local modifications (`git status` clean),
-   checked out at the release commit: run `make setup`, then `make package`.
-   `make package` runs `make build` first, so the archives can only be made from
-   a `dist/` verified against that build's own receipt as a release (not debug)
-   build. It writes three files into `release/`:
-   `autistmask-chrome-<version>.zip`, `autistmask-firefox-<version>.xpi`, and
-   `SHA256SUMS`. _Check:_ those three files exist and `<version>` in the archive
-   names is the version confirmed in step 2. The Firefox `.xpi` is **unsigned**
-   (see step 6 and "Installing on Firefox" in `README.md`).
+- `script/bootstrap`, which installs the dependencies;
+- `script/check`, which is what `make check` runs;
+- the Docker image build (an image is Docker's packaged form of a program).
 
-4. **Verify `SHA256SUMS`.** The archives are deterministic — sorted entries,
-   fixed timestamps, fixed compression — so a second `make package` from another
-   clean checkout of the same commit produces byte-identical files. Verify the
-   recorded digests against the files with `sha256sum -c SHA256SUMS`, run from
-   `release/`. To confirm reproducibility, run `make package` again on a
-   separate clean checkout and compare the digests. _Check:_ `sha256sum -c`
-   reports `OK` for every file, and an independent build's digests match.
+`script/check` runs:
 
-5. **Tag the release commit.** _(owner-only)_ Create an annotated tag `vX.Y.Z`
-   on the release commit and push it: `git tag -a vX.Y.Z` (with a message), then
-   `git push origin vX.Y.Z`. _Check:_ `git tag` lists `vX.Y.Z`, and
-   `git rev-parse vX.Y.Z^{commit}` resolves to the release commit.
+- `script/test`: the tests, in Docker;
+- `script/lint`, which runs three checks in Docker:
+    - ESLint, a code checker;
+    - `prettier --check .`, the formatting check;
+    - `script/check-censored`, which fails when the name that `RULES.md` bars
+      appears outside its allowed places;
+- `script/fmt-check`: `prettier --check .` again, on the host.
 
-6. **Distribute per browser.** _(owner-only; pending the owner's choice on
-   https://git.eeqj.de/sneak/AutistMask/issues/386)_ How 1.0.0 is distributed on
-   each browser is not yet decided; it is the open question on that issue, and
-   the concrete steps cannot be written until the owner records a choice there.
-   These steps need credentials only the owner holds. The options under
-   consideration are:
-    - **Firefox** — the packaged `.xpi` is unsigned, and release Firefox and ESR
-      refuse an unsigned add-on:
-        - (a) AMO self-distribution signing (unlisted): submit the `.xpi` to AMO
-          with the owner's credentials; AMO returns a signed `.xpi` installable
-          on every Firefox, with nothing listed publicly.
-        - (b) AMO listed: as (a), plus a public AMO listing and review.
-        - (c) Ship the unsigned `.xpi` and state that Firefox support means
-          Developer Edition, Nightly, or an Unbranded build with
-          `xpinstall.signatures.required` set to `false`.
-    - **Chrome** — the repo packs no CRX and publishes nothing; the extension id
-      is fixed by the `key` in `manifest/chrome.json`:
-        - (a) Chrome Web Store (unlisted): upload the `.zip` with the owner's
-          developer account; the store delivers installs and updates.
-        - (b) Self-hosted CRX signed with the private key the owner holds
-          (`chrome --pack-extension=dist/chrome --pack-extension-key=<path to the .pem>`),
-          installable only via enterprise policy on Windows and macOS, so
-          realistically Linux-only.
-        - (c) "Load unpacked" from `dist/chrome/` only, as today.
+The `e2e` workflow (`.gitea/workflows/e2e.yml`) has two jobs. One runs
+`script/test-e2e`, the browser tests in Chrome. The other runs
+`script/test-e2e-firefox`, the browser tests in Firefox. A red `e2e` job does
+not fail the `check` run.
 
-    Once the owner decides, the chosen steps — including which credentials they
-    need and who holds them — are written into this section and `README.md`'s
-    installation sections are updated to match, which is part of the definition
-    of done of https://git.eeqj.de/sneak/AutistMask/issues/386. _Check:_ for a
-    store or AMO route, the artifact installs from the store or AMO on a clean
-    browser profile; for the CRX or unpacked route, the documented load succeeds
-    and Chrome reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`.
+Run `script/cibuild` on the clean checkout. `script/cibuild` runs the same steps
+as the `check` run, and must exit 0.
+
+Check: on the Actions page, the `check` run for the release commit succeeded,
+and both `e2e` jobs for that commit succeeded. `script/cibuild` exited 0 on the
+clean checkout.
+
+### 2. Confirm the version
+
+Three files declare the version:
+
+- `package.json`;
+- `manifest/chrome.json`;
+- `manifest/firefox.json`.
+
+`script/lib/version.js` fails the build when the three disagree.
+`tests/version.test.js` fails when the version is not three numbers separated by
+dots. Nothing compares the version with a tag. That comparison is this step.
+
+Check: all three files read the same `X.Y.Z`, and `vX.Y.Z` is the tag that the
+owner creates in step 5.
+
+### 3. Build and package
+
+On the clean checkout, run:
+
+```bash
+make setup
+make package
+```
+
+`make setup` installs two things:
+
+- the dependencies, from the lockfile `yarn.lock`, which pins each one's
+  version;
+- the git pre-commit hook, a script that git runs before each commit. Here the
+  hook runs `script/check`.
+
+`make package` runs `make build`, then `script/lib/package.js`.
+
+`make build`:
+
+- runs `build.js`. `build.js` writes `dist/chrome/`, `dist/firefox/` and a build
+  receipt. The receipt lists every file that `build.js` wrote, with each file's
+  digest. The receipt lives outside the repository and is deleted when the build
+  ends;
+- runs `script/verify-build --expect release` against the receipt. The check
+  fails when:
+    - `dist/` differs from the receipt;
+    - a bundle (one JavaScript file built from many source files) was compiled
+      with the build-time constant `DEBUG` on;
+    - any file carries the test recovery phrase, which a debug build gives every
+      new wallet;
+- runs `script/check-censored --require-dist` against the built files;
+- removes `dist/` when any of those steps fails.
+
+`script/lib/package.js`:
+
+- empties `release/`;
+- refuses a symbolic link (a file that points at another file) under `dist/`;
+- checks that the archive is self-contained: every file that the manifest or the
+  popup's HTML page names is inside the browser's directory (`dist/chrome/` or
+  `dist/firefox/`). The manifest is `manifest.json`, the file that describes the
+  extension to the browser. The popup is the window that the toolbar button
+  opens;
+- checks that the `version` in each `manifest.json` is the version from step 2;
+- writes one archive per browser;
+- reads each archive back;
+- compares every member (a file inside the archive) with `dist/` byte for byte;
+- writes `SHA256SUMS`, with one line per archive:
+    - the digest;
+    - two spaces;
+    - the file name.
+
+`make package` writes three files:
+
+```
+release/autistmask-chrome-<version>.zip
+release/autistmask-firefox-<version>.xpi
+release/SHA256SUMS
+```
+
+The `.xpi` is Firefox's add-on package file (an add-on is Firefox's word for an
+extension). The `.xpi` is not signed.
+
+`make package` prints a line that starts `Not shipped` and names `styles.css`.
+This is expected: each archive holds its own copy of the stylesheet.
+
+Check: `release/` holds those three files, and `<version>` in their names is the
+version from step 2.
+
+### 4. Verify the digests
+
+From `release/`, run `sha256sum -c SHA256SUMS`.
+
+The archives are deterministic for a given `dist/`: the same `dist/` always
+gives the same bytes. `script/lib/zip.js`:
+
+- sorts the members;
+- sets every member's timestamp (its recorded date) to 1980-01-01;
+- compresses each member the same way every time.
+
+`dist/` itself carries the build date. `build.js` compiles the build date, a UTC
+(universal time) day, into the extension. So two builds of the same commit on
+the same UTC day give byte-identical archives. Builds on different days differ.
+
+Check: `sha256sum -c` prints `OK` for both archives. On the same UTC day, a
+second `make package` from another clean checkout of the same commit gives the
+same `SHA256SUMS`.
+
+### 5. Tag the release commit
+
+Owner only. Only the owner decides whether and when a release is tagged. Only
+the owner creates, moves or deletes a tag. On the release commit, the owner
+runs:
+
+```bash
+git tag -a vX.Y.Z -m "AutistMask X.Y.Z"
+git push origin vX.Y.Z
+```
+
+`-a` makes an annotated tag: a tag that carries a message and records who made
+the tag and when. `v0.1.0` is one.
+
+Once the tag exists, `git describe --tags` on the release commit prints
+`vX.Y.Z`. `script/cibuild` and `script/docker` pass that value to the Docker
+image build as `VERSION`.
+
+Check: `git rev-parse vX.Y.Z^{commit}` prints the release commit's hash, and the
+tag is listed at https://git.eeqj.de/sneak/AutistMask/tags.
+
+### 6. Publish the archives
+
+Owner only. The owner decides where the archives are published. No script in
+this repository uploads or publishes them.
+
+Whoever receives an archive installs it as follows.
+
+Chrome loads the extension from a directory:
+
+- unzip the archive into a new, empty directory, for example
+  `unzip autistmask-chrome-0.1.0.zip -d autistmask-chrome`;
+- open `chrome://extensions/` and turn on "Developer mode";
+- click "Load unpacked" and pick that directory.
+
+Chrome then reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`. The id
+is the fixed string that identifies the extension to Chrome; the `key` in
+`manifest/chrome.json` sets the id.
+
+Release builds of Firefox refuse to install an unsigned add-on. Desktop Firefox
+115 or newer, in any edition, loads the `.xpi` as a temporary add-on from the
+`about:debugging` page. Firefox unloads a temporary add-on when Firefox exits.
+The section "Installing on Firefox" in `README.md` has the details.
+
+Check: each archive installs on a fresh browser profile (a new, empty set of
+browser data) by the route above.

