fix: two pages switching networks no longer lose tracked tokens (closes #701)

A page that had not yet taken another page's network switch could lose
tracked tokens in two ways.

- Its save of an added or removed token wrote its own network's list as
  the new network's list. saveState() now keeps the stored list. It
  makes the add or removal in the list of the page's own network, which
  the stored record keeps in networkTrackedTokens.
- Its own switch in Settings wrote its old lists of tracked tokens per
  network over the stored ones. onChainSwitch() now first takes the
  stored switch with takeStoredNetwork(), as followStoredSettings() does,
  and then switches from there.

Model: opus-5-5

Dockerfile

@@ -10,7 +10,6 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
-# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .

README.md

@@ -2053,21 +2053,15 @@ view would leave a wallet one click from deletion.
       fee estimate and the contract and never-sent recipient checks ask that
       network's RPC endpoint, and the Etherscan label check asks that network's
       explorer
-    - "Sign & Send" (correct password) when the gas limit or a fee is over its
+    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
-      bound → nothing is signed; "The gas limit or fee the RPC endpoint quoted
+      total fee the RPC endpoint fills in at signing is over its bound in
-      for this transaction is more than this wallet will sign for, so it was not
+      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
-      sent. Please go back and try again." in its own box, no screen change. For
+      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
-      an ETH amount that Send's "Max" filled in, the gas limit and fees are
+      is more than this wallet will sign for, so it was not sent. Please go back
-      those of this screen's own fee estimate (see Amount above). For any other
+      and try again." in its own box, the same sentence for all three, no screen
-      send, the RPC endpoint fills in the gas limit and fees at signing. Just
+      change
-      before signing, `assertWithinCeilings()` (`src/shared/approvalVerify.js`)
+    - "Sign & Send" (wrong password) → "Wrong password." on the password error
-      refuses the send when any of these is over its bound:
+      line, no screen change
-        - the gas limit
-        - each fee per gas the transaction sets
-        - the total fee: the gas limit times `maxFeePerGas`, or times `gasPrice`
-          when the transaction has no `maxFeePerGas`
-    - "Sign & Send" (wrong password) → "That password is incorrect. Please try
-      again." on the password error line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
       selected: the two are saved separately, so the popup can reopen onto this
       screen with another address selected. When the selected wallet does not
@@ -2239,8 +2233,6 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
-    - "Add", then the contract lookup answers while another screen shows, or
-      after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
       answers → nothing is tracked; "The active network changed before the
       lookup finished, so the token was not added." flash message, no screen

docs/RELEASE.md

@@ -1,228 +1,87 @@
 # Releasing AutistMask
 
-A release is a tagged commit on the `main` branch and the two archives that
+This is the procedure that turns a green `main` into a tagged, packaged release.
-`make package` writes from that commit. This file is the procedure, in order.
+It gathers into one place what is otherwise spread across the `Makefile` and
+three `README.md` sections, so the person cutting a release does not have to
+reconstruct the order from them.
 
-Only the owner ([@sneak](https://sneak.berlin)):
+There is one version, declared in three files (`package.json`,
-
+`manifest/chrome.json`, `manifest/firefox.json`), and `make package` builds and
-- decides whether and when a release is tagged;
+packages but publishes nothing. `make build` and `make package` can be run by
-- creates, moves or deletes a tag;
+anyone; tagging, signing, packing a CRX and any upload need credentials only the
-- decides where the archives are published.
+owner ([@sneak](https://sneak.berlin)) holds and are marked **owner-only**
-
+below. Releases are tagged from `main` (see the Workflow section of `TODO.md`),
-Anyone can run steps 1 to 4. No script in this repository uploads or publishes
+so the "release commit" throughout is the `main` commit the milestone PR merged.
-the archives. None signs them, and none packs a CRX (Chrome's packaged extension
-file).
-
-## Terms
-
-- The tracker is the repository's Gitea site (Gitea is the software that hosts
-  the repository): https://git.eeqj.de/sneak/AutistMask. The tracker's Actions
-  page, https://git.eeqj.de/sneak/AutistMask/actions, lists the workflow runs.
-- A workflow is a file under `.gitea/workflows/` that lists jobs. The tracker
-  runs every workflow on each push. Each job runs one script on the tracker's
-  runner (the machine that runs jobs).
-- The release commit is a commit on `main`. Releases are tagged from `main` only
-  (`TODO.md`, Workflow).
-- A clean checkout is a working tree (the checked-out files) at the release
-  commit where `git status --porcelain` prints nothing. The build stamps the
-  commit hash (the commit's id) into the extension and appends `-dirty` when the
-  tree has local changes.
-- A tag is a name that git attaches to one commit. Release tags read `vX.Y.Z`,
-  such as `v0.1.0`.
-- A digest is the sha256 hash of a file (a fixed-length fingerprint of its
-  bytes), written as 64 hexadecimal characters.
-
-## What you need
-
-- A clean checkout of the release commit.
-- `make`.
-- Docker (a tool that runs programs in containers), for `script/cibuild` in
-  step 1. `make package` needs no Docker.
-- Node and yarn. Both come from the system when present. Otherwise
-  `script/bootstrap` installs Node through a pinned (fixed-version) install of
-  nvm, a Node version manager. `script/bootstrap` installs yarn through corepack
-  (Node's package manager installer). When no corepack is found,
-  `script/bootstrap` installs yarn through `npm` (Node's package manager).
 