eslint.config.js

@@ -153,8 +153,7 @@ module.exports = [
         },
     },
 
-    // The helpers the script/ entrypoints call: plain node programs too, run
-    // from a shell script rather than from yarn, and never bundled.
+    // The files in script/lib/ run on plain node too, and are never bundled.
     {
         files: ["script/lib/**/*.js"],
         languageOptions: {

package.json

@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "jest --forceExit --maxWorkers=3",
-        "test:verbose": "jest --forceExit --maxWorkers=3 --verbose",
+        "test": "node script/lib/jest.js --maxWorkers=3",
+        "test:verbose": "node script/lib/jest.js --maxWorkers=3 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",

script/bootstrap

@@ -118,6 +118,7 @@ ensure_yarn() {
     fi
 }
 
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \

script/lib/jest.js

@@ -0,0 +1,40 @@
+// Runs jest with the arguments it is given, and fails the run when jest had to
+// force-stop the worker process that ran a test file. Jest itself only prints a
+// warning when that happens, and its run still passes. The warning means a test
+// left a timer or another open handle running. The test scripts in package.json
+// run jest through this file.
+//
+// Jest runs inside this process and writes to the terminal directly, so its
+// output looks the same as a plain jest run. This file only checks each write
+// to stderr for the warning below.
+
+"use strict";
+
+// The start of the warning that jest prints on stderr after it force-stops a
+// worker process.
+const WORKER_WARNING = "A worker process has failed to exit gracefully";
+
+let forceStopped = false;
+
+const writeStderr = process.stderr.write.bind(process.stderr);
+process.stderr.write = (chunk, ...rest) => {
+    if (String(chunk).includes(WORKER_WARNING)) {
+        forceStopped = true;
+    }
+    return writeStderr(chunk, ...rest);
+};
+
+// Runs after jest has finished, as the process exits.
+process.on("exit", () => {
+    if (forceStopped) {
+        console.error(
+            "script/lib/jest.js: failing the run, because jest force-stopped " +
+                "a worker process. A test left a timer or another open " +
+                "handle running.",
+        );
+        process.exitCode = 1;
+    }
+});
+
+// Jest's own command-line program. It reads its arguments from process.argv.
+require("jest/bin/jest");

src/popup/views/addToken.js

@@ -5,7 +5,12 @@ const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
 const { log } = require("../../shared/log");
 
+// Counts the times AddToken has opened. A contract lookup started before
+// AddToken was last opened changes neither the screen nor the status line.
+let addTokenScreenOpenings = 0;
+
 function show() {
+    addTokenScreenOpenings++;
     $("add-token-address").value = "";
     $("add-token-info").textContent = "";
     $("add-token-info").style.visibility = "hidden";
@@ -55,6 +60,7 @@ function init(ctx) {
         // The network the lookup asks, which Settings may switch away from
         // before it answers, as for a transaction in confirmTx.js.
         const chainId = currentNetwork().chainId;
+        const opening = addTokenScreenOpenings;
         try {
             const info = await lookupTokenInfo(
                 contractAddr,
@@ -80,6 +86,17 @@ function init(ctx) {
             });
             await saveState();
             ctx.doRefreshAndRender();
+            // If the lookup answers after AddToken was opened again, the
+            // token is still added, but the screen and the status line stay
+            // as they are.
+            if (addTokenScreenOpenings !== opening) return;
+            // The lookup is over, so a later Back onto AddToken shows no
+            // status.
+            infoEl.textContent = "";
+            infoEl.style.visibility = "hidden";
+            // If the lookup answers while another screen shows, the token is
+            // still added but the screen does not change.
+            if (state.currentView !== "add-token") return;
             // Pop the stack (back to address detail) and re-render it
             // so the newly added token is visible immediately.
             if (state.viewStack.length > 0) {
@@ -100,6 +117,7 @@ function init(ctx) {
                     ? detail
                     : "Could not add the token.",
             );
+            if (addTokenScreenOpenings !== opening) return;
             infoEl.textContent = "";
             infoEl.style.visibility = "hidden";
         }

src/popup/views/addressToken.js

@@ -22,7 +22,7 @@ const {
     timeAgo,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { bundledToken, resolveSymbol } = require("../../shared/tokenList");
+const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -52,8 +52,7 @@ function show() {
 
     // Determine token symbol and balance
     let symbol, amount, price;
-    const chainId = currentNetwork().chainId;
-    const knownToken = bundledToken(tokenId, chainId);
+    const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
     if (tokenId === "ETH") {
         symbol = nativeCurrency();
         amount = parseFloat(addr.balance || "0");
@@ -66,7 +65,6 @@ function show() {
             tokenId,
             addr.tokenBalances,
             state.trackedTokens,
-            chainId,
         );
         // null when the scale is unknown: no quantity to show, and none to
         // price. balanceLine() states that rather than printing 0.0000.

src/popup/views/helpers.js

@@ -313,17 +313,14 @@ function nativeCurrency() {
 // The wallets' balances hold what Blockscout reported for each token. So the
 // wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
-    const chainIdOrActive = chainId || currentNetwork().chainId;
-    const net = networkByChainId(chainIdOrActive);
+    const net = chainId ? networkByChainId(chainId) : currentNetwork();
     if (net && net.id === state.networkId) {
         return {
-            chainId: chainIdOrActive,
             trackedTokens: state.trackedTokens,
             wallets: state.useBlockscout ? state.wallets : [],
         };
     }
     return {
-        chainId: chainIdOrActive,
         trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
         wallets: [],
     };
@@ -354,7 +351,7 @@ function blockscoutOffTokenNoteHtml(token, chainId) {
 
 // The symbol shown for a token line, from these sources in order:
 //
-// - the bundled list, for a token on Ethereum Mainnet
+// - the bundled list
 // - the tokens the user tracks
 // - the explorer's report, while "Use Blockscout" is on
 //

src/popup/views/send.js

@@ -12,7 +12,7 @@ const {
     goBack,
     tokenSourcesByChainId,
 } = require("./helpers");
-const { state, currentAddress, currentNetwork } = require("../../shared/state");
+const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
 const { resolveTokenDecimals } = require("../../shared/approvalAmount");
@@ -154,9 +154,7 @@ function renderSendTokenSelect(addr) {
         // out. Its token's own screen can still send it: there
         // state.selectedToken picks the token, not this list.
         if (isBelowOneMillionth(t.balance)) continue;
-        if (isSpoofedSymbol(t.symbol, t.address, currentNetwork().chainId)) {
-            continue;
-        }
+        if (isSpoofedSymbol(t.symbol, t.address)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
         // An unknown holder count does not withhold a token the user holds:
         // only a count the explorer actually reported as below the threshold
@@ -232,7 +230,6 @@ function updateSendBalance() {
             token,
             addr.tokenBalances,
             state.trackedTokens,
-            currentNetwork().chainId,
         );
         // A null balance is a holding whose scale is unknown. Saying a figure
         // for it would be a claim about the amount, so it reads as the
@@ -388,7 +385,6 @@ function init(_ctx) {
                 token,
                 addr.tokenBalances,
                 state.trackedTokens,
-                currentNetwork().chainId,
             );
             ({ tokenDecimals } = tokenBalanceAndDecimals(addr, token));
         }

src/shared/approvalAmount.js

@@ -29,7 +29,7 @@
 // string, and a token the user added by hand carries whatever lookupTokenInfo()
 // got back, so the accepted types are enumerated rather than coerced.
 const { toDecimals } = require("./transferAmount");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 
 // Every decimals the explorer reported for this contract, across all the
@@ -53,14 +53,12 @@ function explorerDecimals(lower, wallets) {
 }
 
 // The decimals to render a token amount with, or null when nothing knows.
-// `sources` is { chainId, trackedTokens, wallets }. `chainId` is the chain id
-// of the token's network. The bundled list is read only when that network is
-// Ethereum Mainnet. `trackedTokens` and `wallets` are shaped as on `state`.
+// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
 function resolveTokenDecimals(tokenAddress, sources) {
     const lower = (tokenAddress || "").toLowerCase();
     if (!lower) return null;
 
-    const bundled = bundledToken(lower, sources && sources.chainId);
+    const bundled = TOKEN_BY_ADDRESS.get(lower);
     if (bundled) {
         const d = toDecimals(bundled.decimals);
         if (d !== null) return d;
@@ -102,19 +100,18 @@ function explorerSymbol(lower, wallets) {
 // explorer reported: the same sources and the same precedence
 // resolveTokenDecimals() uses, so a token's name and its scale are drawn from
 // the same place and the two can no longer disagree about which sources they
-// trust. `sources` is as for resolveTokenDecimals().
+// trust. `sources` is { trackedTokens, wallets }, shaped as on `state`.
 //
 // A tracked or explorer-reported symbol is attacker-influenced text, so it is
-// held to the spoof rule (symbolSpoof.js): a candidate that the rule calls a
-// spoof is refused and the next source tried, so resolving a symbol never
-// becomes a new way to claim a known ticker. The bundled list is the wallet's
-// own data and is trusted as it is.
+// held to the spoof rule (symbolSpoof.js): a candidate that wears a bundled or
+// native ticker from a contract not entitled to it is refused and the next
+// source tried, so resolving a symbol never becomes a new way to claim a known
+// ticker. The bundled list is the wallet's own data and is trusted as it is.
 function resolveTokenSymbol(tokenAddress, sources) {
     const lower = (tokenAddress || "").toLowerCase();
     if (!lower) return null;
 
-    const chainId = sources && sources.chainId;
-    const bundled = bundledToken(lower, chainId);
+    const bundled = TOKEN_BY_ADDRESS.get(lower);
     if (bundled && bundled.symbol) return bundled.symbol;
 
     const tracked = ((sources && sources.trackedTokens) || []).find(
@@ -126,7 +123,7 @@ function resolveTokenSymbol(tokenAddress, sources) {
     if (reported) candidates.push(reported);
 
     for (const symbol of candidates) {
-        if (!isSpoofedSymbol(symbol, tokenAddress, chainId)) return symbol;
+        if (!isSpoofedSymbol(symbol, tokenAddress)) return symbol;
     }
     return null;
 }

src/shared/balances.js

@@ -17,7 +17,7 @@ const { ERC20_ABI } = require("./constants");
 const { NETWORKS } = require("./networks");
 const { log, debugFetch, urlOrigin } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
@@ -106,9 +106,6 @@ function rawUnits(value) {
 // balance is read through the RPC endpoint instead, and its row here gives that
 // entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
-// `chainId` is the chain id of the network `blockscoutUrl` serves. The known
-// token list is used only when that network is Ethereum Mainnet.
-//
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
 // upstream of every screen that displays a token amount, so a value invented
@@ -120,7 +117,6 @@ async function fetchTokenBalances(
     address,
     blockscoutUrl,
     trackedTokens,
-    chainId,
     signal,
 ) {
     if (!(await storedSettingIsOn("useBlockscout"))) return [];
@@ -179,10 +175,7 @@ async function fetchTokenBalances(
             // either way: copying another source into it would make
             // explorerDecimals()'s disagreement check compare something other
             // than explorer values.
-            const known = resolveTokenDecimals(tokenAddr, {
-                chainId,
-                trackedTokens,
-            });
+            const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
             const scale = known !== null ? known : decimals;
             // null is a holding of an amount that cannot be stated, which is
             // not the same as a holding of zero, and must never render as one.
@@ -198,7 +191,7 @@ async function fetchTokenBalances(
             // through to the views, where the two low-holder filters treat
             // an unknown count as "do not judge" rather than as zero.
             const holders = parseHoldersCount(item.token.holders_count);
-            const isKnown = bundledToken(tokenAddr, chainId) !== null;
+            const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
             const hasEnoughHolders = holders >= LOW_HOLDER_THRESHOLD;
 
@@ -209,9 +202,7 @@ async function fetchTokenBalances(
             // Every row here is an ERC-20 the explorer reported, so it has a
             // contract address; the native ETH balance is fetched over RPC in
             // refreshBalances and never passes through this loop.
-            if (isSpoofedSymbol(item.token.symbol, tokenAddr, chainId)) {
-                continue;
-            }
+            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
 
             balances.push({
                 address: item.token.address_hash,
@@ -258,18 +249,17 @@ async function fetchTokenBalances(
 // zero from the tracked list. A token whose symbol the spoof rule refuses gets
 // no entry either, as in fetchTokenBalances().
 //
-// `chainId` and `signal` are as for fetchTokenBalances().
+// `signal` is as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
     provider,
     address,
     trackedTokens,
     previous,
     explorerRequest,
-    chainId,
     signal,
 ) {
     const listed = trackedTokens.filter(
-        (token) => !isSpoofedSymbol(token.symbol, token.address, chainId),
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
     );
     // Each token's balanceOf answer, or null where it failed.
     const balances = await Promise.all(
@@ -311,7 +301,7 @@ async function fetchTrackedTokenBalances(
         if (raw === 0n) return;
         const entry = entryIn(reported);
         const decimals = entry ? entry.decimals : null;
-        const known = resolveTokenDecimals(lower, { chainId, trackedTokens });
+        const known = resolveTokenDecimals(lower, { trackedTokens });
         const scale = known !== null ? known : decimals;
         rows.push({
             address: token.address,
@@ -340,7 +330,6 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
-    const { chainId } = requireNetworkId(networkId);
     const tracked = trackedTokens || [];
     const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
@@ -404,7 +393,6 @@ async function refreshBalances(
                 addr.address,
                 blockscoutUrl,
                 tracked,
-                chainId,
                 signal,
             );
             updates.push(
@@ -415,7 +403,6 @@ async function refreshBalances(
                         tracked,
                         previous,
                         explorerRequest,
-                        chainId,
                         signal,
                     ),
                     explorerRequest,

src/shared/symbolSpoof.js

@@ -19,8 +19,7 @@
 // them hid the other one's holders' money (issue #276).  Membership, not
 // equality, is therefore the question — but it is the same question, asked of
 // a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token on Ethereum Mainnet.  On mainnet, a contract
-// outside the set is still a spoof.
+// wallet ships as a real token; a contract outside the set is still a spoof.
 //
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
@@ -28,7 +27,6 @@
 // since that is what the user acts on.
 