 ## Procedure
 
-### 1. Confirm the release commit is green
+1. **Confirm `main` is green in CI.** The `check` workflow
+   (`.gitea/workflows/check.yml`) runs `script/cibuild`, which runs
+   `script/check` and then builds the image uncached, so a green `check` run is
+   a green `make check`. Find the run for the exact release commit on the
+   tracker's Actions view. _Check:_ that commit's `check` run succeeded; running
+   `make check` on a clean checkout of the commit reproduces it and exits 0.
 
-The `check` workflow (`.gitea/workflows/check.yml`) runs `script/cibuild` on
+2. **Confirm the version matches the intended tag.** `package.json`,
-every push. `script/cibuild` runs:
+   `manifest/chrome.json` and `manifest/firefox.json` must all declare the same
+   `X.Y.Z`. `make build` fails when they disagree, but nothing checks that they
+   equal the tag you mean to create — that is this manual step. _Check:_ all
+   three files read the same `X.Y.Z`, and it is the version you intend to tag
+   `vX.Y.Z`.
 
-- `script/bootstrap`, which installs the dependencies;
+3. **Build and package from a clean checkout of that commit.** From a fresh
-- `script/check`, which is what `make check` runs;
+   clone, or a working tree with no local modifications (`git status` clean),
-- the Docker image build (an image is Docker's packaged form of a program).
+   checked out at the release commit: run `make setup`, then `make package`.
+   `make package` runs `make build` first, so the archives can only be made from
+   a `dist/` verified against that build's own receipt as a release (not debug)
+   build. It writes three files into `release/`:
+   `autistmask-chrome-<version>.zip`, `autistmask-firefox-<version>.xpi`, and
+   `SHA256SUMS`. _Check:_ those three files exist and `<version>` in the archive
+   names is the version confirmed in step 2. The Firefox `.xpi` is **unsigned**
+   (see step 6 and "Installing on Firefox" in `README.md`).
 
-`script/check` runs:
+4. **Verify `SHA256SUMS`.** The archives are deterministic — sorted entries,
+   fixed timestamps, fixed compression — so a second `make package` from another
+   clean checkout of the same commit produces byte-identical files. Verify the
+   recorded digests against the files with `sha256sum -c SHA256SUMS`, run from
+   `release/`. To confirm reproducibility, run `make package` again on a
+   separate clean checkout and compare the digests. _Check:_ `sha256sum -c`
+   reports `OK` for every file, and an independent build's digests match.
 
-- `script/test`: the tests, in Docker;
+5. **Tag the release commit.** _(owner-only)_ Create an annotated tag `vX.Y.Z`
-- `script/lint`, which runs three checks in Docker:
+   on the release commit and push it: `git tag -a vX.Y.Z` (with a message), then
-    - ESLint, a code checker;
+   `git push origin vX.Y.Z`. _Check:_ `git tag` lists `vX.Y.Z`, and
-    - `prettier --check .`, the formatting check;
+   `git rev-parse vX.Y.Z^{commit}` resolves to the release commit.
-    - `script/check-censored`, which fails when the name that `RULES.md` bars
-      appears outside its allowed places;
-- `script/fmt-check`: `prettier --check .` again, on the host.
 
-The `e2e` workflow (`.gitea/workflows/e2e.yml`) has two jobs. One runs
+6. **Distribute per browser.** _(owner-only; pending the owner's choice on
-`script/test-e2e`, the browser tests in Chrome. The other runs
+   https://git.eeqj.de/sneak/AutistMask/issues/386)_ How 1.0.0 is distributed on
-`script/test-e2e-firefox`, the browser tests in Firefox. A red `e2e` job does
+   each browser is not yet decided; it is the open question on that issue, and
-not fail the `check` run.
+   the concrete steps cannot be written until the owner records a choice there.
+   These steps need credentials only the owner holds. The options under
+   consideration are:
+    - **Firefox** — the packaged `.xpi` is unsigned, and release Firefox and ESR
+      refuse an unsigned add-on:
+        - (a) AMO self-distribution signing (unlisted): submit the `.xpi` to AMO
+          with the owner's credentials; AMO returns a signed `.xpi` installable
+          on every Firefox, with nothing listed publicly.
+        - (b) AMO listed: as (a), plus a public AMO listing and review.
+        - (c) Ship the unsigned `.xpi` and state that Firefox support means
+          Developer Edition, Nightly, or an Unbranded build with
+          `xpinstall.signatures.required` set to `false`.
+    - **Chrome** — the repo packs no CRX and publishes nothing; the extension id
+      is fixed by the `key` in `manifest/chrome.json`:
+        - (a) Chrome Web Store (unlisted): upload the `.zip` with the owner's
+          developer account; the store delivers installs and updates.
+        - (b) Self-hosted CRX signed with the private key the owner holds
+          (`chrome --pack-extension=dist/chrome --pack-extension-key=<path to the .pem>`),
+          installable only via enterprise policy on Windows and macOS, so
+          realistically Linux-only.
+        - (c) "Load unpacked" from `dist/chrome/` only, as today.
 