 const { KNOWN_SYMBOLS } = require("./tokenList");
-const { NETWORKS } = require("./networks");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.
@@ -95,24 +93,18 @@ function normalizeSymbol(symbol) {
 }
 
 // True when a token bearing `symbol` from contract `contractAddress` is
-// impersonating a known symbol. `chainId` is the chain id of the token's
-// network.
-//
-// The native asset's labels are known symbols on every network. The bundled
-// list's symbols are known symbols only on Ethereum Mainnet, because the list
-// holds mainnet contracts.
+// impersonating a known symbol.
 //
 // An empty contract address is the native asset, which is never a spoof:
 // this is what keeps the user's real ETH out of the rule, and it holds for
 // any symbol that becomes null-mapped later, not just for ETH.
-function isSpoofedSymbol(symbol, contractAddress, chainId) {
+function isSpoofedSymbol(symbol, contractAddress) {
     const contract = normalizeAddress(contractAddress);
     if (!contract) return false;
     const sym = normalizeSymbol(symbol);
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
-    if (chainId !== NETWORKS.mainnet.chainId) return false;
     return !legit.has(contract);
 }
 

src/shared/tokenList.js

@@ -3953,15 +3953,6 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// The bundled list's entry for the contract at `address` on the network with
-// chain id `chainId`, or null. The list holds Ethereum Mainnet contracts only.
-// A contract at the same address on another network is another token, so any
-// other chain id gets null.
-function bundledToken(address, chainId) {
-    if (chainId !== NETWORKS.mainnet.chainId) return null;
-    return TOKEN_BY_ADDRESS.get((address || "").toLowerCase()) || null;
-}
-
 // Build a map of symbol (uppercased) -> the set of contract addresses
 // (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
 // "ETH" maps to null: the native asset has no contract, so no contract may
@@ -3978,8 +3969,7 @@ function bundledToken(address, chainId) {
 // hides from the balance list, the history and the send selector at its own
 // address, so the user cannot spend it (issue #276).  Naming every address
 // that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule.  On Ethereum Mainnet, a contract outside the set is still a
-// spoof.
+// loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const network of Object.values(NETWORKS)) {
@@ -3998,15 +3988,14 @@ for (const t of TOKENS) {
     }
 }
 
-// Resolve a token symbol from multiple sources, never returning "?". The token
-// is a contract on the network with chain id `chainId`.
-function resolveSymbol(tokenAddress, tokenBalances, trackedTokens, chainId) {
+// Resolve a token symbol from multiple sources, never returning "?".
+function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
     const lower = (tokenAddress || "").toLowerCase();
     const tb = (tokenBalances || []).find(
         (t) => t.address.toLowerCase() === lower,
     );
     if (tb && tb.symbol) return tb.symbol;
-    const known = bundledToken(lower, chainId);
+    const known = TOKEN_BY_ADDRESS.get(lower);
     if (known && known.symbol) return known.symbol;
     const tracked = (trackedTokens || []).find(
         (t) => t.address.toLowerCase() === lower,
@@ -4023,6 +4012,5 @@ module.exports = {
     USD_PRICE_FEEDS,
     PRICE_FEED_BY_ADDRESS,
     getTopTokens,
-    bundledToken,
     resolveSymbol,
 };

src/shared/transactions.js

@@ -8,7 +8,7 @@
 
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { parseHoldersCount, isLowHolderCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { nativeCurrencyByChainId } = require("./networks");
@@ -47,7 +47,7 @@ function parseTx(tx, addrLower, chainId) {
     let direction = normalizeAddress(from) === addrLower ? "sent" : "received";
     let directionLabel = direction === "sent" ? "Sent" : "Received";
     if (toIsContract && method && method !== "transfer") {
-        const token = bundledToken(to, chainId);
+        const token = TOKEN_BY_ADDRESS.get(normalizeAddress(to));
         if (token) {
             symbol = token.symbol;
         }
@@ -317,10 +317,7 @@ function filterTransactions(txs, filters = {}) {
         const contract = normalizeAddress(tx.contractAddress);
 
         // Filter spoofed known symbols and record the fraud contract
-        if (
-            hideSpoofed &&
-            isSpoofedSymbol(tx.symbol, tx.contractAddress, tx.chainId)
-        ) {
+        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
             if (contract && !fraudSet.has(contract)) {
                 fraudSet.add(contract);
                 newFraud.push(contract);

src/shared/uniswap.js

@@ -452,8 +452,8 @@ const ADDRESS_THIS = "0x0000000000000000000000000000000000000002";
 // `decimals` is null when nothing knows this token's scale. It is not
 // defaulted to 18: the swap lines land on the same approval screen as the
 // ERC-20 line, and a scale guessed there is what showed a 1,000 USDT swap as
-// 0.000000000001. `sources` is as for resolveTokenDecimals(), which reads the
-// bundled list on Ethereum Mainnet, then the tracked tokens and the wallets.
+// 0.000000000001. `sources` is { trackedTokens, wallets }, shaped as they are
+// on `state`; resolveTokenDecimals() reads the bundled list, then those.
 //
 // A null `address` means UNDETERMINED — the calldata named no currency for
 // that side — and is refused rather than named. It is not native ETH: Uniswap
@@ -1240,9 +1240,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
     const release = routerRelease(toAddress, chainId);
     if (release === null) return null;
     const { commandTypeMask, commands, allowRevert } = release;
-    // The swap's tokens are contracts on the network with `chainId`, so they
-    // are named and scaled for that network.
-    const tokenSources = { ...sources, chainId };
     try {
         const parsed = ROUTER_IFACE.parseTransaction({ data });
         if (!parsed) return null;
@@ -2211,11 +2208,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // Any other output keeps its own token and figure: a swap that pays
         // its WETH to the user and then unwraps receives WETH, and one that
         // buys USDC and then unwraps the WETH it did not spend receives USDC.
-        const inInfo = tokenInfo(inputToken, tokenSources);
+        const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
             outputUnwrapped || (hasUnwrapWeth && !outputEstablished)
                 ? { symbol: "ETH", decimals: 18, address: null }
-                : tokenInfo(outputToken, tokenSources);
+                : tokenInfo(outputToken, sources);
 