-Run `script/cibuild` on the clean checkout. `script/cibuild` runs the same steps
+    Once the owner decides, the chosen steps — including which credentials they
-as the `check` run, and must exit 0.
+    need and who holds them — are written into this section and `README.md`'s
-
+    installation sections are updated to match, which is part of the definition
-Check: on the Actions page, the `check` run for the release commit succeeded,
+    of done of https://git.eeqj.de/sneak/AutistMask/issues/386. _Check:_ for a
-and both `e2e` jobs for that commit succeeded. `script/cibuild` exited 0 on the
+    store or AMO route, the artifact installs from the store or AMO on a clean
-clean checkout.
+    browser profile; for the CRX or unpacked route, the documented load succeeds
-
+    and Chrome reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`.
-### 2. Confirm the version
-
-Three files declare the version:
-
-- `package.json`;
-- `manifest/chrome.json`;
-- `manifest/firefox.json`.
-
-`script/lib/version.js` fails the build when the three disagree.
-`tests/version.test.js` fails when the version is not three numbers separated by
-dots. Nothing compares the version with a tag. That comparison is this step.
-
-Check: all three files read the same `X.Y.Z`, and `vX.Y.Z` is the tag that the
-owner creates in step 5.
-
-### 3. Build and package
-
-On the clean checkout, run:
-
-```bash
-make setup
-make package
-```
-
-`make setup` installs two things:
-
-- the dependencies, from the lockfile `yarn.lock`, which pins each one's
-  version;
-- the git pre-commit hook, a script that git runs before each commit. Here the
-  hook runs `script/check`.
-
-`make package` runs `make build`, then `script/lib/package.js`.
-
-`make build`:
-
-- runs `build.js`. `build.js` writes `dist/chrome/`, `dist/firefox/` and a build
-  receipt. The receipt lists every file that `build.js` wrote, with each file's
-  digest. The receipt lives outside the repository and is deleted when the build
-  ends;
-- runs `script/verify-build --expect release` against the receipt. The check
-  fails when:
-    - `dist/` differs from the receipt;
-    - a bundle (one JavaScript file built from many source files) was compiled
-      with the build-time constant `DEBUG` on;
-    - any file carries the test recovery phrase, which a debug build gives every
-      new wallet;
-- runs `script/check-censored --require-dist` against the built files;
-- removes `dist/` when any of those steps fails.
-
-`script/lib/package.js`:
-
-- empties `release/`;
-- refuses a symbolic link (a file that points at another file) under `dist/`;
-- checks that the archive is self-contained: every file that the manifest or the
-  popup's HTML page names is inside the browser's directory (`dist/chrome/` or
-  `dist/firefox/`). The manifest is `manifest.json`, the file that describes the
-  extension to the browser. The popup is the window that the toolbar button
-  opens;
-- checks that the `version` in each `manifest.json` is the version from step 2;
-- writes one archive per browser;
-- reads each archive back;
-- compares every member (a file inside the archive) with `dist/` byte for byte;
-- writes `SHA256SUMS`, with one line per archive:
-    - the digest;
-    - two spaces;
-    - the file name.
-
-`make package` writes three files:
-
-```
-release/autistmask-chrome-<version>.zip
-release/autistmask-firefox-<version>.xpi
-release/SHA256SUMS
-```
-
-The `.xpi` is Firefox's add-on package file (an add-on is Firefox's word for an
-extension). The `.xpi` is not signed.
-
-`make package` prints a line that starts `Not shipped` and names `styles.css`.
-This is expected: each archive holds its own copy of the stylesheet.
-
-Check: `release/` holds those three files, and `<version>` in their names is the
-version from step 2.
-
-### 4. Verify the digests
-
-From `release/`, run `sha256sum -c SHA256SUMS`.
-
-The archives are deterministic for a given `dist/`: the same `dist/` always
-gives the same bytes. `script/lib/zip.js`:
-
-- sorts the members;
-- sets every member's timestamp (its recorded date) to 1980-01-01;
-- compresses each member the same way every time.
-
-`dist/` itself carries the build date. `build.js` compiles the build date, a UTC
-(universal time) day, into the extension. So two builds of the same commit on
-the same UTC day give byte-identical archives. Builds on different days differ.
-
-Check: `sha256sum -c` prints `OK` for both archives. On the same UTC day, a
-second `make package` from another clean checkout of the same commit gives the
-same `SHA256SUMS`.
-
-### 5. Tag the release commit
-
-Owner only. Only the owner decides whether and when a release is tagged. Only
-the owner creates, moves or deletes a tag. On the release commit, the owner
-runs:
-
-```bash
-git tag -a vX.Y.Z -m "AutistMask X.Y.Z"
-git push origin vX.Y.Z
-```
-
-`-a` makes an annotated tag: a tag that carries a message and records who made
-the tag and when. `v0.1.0` is one.
-
-Once the tag exists, `git describe --tags` on the release commit prints
-`vX.Y.Z`. `script/cibuild` and `script/docker` pass that value to the Docker
-image build as `VERSION`.
-
-Check: `git rev-parse vX.Y.Z^{commit}` prints the release commit's hash, and the
-tag is listed at https://git.eeqj.de/sneak/AutistMask/tags.
-
-### 6. Publish the archives
-
-Owner only. The owner decides where the archives are published. No script in
-this repository uploads or publishes them.
-
-Whoever receives an archive installs it as follows.
-
-Chrome loads the extension from a directory:
-
-- unzip the archive into a new, empty directory, for example
-  `unzip autistmask-chrome-0.1.0.zip -d autistmask-chrome`;
-- open `chrome://extensions/` and turn on "Developer mode";
-- click "Load unpacked" and pick that directory.
-
-Chrome then reports the extension id `gipbhkogfopeahplcjhipkgpcimdpkip`. The id
-is the fixed string that identifies the extension to Chrome; the `key` in
-`manifest/chrome.json` sets the id.
-
-Release builds of Firefox refuse to install an unsigned add-on. Desktop Firefox
-115 or newer, in any edition, loads the `.xpi` as a temporary add-on from the
-`about:debugging` page. Firefox unloads a temporary add-on when Firefox exits.
-The section "Installing on Firefox" in `README.md` has the details.
-
-Check: each archive installs on a fresh browser profile (a new, empty set of
-browser data) by the route above.

eslint.config.js

@@ -153,7 +153,8 @@ module.exports = [
         },
     },
 
-    // The files in script/lib/ run on plain node too, and are never bundled.
+    // The helpers the script/ entrypoints call: plain node programs too, run
+    // from a shell script rather than from yarn, and never bundled.
     {
         files: ["script/lib/**/*.js"],
         languageOptions: {

package.json

@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "node script/lib/jest.js --maxWorkers=3",
+        "test": "jest --forceExit --maxWorkers=3",
-        "test:verbose": "node script/lib/jest.js --maxWorkers=3 --verbose",
+        "test:verbose": "jest --forceExit --maxWorkers=3 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",

script/bootstrap

@@ -118,7 +118,6 @@ ensure_yarn() {
     fi
 }
 
-# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \

script/lib/jest.js

@@ -1,40 +0,0 @@
-// Runs jest with the arguments it is given, and fails the run when jest had to
-// force-stop the worker process that ran a test file. Jest itself only prints a
-// warning when that happens, and its run still passes. The warning means a test
-// left a timer or another open handle running. The test scripts in package.json
-// run jest through this file.
-//
-// Jest runs inside this process and writes to the terminal directly, so its
-// output looks the same as a plain jest run. This file only checks each write
-// to stderr for the warning below.
-
-"use strict";
-
-// The start of the warning that jest prints on stderr after it force-stops a
-// worker process.
-const WORKER_WARNING = "A worker process has failed to exit gracefully";
-
-let forceStopped = false;
-
-const writeStderr = process.stderr.write.bind(process.stderr);
-process.stderr.write = (chunk, ...rest) => {
-    if (String(chunk).includes(WORKER_WARNING)) {
-        forceStopped = true;
-    }
-    return writeStderr(chunk, ...rest);
-};
-
-// Runs after jest has finished, as the process exits.
-process.on("exit", () => {
-    if (forceStopped) {
-        console.error(
-            "script/lib/jest.js: failing the run, because jest force-stopped " +
-                "a worker process. A test left a timer or another open " +
-                "handle running.",
-        );
-        process.exitCode = 1;
-    }
-});
-
-// Jest's own command-line program. It reads its arguments from process.argv.
-require("jest/bin/jest");

src/popup/views/addToken.js

@@ -5,12 +5,7 @@ const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
 const { log } = require("../../shared/log");
 