         const inSymbol = inInfo.symbol;
         const outSymbol = outInfo.symbol;
@@ -2340,19 +2337,13 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             details.push({
                 label: "Moved from the sender",
                 value: present(s.amount)
-                    ? spentText(
-                          s.amount,
-                          tokenInfo(s.token, tokenSources),
-                          s.atMost,
-                      ).display
+                    ? spentText(s.amount, tokenInfo(s.token, sources), s.atMost)
+                          .display
                     : UNDECODED_CURRENCY,
             });
             if (present(s.token)) {
                 details.push(
-                    tokenMovedLine(
-                        "Token moved",
-                        tokenInfo(s.token, tokenSources),
-                    ),
+                    tokenMovedLine("Token moved", tokenInfo(s.token, sources)),
                 );
                 details.push({
                     label: "Moved to",
@@ -2364,7 +2355,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // What each PERMIT2_TRANSFER_FROM moves: its amount, its token and
         // where it goes, an address on a line of its own.
         for (const m of movedFromSender) {
-            const info = permit2TokenInfo(m.token, tokenSources);
+            const info = permit2TokenInfo(m.token, sources);
             details.push({
                 label: "Moved from the sender",
                 value: amountText(m.amount, info).display,
@@ -2399,7 +2390,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 });
                 continue;
             }
-            const info = permit2TokenInfo(p.token, tokenSources);
+            const info = permit2TokenInfo(p.token, sources);
             details.push({
                 label: "Permit2 allowance",
                 value:
@@ -2465,7 +2456,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             paidTo.push({ label: "Paid to", value: PAID_TO_BRIDGE });
         }
         for (const m of movedIntoRouter) {
-            const info = permit2TokenInfo(m.token, tokenSources);
+            const info = permit2TokenInfo(m.token, sources);
             paidTo.push({
                 label: "Paid to",
                 value:
@@ -2490,7 +2481,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             paidTo.push(
                 tokenMovedLine(
                     "Token moved into the router",
-                    tokenInfo(getAddress(token), tokenSources),
+                    tokenInfo(getAddress(token), sources),
                 ),
             );
         }

tests/addTokenLateAnswer.test.js

@@ -0,0 +1,137 @@
+// A contract lookup on AddToken can answer after the user has left AddToken.
+// The token is still added, and the screen the user is on does not change
+// (https://git.eeqj.de/sneak/AutistMask/issues/603). An answer while AddToken
+// still shows goes to AddressDetail. Driven through the real popup over a
+// stored profile.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+
+const TOKEN = {
+    address: TOKEN_ADDRESS,
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+
+// A second contract address, typed after AddToken was opened again.
+const OTHER_TOKEN_ADDRESS = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// The popup reopened onto AddressDetail, then AddToken opened from it with
+// TOKEN's contract address typed in.
+async function openAddToken() {
+    const boot = await bootPopup(
+        unversionedValidProfile({
+            currentView: "address",
+            selectedWallet: 0,
+            selectedAddress: 0,
+        }),
+    );
+    expect(boot.pageErrors).toEqual([]);
+    await boot.click("btn-add-token");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    boot.node("add-token-address").value = TOKEN.address;
+    return boot;
+}
+
+// Presses Add with a contract lookup that answers only when the function
+// returned here is called. That function waits for Add to finish.
+function addWithPendingLookup(boot) {
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let answer;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((resolve) => {
+                answer = resolve;
+            }),
+    );
+    const adding = boot.click("btn-add-token-confirm");
+    return async () => {
+        answer({
+            symbol: TOKEN.symbol,
+            decimals: TOKEN.decimals,
+            name: TOKEN.name,
+        });
+        await adding;
+    };
+}
+
+test("an answer after the user opened Settings adds the token and Settings stays", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+    await boot.click("btn-settings");
+    expect(boot.visibleViews()).toEqual(["settings"]);
+
+    await answerLookup();
+    expect(boot.visibleViews()).toEqual(["settings"]);
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});
+
+test("Back from Settings onto AddToken after the lookup answered shows no lookup status", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+    await boot.click("btn-settings");
+    await answerLookup();
+
+    await boot.click("btn-settings-back");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    expect(boot.text("add-token-info")).toBe("");
+    expect(boot.node("add-token-info").style.visibility).toBe("hidden");
+});
+
+test("an answer after AddToken was opened again adds the token and leaves AddToken and its status line as they are", async () => {
+    const boot = await openAddToken();
+    const answerFirstLookup = addWithPendingLookup(boot);
+    await boot.click("btn-add-token-back");
+    await boot.click("btn-add-token");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
+    // The second lookup is never answered.
+    addWithPendingLookup(boot);
+
+    await answerFirstLookup();
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});
+
+test("a lookup that fails after AddToken was opened again leaves the status line as it is", async () => {
+    const boot = await openAddToken();
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let failFirstLookup;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((_, reject) => {
+                failFirstLookup = reject;
+            }),
+    );
+    const firstAdd = boot.click("btn-add-token-confirm");
+    await boot.click("btn-add-token-back");
+    await boot.click("btn-add-token");
+    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
+    // The second lookup is never answered.
+    addWithPendingLookup(boot);
+
+    failFirstLookup(new Error("lookup failed"));
+    await firstAdd;
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+});
+
+test("an answer while AddToken still shows goes to AddressDetail with the token listed", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+
+    await answerLookup();
+    expect(boot.visibleViews()).toEqual(["address"]);
+    expect(boot.node("address-balances").innerHTML).toContain("TST");
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});

tests/addressKey.test.js

@@ -161,7 +161,7 @@ function click(element) {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 // ------------------------------------------------------------ harness
@@ -188,7 +188,11 @@ let sent;
 // handler to the buttons it drew, as the browser's fresh list would have.
 let plusButton;
 
+// showFlash() starts a timer that clears the message one or two seconds later.
+// Each test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     approvalDetails = null;
     sent = [];
     mockNode.broadcast = [];
@@ -239,6 +243,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+    jest.useRealTimers();
     jest.restoreAllMocks();
 });
 

tests/approvalAmount.test.js

@@ -90,11 +90,9 @@ beforeEach(() => {
 });
 
 describe("resolveTokenDecimals", () => {
-    // The bundled list is read only for a token on Ethereum Mainnet.
     test("prefers the bundled list", () => {
         state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenDecimals(USDC, sources)).toBe(6);
+        expect(resolveTokenDecimals(USDC, state)).toBe(6);
     });
 
     test("reads a token the user tracks", () => {
@@ -126,8 +124,7 @@ describe("resolveTokenDecimals", () => {
     // answers 0 is used rather than fallen past like the unusable entry above.
     test("uses a bundled scale of zero", () => {
         state.trackedTokens = [{ address: SLP, symbol: "SLP", decimals: 18 }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenDecimals(SLP, sources)).toBe(0);
+        expect(resolveTokenDecimals(SLP, state)).toBe(0);
     });
 