-// Counts the times AddToken has opened. A contract lookup started before
-// AddToken was last opened changes neither the screen nor the status line.
-let addTokenScreenOpenings = 0;
-
 function show() {
-    addTokenScreenOpenings++;
     $("add-token-address").value = "";
     $("add-token-info").textContent = "";
     $("add-token-info").style.visibility = "hidden";
@@ -60,7 +55,6 @@ function init(ctx) {
         // The network the lookup asks, which Settings may switch away from
         // before it answers, as for a transaction in confirmTx.js.
         const chainId = currentNetwork().chainId;
-        const opening = addTokenScreenOpenings;
         try {
             const info = await lookupTokenInfo(
                 contractAddr,
@@ -86,17 +80,6 @@ function init(ctx) {
             });
             await saveState();
             ctx.doRefreshAndRender();
-            // If the lookup answers after AddToken was opened again, the
-            // token is still added, but the screen and the status line stay
-            // as they are.
-            if (addTokenScreenOpenings !== opening) return;
-            // The lookup is over, so a later Back onto AddToken shows no
-            // status.
-            infoEl.textContent = "";
-            infoEl.style.visibility = "hidden";
-            // If the lookup answers while another screen shows, the token is
-            // still added but the screen does not change.
-            if (state.currentView !== "add-token") return;
             // Pop the stack (back to address detail) and re-render it
             // so the newly added token is visible immediately.
             if (state.viewStack.length > 0) {
@@ -117,7 +100,6 @@ function init(ctx) {
                     ? detail
                     : "Could not add the token.",
             );
-            if (addTokenScreenOpenings !== opening) return;
             infoEl.textContent = "";
             infoEl.style.visibility = "hidden";
         }

src/shared/chainSwitch.js

@@ -61,20 +61,31 @@ function clearPopupCaches() {
 // (https://git.eeqj.de/sneak/AutistMask/issues/653,
 // https://git.eeqj.de/sneak/AutistMask/issues/692).
 //
+// When the stored record is on another network, a switch saved elsewhere has
+// not reached this page yet. This page first takes that switch with
+// takeStoredNetwork() (state.js), as followStoredSettings() does. The switch to
+// `newNetworkId` is then made from the stored record's network. So every
+// network's list of tracked tokens in the stored record is kept
+// (https://git.eeqj.de/sneak/AutistMask/issues/701). When the stored record is
+// already on `newNetworkId`, the switch made from there only resets the
+// balances and caches.
+//
 // Before the switch, `state` takes the tracked tokens that another page stored
 // since this page's last save (takeStoredTrackedTokens() in state.js). The
 // switch then puts them away under the previous network, the network they were
-// added on. When the stored record is on another network, a switch saved
+// added on.
-// elsewhere has not reached this page yet. The stored record's tokens are then
-// that network's, and none are taken.
 async function onChainSwitch(newNetworkId) {
-    const { state, saveState, takeStoredTrackedTokens } = require("./state");
+    const {
+        state,
+        saveState,
+        takeStoredNetwork,
+        takeStoredTrackedTokens,
+    } = require("./state");
     let net = null;
     await saveState((stored) => {
         if (state.networkId === newNetworkId) return false;
-        if (stored.networkId === state.networkId) {
+        if (stored.networkId !== state.networkId) takeStoredNetwork(stored);
-            takeStoredTrackedTokens(stored);
+        takeStoredTrackedTokens(stored);
-        }
         net = applyChainSwitchFields(state, newNetworkId);
         stored.lastBalanceRefresh = 0;
         stored.fraudContracts = [];

src/shared/state.js

@@ -527,6 +527,26 @@ async function saveStateOnce(beforeWrite) {
             merged[key] = current[key];
         }
     }
+    // When the merged record names a network other than this page's, this page
+    // has not yet taken a switch saved elsewhere. This page's `trackedTokens`
+    // is then the list of this page's network. The stored record keeps the
+    // list of this page's network in `networkTrackedTokens`. So a token that
+    // this page added or removed since its last save is added to or removed
+    // from that stored list. The merged record keeps the stored `trackedTokens`
+    // (https://git.eeqj.de/sneak/AutistMask/issues/701).
+    if (merged.networkId !== current.networkId) {
+        merged.trackedTokens = fresh.trackedTokens;
+        merged.networkTrackedTokens = {
+            ...fresh.networkTrackedTokens,
+            [current.networkId]: mergeListByIdentity(
+                baseline.trackedTokens,
+                current.trackedTokens,
+                fresh.networkTrackedTokens[current.networkId],
+                (token) => token.address.toLowerCase(),
+                (base, ours) => ours,
+            ),
+        };
+    }
     merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
     // Stamped on every write, never merged or diffed: the record that goes to
     // storage is in THIS build's shape whatever shape it was read in, which is
@@ -608,11 +628,12 @@ function saveState(beforeWrite) {
 }
 