     test("uses a tracked scale of zero", () => {

tests/approvalBundledListSepolia.test.js

@@ -1,169 +0,0 @@
-// The approval screen for a site's Sepolia transfer of the contract at USDC's
-// mainnet address, while Sepolia is active.
-//
-// The bundled token list holds Ethereum Mainnet contracts. The contract at the
-// same address on Sepolia is another token, but the screen named it USDC and
-// scaled its amount at USDC's decimals
-// (https://git.eeqj.de/sneak/AutistMask/issues/632). The bundled list now names
-// a token only on Ethereum Mainnet. The same screen for a mainnet transfer of
-// USDC, while Sepolia is active, still names USDC.
-//
-// Driven through the real approval screen, against the minimal DOM stub
-// tests/approvalTokenNetwork.test.js uses.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { Interface } = require("ethers");
-const { state } = require("../src/shared/state");
-const { NETWORKS } = require("../src/shared/networks");
-const approval = require("../src/popup/views/approval");
-
-const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-// USDC's address on Ethereum Mainnet, where the bundled list names it.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-
-// FROM sends 1234500000 base units to RECIPIENT.
-const TRANSFER_DATA = new Interface([
-    "function transfer(address to, uint256 amount)",
-]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
-
-function makeElement(id) {
-    const classes = new Set();
-    const el = {
-        id,
-        textContent: "",
-        value: "",
-        innerHTML: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        listeners: {},
-        classList: {
-            add: (...names) => names.forEach((n) => classes.add(n)),
-            remove: (...names) => names.forEach((n) => classes.delete(n)),
-            contains: (n) => classes.has(n),
-            toggle: (n, force) => {
-                const on = force === undefined ? !classes.has(n) : force;
-                if (on) classes.add(n);
-                else classes.delete(n);
-                return on;
-            },
-        },
-        addEventListener: (name, fn) => {
-            el.listeners[name] = el.listeners[name] || [];
-            el.listeners[name].push(fn);
-        },
-        querySelectorAll: () => [],
-        appendChild: () => {},
-    };
-    // Views reach for .parentElement to hide whole sections.
-    Object.defineProperty(el, "parentElement", {
-        get: () => node(id + "-parent"),
-    });
-    return el;
-}
-
-function makeDocument() {
-    const els = new Map();
-    return {
-        getElementById(id) {
-            // The debug banner is created on demand by helpers.js; absent
-            // is the state a non-debug, non-testnet popup is in.
-            if (id === "debug-banner") return null;
-            if (!els.has(id)) els.set(id, makeElement(id));
-            return els.get(id);
-        },
-        createElement: () => makeElement("created"),
-        body: { prepend: () => {} },
-    };
-}
-
-function node(id) {
-    return globalThis.document.getElementById(id);
-}
-
-// One line of the decoded details: its label and what is drawn under it.
-function decodedLine(label) {
-    return node("approve-tx-decoded-details")
-        .innerHTML.split('<div class="mb-2">')
-        .find((line) =>
-            line.startsWith(`<div class="text-muted">${label}</div>`),
-        );
-}
-
-// Open the approval screen, with Sepolia active, for the site's transaction
-// sending TRANSFER_DATA to the contract at USDC's address on the network with
-// chain id `chainId`.
-async function showTransfer(chainId) {
-    globalThis.document = makeDocument();
-    globalThis.window = { location: { search: "" }, close: () => {} };
-    globalThis.chrome.runtime = {
-        connect: () => ({ postMessage: () => {} }),
-        sendMessage: (msg, reply) => {
-            if (!reply) return;
-            reply({
-                type: "tx",
-                origin: "https://dapp.example",
-                isPhishingDomain: false,
-                approvedFrom: FROM,
-                approvedTx: {
-                    type: 2,
-                    from: FROM,
-                    chainId,
-                    nonce: "0x7",
-                    gasLimit: "0x30d40",
-                    maxPriorityFeePerGas: "0x3b9aca00",
-                    maxFeePerGas: "0x77359400",
-                    to: USDC,
-                    value: "0x0",
-                    data: TRANSFER_DATA,
-                    accessList: [],
-                },
-            });
-        },
-    };
-    state.networkId = "sepolia";
-    state.trackedTokens = [];
-    state.networkTrackedTokens = {};
-    state.activeAddress = FROM;
-    state.wallets = [
-        {
-            type: "hd",
-            name: "Wallet 1",
-            xpub: "xpub-wallet-1",
-            encryptedSecret: "encrypted-secret-1",
-            nextIndex: 1,
-            addresses: [
-                { address: FROM, index: 0, balance: "0", tokenBalances: [] },
-            ],
-        },
-    ];
-    state.currentView = null;
-    approval.init({});
-    await approval.show(1);
-}
-
-test("names no token, and states the amount in base units", async () => {
-    await showTransfer(NETWORKS.sepolia.chainId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(node("approve-tx-to").innerHTML).not.toContain("USDC");
-    expect(decodedLine("Token")).toContain(
-        '<div class="font-bold">Unknown token</div>',
-    );
-    expect(decodedLine("Amount")).toContain(
-        '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
-    );
-});
-
-// A transaction is named for its own network, not the active one.
-test("a mainnet transfer of USDC is still named and scaled as USDC", async () => {
-    await showTransfer(NETWORKS.mainnet.chainId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(decodedLine("Token")).toContain('<div class="font-bold">USDC</div>');
-    expect(decodedLine("Amount")).toContain(
-        '<div class="font-bold">1234.5000 USDC</div>',
-    );
-});

tests/backgroundApproval.test.js

@@ -537,7 +537,18 @@ async function settleIncludingRejections() {
     await new Promise((resolve) => setImmediate(resolve));
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });
@@ -1883,18 +1894,6 @@ describe("a closed approval window leaves the request pending", () => {
         return bg.actionPopups[bg.actionPopups.length - 1];
     }
 
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
     test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();

tests/backgroundStateIsolation.test.js

@@ -103,7 +103,18 @@ function deferred() {
     return { promise, resolve };
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/bundledListScreens.test.js

@@ -1,81 +0,0 @@
-// The token screen, the Send screen and the confirmation screen for the
-// contract at USDC's mainnet address. No address holds it and the user does
-// not track it, so only the bundled token list can name it.
-//
-// The bundled token list holds Ethereum Mainnet contracts, so these screens
-// name the token from it on Ethereum Mainnet only
-// (https://git.eeqj.de/sneak/AutistMask/issues/632). Driven through the real
-// popup over a stored profile.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressToken for USDC's address, on `networkId`.
-function bootOnToken(networkId) {
-    return bootPopup(
-        unversionedValidProfile({
-            networkId,
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            selectedToken: USDC,
-        }),
-    );
-}
-
-// AddressToken's Send, then Review for 1 token to RECIPIENT.
-async function reviewSend(boot) {
-    await boot.click("btn-address-token-send");
-    expect(boot.visibleViews()).toEqual(["send"]);
-    boot.node("send-to").value = RECIPIENT;
-    boot.node("send-amount").value = "1";
-    await boot.click("btn-send-review");
-    expect(boot.visibleViews()).toEqual(["confirm-tx"]);
-}
-
-describe("on Ethereum Mainnet, the bundled list names the token", () => {
-    test("on the token screen", async () => {
-        const boot = await bootOnToken("mainnet");
-        expect(boot.visibleViews()).toEqual(["address-token"]);
-        expect(boot.text("address-token-title")).toContain("USDC");
-        const info = boot.node("address-token-contract-info").innerHTML;
-        expect(info).toContain(
-            '<span class="text-muted">Decimals:</span> 6</div>',
-        );
-    });
-
-    test("on the Send screen and the confirmation screen", async () => {
-        const boot = await bootOnToken("mainnet");
-        await reviewSend(boot);
-        expect(boot.text("send-balance")).toContain("USDC");
-        expect(boot.text("confirm-amount")).toContain("USDC");
-    });
-});
-
-describe("with Sepolia active, the bundled list does not name the token", () => {
-    test("on the token screen", async () => {
-        const boot = await bootOnToken("sepolia");
-        expect(boot.visibleViews()).toEqual(["address-token"]);
-        expect(boot.text("address-token-title")).not.toContain("USDC");
-        const info = boot.node("address-token-contract-info").innerHTML;
-        expect(info).not.toContain("Decimals:");
-    });
-
-    test("on the Send screen and the confirmation screen", async () => {
-        const boot = await bootOnToken("sepolia");
-        await reviewSend(boot);
-        expect(boot.text("send-balance")).not.toContain("USDC");
-        expect(boot.text("confirm-amount")).not.toContain("USDC");
-    });
-});

tests/chainSwitchGate.test.js

@@ -56,7 +56,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerChainSwitch.test.js

@@ -64,7 +64,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerSendTransaction.test.js

@@ -76,7 +76,18 @@ async function settle() {
     for (let i = 0; i < 60; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/connectedSitesWorkerRestart.test.js

@@ -57,7 +57,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });

tests/deleteWalletLostPassword.test.js

@@ -102,6 +102,17 @@ function makeDocument() {
 
 // ------------------------------------------------------------ harness
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
+beforeEach(() => {
+    jest.useFakeTimers();
+});
+
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 function wallet(name, secret, addresses) {
     return {
         type: "hd",

tests/fabricatedDecimals.test.js

@@ -111,15 +111,13 @@ function respondWith(items) {
 }
 
 // Fetch and place the result exactly where refreshBalances() places it, so the
-// approval screens read what a real refresh on Ethereum Mainnet would have
-// left on state.
+// approval screens read what a real refresh would have left on state.
 async function fetchOnto(items, trackedTokens = []) {
     respondWith(items);
     const balances = await fetchTokenBalances(
         HOLDER,
         BLOCKSCOUT,
         trackedTokens,
-        "0x1",
     );
     state.trackedTokens = trackedTokens;
     state.wallets = [

tests/holders.test.js

@@ -192,13 +192,7 @@ describe("the balance-list spam gate", () => {
                 },
             }),
         ]);
-        // On Ethereum Mainnet, the only network the known-token list covers.
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            "0x1",
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBeNull();
     });

tests/resolveTokenSymbol.test.js

@@ -67,15 +67,13 @@ beforeEach(() => {
 });
 
 describe("resolveTokenSymbol", () => {
-    // The bundled list is read only for a token on Ethereum Mainnet.
     test("reads the bundled list", () => {
-        expect(resolveTokenSymbol(USDC, { chainId: "0x1" })).toBe("USDC");
+        expect(resolveTokenSymbol(USDC, state)).toBe("USDC");
     });
 
     test("prefers the bundled list over a tracked entry", () => {
         state.trackedTokens = [{ address: USDC, symbol: "NOTUSDC" }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenSymbol(USDC, sources)).toBe("USDC");
+        expect(resolveTokenSymbol(USDC, state)).toBe("USDC");
     });
 
     test("reads a token the user tracks", () => {
@@ -106,19 +104,7 @@ describe("resolveTokenSymbol", () => {
     test("rejects a tracked entry claiming a bundled ticker it is not", () => {
         // NOVEL_TOKEN is not the real USDC contract, so it may not wear USDC.
         state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBeNull();
-    });
-
-    // The bundled list holds mainnet contracts, so on Sepolia any contract may
-    // carry one of its symbols.
-    test("on Sepolia, reads a tracked entry carrying a bundled ticker", () => {
-        state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
-        const sources = {
-            chainId: "0xaa36a7",
-            trackedTokens: state.trackedTokens,
-        };
-        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBe("USDC");
+        expect(resolveTokenSymbol(NOVEL_TOKEN, state)).toBeNull();
     });
 
     test("rejects an explorer entry claiming the native ETH ticker", () => {

tests/sendAmountRule.test.js

@@ -131,10 +131,14 @@ async function review(amount, token) {
 async function confirm(amount, token) {
     const txInfo = await review("0.5", token);
     confirmTx.show({ ...txInfo, amount });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     state.wallets = [
         {
@@ -167,6 +171,10 @@ beforeEach(() => {
     state.currentView = null;
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe.each([
     ["1e-3", "ETH"],
     ["1e-3", "TOK"],

tests/sendMax.test.js

@@ -277,14 +277,18 @@ async function review() {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 function canSend() {
     return !el("btn-confirm-send").disabled;
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     log.errorf.mockClear();
     pageClosed = new AbortController();
@@ -297,6 +301,10 @@ beforeEach(() => {
     mockNode.broadcast = [];
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe("Max on an ETH send", () => {
     test("fills in the exact balance minus the fee reserve", async () => {
         await refreshWith(BALANCE_WEI);

tests/symbolSpoof.test.js

@@ -72,11 +72,6 @@ const {
 const { renderSendTokenSelect } = require("../src/popup/views/send");
 const { state } = require("../src/shared/state");
 const { debugFetch } = require("../src/shared/log");
-const { NETWORKS } = require("../src/shared/networks");
-
-// The bundled list's symbols are known symbols only on Ethereum Mainnet.
-const MAINNET = NETWORKS.mainnet.chainId;
-const SEPOLIA = NETWORKS.sepolia.chainId;
 
 // The fake "Ethereum" token with symbol "ETH" from the attack documented in
 // README.md, given a holder count high enough to clear every other filter so
@@ -121,29 +116,14 @@ describe("the shared rule", () => {
     });
 
     test("a known symbol from its own contract is not a spoof", () => {
-        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, MAINNET)).toBe(false);
-        expect(
-            isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase(), MAINNET),
-        ).toBe(false);
+        expect(isSpoofedSymbol("USDC", USDC_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase())).toBe(
+            false,
+        );
     });
 
     test("a known symbol from another contract is a spoof", () => {
-        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, MAINNET)).toBe(true);
-    });
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry one of its
-    // symbols.
-    test("on Sepolia, a bundled symbol from any contract is not a spoof", () => {
-        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(false);
-        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, SEPOLIA)).toBe(false);
-    });
-
-    test("on Sepolia, the native asset's labels are still reserved", () => {
-        expect(isSpoofedSymbol("ETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(true);
-        expect(isSpoofedSymbol("SepoliaETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(
-            true,
-        );
+        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     test("a symbol that is not in the table is not judged here", () => {
@@ -184,9 +164,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     test("ASCII padding does not buy a pass", () => {
         expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
         expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT, MAINNET)).toBe(
-            true,
-        );
+        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     test("non-breaking and other Unicode spaces do not either", () => {
@@ -265,9 +243,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 
     test("compatibility forms fold onto the symbol they imitate", () => {
         expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
-        expect(
-            isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT, MAINNET),
-        ).toBe(true);
+        expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     // The two knowingly open classes, asserted here so that the boundary is
@@ -295,10 +271,8 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     });
 
     test("a genuine contract still bears its own padded symbol", () => {
-        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT, MAINNET)).toBe(false);
-        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT, MAINNET)).toBe(
-            false,
-        );
+        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
     });
 
     // Normalization must not invent a match.  Interior ASCII whitespace is
@@ -322,7 +296,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
             expect(symbol).toMatch(/^[!-~]+$/);
             if (addresses === null) continue;
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address)).toBe(false);
             }
         }
     });
@@ -343,7 +317,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 describe("the shipped token list", () => {
     test("no bundled token is filtered at its own address", () => {
         const filtered = TOKENS.filter((t) =>
-            isSpoofedSymbol(t.symbol, t.address, MAINNET),
+            isSpoofedSymbol(t.symbol, t.address),
         ).map((t) => t.symbol + " @ " + t.address);
         expect(filtered).toEqual([]);
     });
@@ -386,9 +360,7 @@ describe("the shipped token list", () => {
         expect(shared.length).toBeGreaterThan(0);
         for (const [, list] of shared) {
             for (const t of list) {
-                expect(isSpoofedSymbol(t.symbol, t.address, MAINNET)).toBe(
-                    false,
-                );
+                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
             }
         }
     });
@@ -432,7 +404,7 @@ describe("the shipped token list", () => {
                 [...addresses].sort(),
             );
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address)).toBe(false);
             }
         }
     });
@@ -449,9 +421,7 @@ describe("the shipped token list", () => {
         }
         for (const [symbol, list] of bySymbol) {
             if (list.length < 2) continue;
-            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT, MAINNET)).toBe(
-                true,
-            );
+            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
         }
     });
 });
@@ -536,40 +506,10 @@ describe("surface 2: the Send token selector", () => {
     }
 
     beforeEach(() => {
-        state.networkId = "mainnet";
         state.fraudContracts = [];
         state.hideLowHolderTokens = true;
     });
 
-    afterAll(() => {
-        state.networkId = "mainnet";
-    });
-
-    // A token reporting USDC's symbol from another contract.
-    function otherUsdc() {
-        return {
-            address: FAKE_ETH_CONTRACT,
-            symbol: "USDC",
-            decimals: 6,
-            balance: "12.5",
-            holders: 900000,
-        };
-    }
-
-    test("a bundled symbol from another contract is not selectable", () => {
-        render([otherUsdc()]);
-        expect(select.children).toEqual([]);
-    });
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry its symbols.
-    test("with Sepolia active, a bundled symbol from another contract is selectable", () => {
-        state.networkId = "sepolia";
-        render([otherUsdc()]);
-        expect(select.children).toHaveLength(1);
-        expect(select.children[0].value).toBe(FAKE_ETH_CONTRACT);
-    });
-
     test("a fake ETH token is not selectable", () => {
         render([
             {
@@ -687,12 +627,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            MAINNET,
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -706,40 +641,11 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            MAINNET,
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry its symbols.
-    test("a bundled symbol from another contract is listed on Sepolia only", async () => {
-        respondWith([fakeEthItem({ symbol: "USDC", decimals: "6" })]);
-        expect(
-            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], MAINNET),
-        ).toEqual([]);
-        const sepolia = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            SEPOLIA,
-        );
-        expect(sepolia).toHaveLength(1);
-        expect(sepolia[0].symbol).toBe("USDC");
-    });
-
-    test("a fake ETH token is filtered on Sepolia too", async () => {
-        respondWith([fakeEthItem()]);
-        expect(
-            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], SEPOLIA),
-        ).toEqual([]);
-    });
-
     // The trap in this change: the user's real ETH balance is not an ERC-20
     // and is fetched over RPC in refreshBalances, so it never passes through
     // this loop at all.  An explorer row that is not an ERC-20 is dropped

tests/trackedTokenBalances.test.js

@@ -133,13 +133,13 @@ function trackedRow(balance, decimals = null, holders = null) {
     };
 }
 