 // Give this page the network switch held by `stored`, a record a save of this
-// page has just read (followStoredSettings() in src/popup/index.js calls this
+// page has just read (followStoredSettings() in src/popup/index.js and
-// from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
+// onChainSwitch() in src/shared/chainSwitch.js call this from `beforeWrite`),
-// with a whole record. The switch is then not this page's own change, even when
+// in `state` and in `baseline` alike, as loadState() does with a whole
-// that save fails to write: a later switch back to the previous network still
+// record. The switch is then not this page's own change, even when that save
-// differs from `baseline`, and is stored.
+// fails to write: a later switch back to the previous network still differs
+// from `baseline`, and is stored.
 function takeStoredNetwork(stored) {
     copyChainSwitchFields(rawState, stored);
     copyChainSwitchFields(baseline, structuredClone(stored));

tests/addTokenLateAnswer.test.js

@@ -1,137 +0,0 @@
-// A contract lookup on AddToken can answer after the user has left AddToken.
-// The token is still added, and the screen the user is on does not change
-// (https://git.eeqj.de/sneak/AutistMask/issues/603). An answer while AddToken
-// still shows goes to AddressDetail. Driven through the real popup over a
-// stored profile.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-    TOKEN_ADDRESS,
-} = require("./support/popupBoot");
-
-const TOKEN = {
-    address: TOKEN_ADDRESS,
-    symbol: "TST",
-    decimals: 18,
-    name: "Test Token",
-};
-
-// A second contract address, typed after AddToken was opened again.
-const OTHER_TOKEN_ADDRESS = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressDetail, then AddToken opened from it with
-// TOKEN's contract address typed in.
-async function openAddToken() {
-    const boot = await bootPopup(
-        unversionedValidProfile({
-            currentView: "address",
-            selectedWallet: 0,
-            selectedAddress: 0,
-        }),
-    );
-    expect(boot.pageErrors).toEqual([]);
-    await boot.click("btn-add-token");
-    expect(boot.visibleViews()).toEqual(["add-token"]);
-    boot.node("add-token-address").value = TOKEN.address;
-    return boot;
-}
-
-// Presses Add with a contract lookup that answers only when the function
-// returned here is called. That function waits for Add to finish.
-function addWithPendingLookup(boot) {
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    let answer;
-    lookupTokenInfo.mockImplementationOnce(
-        () =>
-            new Promise((resolve) => {
-                answer = resolve;
-            }),
-    );
-    const adding = boot.click("btn-add-token-confirm");
-    return async () => {
-        answer({
-            symbol: TOKEN.symbol,
-            decimals: TOKEN.decimals,
-            name: TOKEN.name,
-        });
-        await adding;
-    };
-}
-
-test("an answer after the user opened Settings adds the token and Settings stays", async () => {
-    const boot = await openAddToken();
-    const answerLookup = addWithPendingLookup(boot);
-    await boot.click("btn-settings");
-    expect(boot.visibleViews()).toEqual(["settings"]);
-
-    await answerLookup();
-    expect(boot.visibleViews()).toEqual(["settings"]);
-    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
-});
-
-test("Back from Settings onto AddToken after the lookup answered shows no lookup status", async () => {
-    const boot = await openAddToken();
-    const answerLookup = addWithPendingLookup(boot);
-    expect(boot.text("add-token-info")).toBe("Looking up token...");
-    await boot.click("btn-settings");
-    await answerLookup();
-
-    await boot.click("btn-settings-back");
-    expect(boot.visibleViews()).toEqual(["add-token"]);
-    expect(boot.text("add-token-info")).toBe("");
-    expect(boot.node("add-token-info").style.visibility).toBe("hidden");
-});
-
-test("an answer after AddToken was opened again adds the token and leaves AddToken and its status line as they are", async () => {
-    const boot = await openAddToken();
-    const answerFirstLookup = addWithPendingLookup(boot);
-    await boot.click("btn-add-token-back");
-    await boot.click("btn-add-token");
-    expect(boot.visibleViews()).toEqual(["add-token"]);
-    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
-    // The second lookup is never answered.
-    addWithPendingLookup(boot);
-
-    await answerFirstLookup();
-    expect(boot.visibleViews()).toEqual(["add-token"]);
-    expect(boot.text("add-token-info")).toBe("Looking up token...");
-    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
-});
-
-test("a lookup that fails after AddToken was opened again leaves the status line as it is", async () => {
-    const boot = await openAddToken();
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    let failFirstLookup;
-    lookupTokenInfo.mockImplementationOnce(
-        () =>
-            new Promise((_, reject) => {
-                failFirstLookup = reject;
-            }),
-    );
-    const firstAdd = boot.click("btn-add-token-confirm");
-    await boot.click("btn-add-token-back");
-    await boot.click("btn-add-token");
-    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
-    // The second lookup is never answered.
-    addWithPendingLookup(boot);
-
-    failFirstLookup(new Error("lookup failed"));
-    await firstAdd;
-    expect(boot.text("add-token-info")).toBe("Looking up token...");
-});
-
-test("an answer while AddToken still shows goes to AddressDetail with the token listed", async () => {
-    const boot = await openAddToken();
-    const answerLookup = addWithPendingLookup(boot);
-
-    await answerLookup();
-    expect(boot.visibleViews()).toEqual(["address"]);
-    expect(boot.node("address-balances").innerHTML).toContain("TST");
-    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
-});

tests/addressKey.test.js

@@ -161,7 +161,7 @@ function click(element) {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
 // ------------------------------------------------------------ harness
@@ -188,11 +188,7 @@ let sent;
 // handler to the buttons it drew, as the browser's fresh list would have.
 let plusButton;
 
-// showFlash() starts a timer that clears the message one or two seconds later.
-// Each test here runs on fake timers and drops them in afterEach, so that timer
-// never outlives the test.
 beforeEach(() => {
-    jest.useFakeTimers();
     approvalDetails = null;
     sent = [];
     mockNode.broadcast = [];
@@ -243,7 +239,6 @@ beforeEach(() => {
 });
 
 afterEach(() => {
-    jest.useRealTimers();
     jest.restoreAllMocks();
 });
 

tests/backgroundApproval.test.js

@@ -537,18 +537,7 @@ async function settleIncludingRejections() {
     await new Promise((resolve) => setImmediate(resolve));
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });
@@ -1894,6 +1883,18 @@ describe("a closed approval window leaves the request pending", () => {
         return bg.actionPopups[bg.actionPopups.length - 1];
     }
 
+    // The timer that keeps the worker running while an approval is pending is
+    // stubbed, so no test here leaves that timer running when it ends.
+    let keepRunningTimer;
+    beforeEach(() => {
+        keepRunningTimer = jest
+            .spyOn(global, "setInterval")
+            .mockImplementation(() => 1);
+    });
+    afterEach(() => {
+        keepRunningTimer.mockRestore();
+    });
+
     test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();

tests/backgroundStateIsolation.test.js

@@ -103,18 +103,7 @@ function deferred() {
     return { promise, resolve };
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/chainSwitchGate.test.js

@@ -56,18 +56,7 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerChainSwitch.test.js

@@ -64,18 +64,7 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerSendTransaction.test.js

@@ -76,18 +76,7 @@ async function settle() {
     for (let i = 0; i < 60; i++) await Promise.resolve();
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/connectedSitesWorkerRestart.test.js

@@ -57,18 +57,7 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
-// While an approval is pending, the background starts a 20-second timer to
-// keep itself running. The timer is stubbed and never starts, so no test in
-// this file leaves it running.
-let keepRunningTimer;
-beforeEach(() => {
-    keepRunningTimer = jest
-        .spyOn(global, "setInterval")
-        .mockImplementation(() => 1);
-});
-
 afterEach(() => {
-    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });

tests/deleteWalletLostPassword.test.js

@@ -102,17 +102,6 @@ function makeDocument() {
 
 // ------------------------------------------------------------ harness
 
-// showFlash() starts a timer that clears the message two seconds later. Each
-// test here runs on fake timers and drops them in afterEach, so that timer
-// never outlives the test.
-beforeEach(() => {
-    jest.useFakeTimers();
-});
-
-afterEach(() => {
-    jest.useRealTimers();
-});
-
 function wallet(name, secret, addresses) {
     return {
         type: "hd",

tests/sendAmountRule.test.js

@@ -131,14 +131,10 @@ async function review(amount, token) {
 async function confirm(amount, token) {
     const txInfo = await review("0.5", token);
     confirmTx.show({ ...txInfo, amount });
-    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
-// showFlash() starts a timer that clears the message two seconds later. Each
-// test here runs on fake timers and drops them in afterEach, so that timer
-// never outlives the test.
 beforeEach(() => {
-    jest.useFakeTimers();
     elements.clear();
     state.wallets = [
         {
@@ -171,10 +167,6 @@ beforeEach(() => {
     state.currentView = null;
 });
 
-afterEach(() => {
-    jest.useRealTimers();
-});
-
 describe.each([
     ["1e-3", "ETH"],
     ["1e-3", "TOK"],

tests/sendMax.test.js

@@ -277,18 +277,14 @@ async function review() {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
 function canSend() {
     return !el("btn-confirm-send").disabled;
 }
 
-// showFlash() starts a timer that clears the message two seconds later. Each
-// test here runs on fake timers and drops them in afterEach, so that timer
-// never outlives the test.
 beforeEach(() => {
-    jest.useFakeTimers();
     elements.clear();
     log.errorf.mockClear();
     pageClosed = new AbortController();
@@ -301,10 +297,6 @@ beforeEach(() => {
     mockNode.broadcast = [];
 });
 
-afterEach(() => {
-    jest.useRealTimers();
-});
-
 describe("Max on an ETH send", () => {
     test("fills in the exact balance minus the fee reserve", async () => {
         await refreshWith(BALANCE_WEI);

tests/trackedTokensPerNetwork.test.js

@@ -257,6 +257,7 @@ test("a token tracked on Sepolia when another page switched there is not tracked
         ...boot.storage.read("autistmask"),
         networkId: "sepolia",
         trackedTokens: [SEPOLIA_TOKEN],
+        networkTrackedTokens: { mainnet: [] },
     });
 
     await chooseNetwork(boot, "sepolia");
@@ -267,6 +268,103 @@ test("a token tracked on Sepolia when another page switched there is not tracked
     expect(stored.networkTrackedTokens.mainnet).toEqual([]);
 });
 