-async function refresh(addresses, trackedTokens, networkId = "mainnet") {
+async function refresh(addresses, trackedTokens) {
     await refreshBalances(
         [{ addresses }],
         RPC_URL,
         EXPLORER_URL,
         trackedTokens,
-        networkId,
+        "mainnet",
         new AbortController().signal,
     );
     return addresses;
@@ -307,76 +307,3 @@ test("a tracked token wearing a known symbol from another contract is not listed
     );
     expect(first.tokenBalances).toEqual([]);
 });
-
-// https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-// Ethereum Mainnet contracts. A token outside the tracked tokens with an
-// unknown holder count is listed only when the bundled list names it.
-test("an untracked bundled token with an unknown holder count is listed on Ethereum Mainnet only", async () => {
-    explorerRows = [explorerRow(USDC, "USDC", 5000000, null)];
-    const [mainnet] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [],
-    );
-    expect(mainnet.tokenBalances).toEqual([
-        {
-            address: USDC,
-            name: "USDC",
-            symbol: "USDC",
-            decimals: 6,
-            balance: "5.0",
-            holders: null,
-        },
-    ]);
-    const [sepolia] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [],
-        "sepolia",
-    );
-    expect(sepolia.tokenBalances).toEqual([]);
-});
-
-test("a tracked token at a bundled token's address takes the bundled scale on Ethereum Mainnet only", async () => {
-    holdings[USDC] = { [FIRST]: 5000000n };
-    // The tracked entry records no decimals, and Blockscout fails.
-    const tracked = [
-        { address: USDC, symbol: "USDC", name: "USD Coin", decimals: null },
-    ];
-    const row = (balance) => ({
-        address: USDC,
-        name: "USD Coin",
-        symbol: "USDC",
-        decimals: null,
-        balance: balance,
-        holders: null,
-    });
-    const [mainnet] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        tracked,
-    );
-    expect(mainnet.tokenBalances).toEqual([row("5.0")]);
-    const [sepolia] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        tracked,
-        "sepolia",
-    );
-    expect(sepolia.tokenBalances).toEqual([row(null)]);
-});
-
-test("with Sepolia active, a tracked token wearing a bundled symbol from another contract is listed", async () => {
-    holdings[OTHER] = { [FIRST]: 5000000n };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [{ address: OTHER, symbol: "USDC", name: "Other", decimals: 6 }],
-        "sepolia",
-    );
-    expect(first.tokenBalances).toEqual([
-        {
-            address: OTHER,
-            name: "Other",
-            symbol: "USDC",
-            decimals: null,
-            balance: "5.0",
-            holders: null,
-        },
-    ]);
-});

tests/transactions.test.js

@@ -144,7 +144,6 @@ function tokenTx(overrides = {}) {
         isError: false,
         contractAddress: USDC_CONTRACT,
         holders: 3500000,
-        chainId: "0x1",
         ...overrides,
     };
 }
@@ -260,32 +259,6 @@ describe("known-symbol spoof verification", () => {
         expect(result.newFraudContracts).toEqual([NOVEL_SPAM_CONTRACT]);
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so its symbols are not known symbols on Sepolia.
-    test("on Sepolia, a bundled symbol from another contract is kept", () => {
-        const sepoliaToken = tokenTx({
-            symbol: "USDC",
-            contractAddress: NOVEL_SPAM_CONTRACT,
-            holders: 5000000,
-            chainId: "0xaa36a7",
-        });
-        const result = filterTransactions([sepoliaToken], filters());
-        expect(result.transactions).toEqual([sepoliaToken]);
-        expect(result.newFraudContracts).toEqual([]);
-    });
-
-    test('on Sepolia, "ETH" as an ERC-20 is still spoofed', () => {
-        const fakeEth = tokenTx({
-            symbol: "ETH",
-            contractAddress: NOVEL_SPAM_CONTRACT,
-            holders: 5000000,
-            chainId: "0xaa36a7",
-        });
-        expect(filterTransactions([fakeEth], filters()).transactions).toEqual(
-            [],
-        );
-    });
-
     test("the genuine contract for that symbol is not spoofed", () => {
         const genuine = tokenTx();
         const result = filterTransactions([genuine], filters());
@@ -1522,41 +1495,6 @@ describe("fetchRecentTransactions merge and dedup", () => {
         expect(mainnet[0].chainId).toBe("0x1");
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled token list
-    // names a contract only on Ethereum Mainnet. On Sepolia, a call to the
-    // contract at USDC's mainnet address is labelled with the network's native
-    // currency. A call to any contract the wallet does not name gets that label.
-    test("a contract call on Sepolia is not named by the bundled list", async () => {
-        respondWith(
-            [
-                {
-                    hash: "0x" + "b".repeat(64),
-                    block_number: 21000095,
-                    timestamp: TS,
-                    from: { hash: VICTIM },
-                    to: { hash: USDC_CONTRACT, is_contract: true },
-                    value: "0",
-                    method: "approve",
-                    status: "ok",
-                },
-            ],
-            [],
-        );
-        const sepolia = await fetchRecentTransactions(
-            VICTIM,
-            BLOCKSCOUT,
-            "0xaa36a7",
-        );
-        expect(sepolia[0].directionLabel).toBe("Approve");
-        expect(sepolia[0].symbol).toBe("SepoliaETH");
-        const mainnet = await fetchRecentTransactions(
-            VICTIM,
-            BLOCKSCOUT,
-            "0x1",
-        );
-        expect(mainnet[0].symbol).toBe("USDC");
-    });
-
     test("the fake token transfer survives fetching and is then filtered", async () => {
         respondWith(
             [],

tests/unknownScaleSend.test.js

@@ -167,8 +167,7 @@ function row(token = {}, value = FIVE_WETH) {
 }
 
 // Fetch the explorer's rows through the real fetcher and put them exactly where
-// refreshBalances() puts them on Ethereum Mainnet. The node reports the holding
-// the explorer does.
+// refreshBalances() puts them. The node reports the holding the explorer does.
 async function fetchOnto(items) {
     mockProvider.tokenUnits = BigInt(items[0].value);
     debugFetch.mockImplementation(async () => ({
@@ -177,7 +176,7 @@ async function fetchOnto(items) {
         statusText: "OK",
         json: async () => items,
     }));
-    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], "0x1");
+    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
     state.wallets = [
         {
             name: "Wallet 1",

tests/walletDefects.test.js

@@ -357,6 +357,11 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     beforeEach(() => {
+        // showFlash() starts a timer that clears the message two seconds
+        // later. Each test here runs on fake timers and drops them in
+        // afterEach, so that timer never outlives the test.
+        jest.useFakeTimers();
+
         const broken = brokenXprvWallet();
         // A balance, so that no Send button's zero-balance refusal can stand
         // in for the defect check.
@@ -398,6 +403,7 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     afterEach(() => {
+        jest.useRealTimers();
         state.wallets = [];
         state.activeAddress = null;
         state.selectedWallet = null;