+// Another popup page saves a switch to Sepolia, where TST is tracked. Before
+// taking that switch, this page adds a token on Ethereum Mainnet. The add's
+// save adds the token to Ethereum Mainnet's list and leaves Sepolia's list as
+// it was.
+test("a token added before this page takes another page's switch is tracked on Ethereum Mainnet", async () => {
+    const boot = await bootOnAddToken("mainnet", {
+        trackedTokens: [MAINNET_TOKEN],
+        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+    });
+    expect(boot.pageErrors).toEqual([]);
+    boot.storage.write("autistmask", {
+        ...boot.storage.read("autistmask"),
+        networkId: "sepolia",
+        trackedTokens: [SEPOLIA_TOKEN],
+        networkTrackedTokens: {
+            mainnet: [MAINNET_TOKEN],
+            sepolia: [SEPOLIA_TOKEN],
+        },
+    });
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    lookupTokenInfo.mockResolvedValueOnce({
+        symbol: "NEW",
+        decimals: 18,
+        name: "New Token",
+    });
+
+    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
+    await boot.click("btn-settings-addtoken-manual");
+
+    const stored = boot.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.trackedTokens).toEqual([SEPOLIA_TOKEN]);
+    expect(stored.networkTrackedTokens.mainnet).toEqual([
+        MAINNET_TOKEN,
+        {
+            address: NEW_TOKEN_ADDRESS,
+            symbol: "NEW",
+            decimals: 18,
+            name: "New Token",
+        },
+    ]);
+});
+
+// Another popup page saves a switch to Sepolia, where TST is tracked. Before
+// taking that switch, this page removes DAI on Ethereum Mainnet, as the `[x]`
+// on a tracked token in Settings does. The removal's save drops DAI from
+// Ethereum Mainnet's list and leaves Sepolia's list as it was.
+test("a token removed before this page takes another page's switch is gone from Ethereum Mainnet", async () => {
+    const boot = await bootPopup(
+        unversionedValidProfile({
+            trackedTokens: [MAINNET_TOKEN],
+            networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+        }),
+    );
+    expect(boot.pageErrors).toEqual([]);
+    boot.storage.write("autistmask", {
+        ...boot.storage.read("autistmask"),
+        networkId: "sepolia",
+        trackedTokens: [SEPOLIA_TOKEN],
+        networkTrackedTokens: {
+            mainnet: [MAINNET_TOKEN],
+            sepolia: [SEPOLIA_TOKEN],
+        },
+    });
+
+    const { state, saveState } = require("../src/shared/state");
+    state.trackedTokens.splice(0, 1);
+    await saveState();
+
+    const stored = boot.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.trackedTokens).toEqual([SEPOLIA_TOKEN]);
+    expect(stored.networkTrackedTokens.mainnet).toEqual([]);
+});
+
+// Another popup page tracks DAI on Ethereum Mainnet and then saves a switch to
+// Sepolia. That switch puts DAI away under Ethereum Mainnet. This page has not
+// taken the switch yet. A switch to Sepolia in this page's Settings keeps DAI
+// on Ethereum Mainnet's list.
+test("a token another page tracked before its own switch stays tracked on Ethereum Mainnet", async () => {
+    const boot = await bootPopup(unversionedValidProfile());
+    expect(boot.pageErrors).toEqual([]);
+    await boot.click("btn-settings");
+    boot.storage.write("autistmask", {
+        ...boot.storage.read("autistmask"),
+        networkId: "sepolia",
+        trackedTokens: [],
+        networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
+    });
+
+    await chooseNetwork(boot, "sepolia");
+
+    const stored = boot.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.networkTrackedTokens.mainnet).toEqual([MAINNET_TOKEN]);
+});
+
 // Another popup page records a fraud contract on Ethereum Mainnet after this
 // page's last save. The switch to Sepolia drops that fraud contract, as the
 // switch drops this page's own.

tests/walletDefects.test.js

@@ -357,11 +357,6 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     beforeEach(() => {
-        // showFlash() starts a timer that clears the message two seconds
-        // later. Each test here runs on fake timers and drops them in
-        // afterEach, so that timer never outlives the test.
-        jest.useFakeTimers();
-
         const broken = brokenXprvWallet();
         // A balance, so that no Send button's zero-balance refusal can stand
         // in for the defect check.
@@ -403,7 +398,6 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     afterEach(() => {
-        jest.useRealTimers();
         state.wallets = [];
         state.activeAddress = null;
         state.selectedWallet = null;