fix: run libsodium on WebAssembly under the extension CSP (closes #182 )

libsodium ships a WASM build and a wasm2js translation in one file, tries WASM first, and silently falls back if instantiation throws. Under a plain script-src 'self' the fallback was taken on every popup load, announced by nothing but an uncaught CompileError. Measured on the vault's own Argon2id parameters (OPSLIMIT_INTERACTIVE, MEMLIMIT_INTERACTIVE), node 22: WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is identical either way — it is set by the ops and memory parameters, not by wall time — so the fallback bought no security and cost about 3.5s on every operation that asks for the password, which is every signature. Both manifests now declare script-src 'self' 'wasm-unsafe-eval'; object-src 'self' for extension pages: an object under content_security_policy.extension_pages for Chrome MV3, a bare string for Firefox MV2. The keyword permits compiling WebAssembly and nothing else — not eval() of strings, not inline script, not remote script — and reaching it requires already executing script in an extension page. 'unsafe-eval' is not granted. The silence is what made this dangerous, so the fallback is now loud at three levels: tests/manifest.test.js pins both policies to exactly that token set, failing make check if the grant is dropped or if anything is added beside it; tests/vaultBackend.test.js asserts the unit tests exercise the WASM backend, with a self-validating check that libsodium never swapped its fallback in; and the e2e suite compiles a WebAssembly module inside the real popup under the real manifest, with the harness allowlist entry that used to excuse the CompileError now deleted. The runtime fallback itself is kept — a wallet that refuses to decrypt is worse than a slow one — but vault.js now reports the backend and logs an error when it is not WASM.
fix: repair wallet state on delete (closes #156 )
2026-08-11 12:24:29 +00:00 · 2026-08-11 14:23:06 +02:00 · 2026-08-11 14:15:05 +02:00 · 2026-08-10 16:15:22 +02:00 · 2026-08-10 15:59:30 +02:00 · 2026-08-10 15:53:15 +02:00
28 changed files with 3590 additions and 236 deletions
--- a/13
+++ b/13
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build build-debug clean dev
+.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev

 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -16,6 +16,10 @@ install:
 test:
 	@script/test

+# Browser end-to-end suite. Requires docker; not part of check.
+test-e2e:
+	@script/test-e2e
+
 lint:
 	@script/lint

@@ -37,6 +41,7 @@ hooks:
 build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
+	@script/verify-build

 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
@@ -44,6 +49,12 @@ build:
 build-debug:
 	@echo "Building extension (DEBUG)..."
 	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
+	@AUTISTMASK_DEBUG=1 script/verify-build
+
+# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
+# the end of build and build-debug; separate target for re-running it alone.
+verify-build:
+	@script/verify-build

 clean:
 	@rm -rf dist/
--- a/README.md
+++ b/README.md
@@ -59,6 +59,13 @@ behavior. The build prints which mode it used. See the
 distribute a debug build** — every wallet it creates gets the same publicly
 known test recovery phrase.

+Both builds end by running `script/verify-build`, which reads the compiled
+`DEBUG` state back out of the emitted bundles and fails the build if it is not
+the one that was asked for. The test suite cannot check this: it loads
+`src/shared/constants.js` outside a bundle, so it only ever sees the fallback
+value. The assertion is on the artifacts because that is where the property
+lives.
+
 ## Entrypoints

 This repository adheres to the
@@ -73,15 +80,84 @@ provide:
  git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
+- `script/test-e2e` — run the browser end-to-end suite (docker required; see
+  [End-to-End Tests](#end-to-end-tests))
 - `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
+- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
+  `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
+  off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
+  `make build` and `make build-debug`; fails loudly rather than passing if it
+  cannot determine a bundle's state. Not part of `make check`, which does not
+  depend on build artifacts existing.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook

+## End-to-End Tests
+
+`make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
+Chrome**, loaded as an unpacked MV3 extension inside a pinned
+`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
+docker is required and the suite fails loudly rather than skipping if it is
+unavailable). The suite lives in `tests/e2e/` and is driven by
+`playwright-core`, whose version must stay matched to the container's Playwright
+version — the browsers ship inside the image.
+
+It covers popup load, WebAssembly compilation under the shipped CSP (see
+[Content Security Policy](#content-security-policy)), wallet creation through
+the UI, the Add Token screen and the transaction detail screen for an ERC-20
+transfer. All outbound network is intercepted at the browser level and served
+from fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
+offline; unrecognised outbound requests are reported as failures rather than
+silently allowed.
+
+That reporting has one bound worth knowing. Observation ends when the browser
+context is torn down, and nothing can watch traffic after that, so the run keeps
+collecting for a fixed grace period after the last test returns
+(`TRAILING_WATCH_MS` in `tests/e2e/run.js`, currently 1500ms) and then closes
+the context. A request whose _first_ dispatch falls after that window is never
+seen at all and cannot fail the run. In practice a request a test fires without
+awaiting reaches the route handler about 10ms later, and anything on a repeating
+timer gets observed on an earlier tick during the ~20s suite — but a one-shot
+call deliberately deferred past the window will escape.
+
+That interception covers the MV3 background service worker as well as the popup
+page, which it does not by default — `script/test-e2e` sets
+`PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
+experimental, the harness does not take it on trust. At launch it waits for the
+background worker's **own** startup request — the phishing blocklist fetch that
+`src/background/index.js` issues unconditionally — to arrive in the route
+handler, and aborts the entire suite if none does within 30 seconds
+(`tests/e2e/harness.js`). The check is passive on purpose: a synthetic probe
+fetched from inside the worker via `worker.evaluate()` was tried first and
+rejected, because evaluating in an extension service worker that early kills the
+worker outright, destroying the thing being measured. Observing traffic the
+extension already generates perturbs nothing. Losing the race fails closed — the
+suite refuses to run rather than passing quietly.
+
+As defence in depth, Chrome is also started with
+`--host-resolver-rules=MAP * ~NOTFOUND`, so a request that ever did slip past
+the route handler could not resolve a host at all. That only bounds the damage;
+detecting escaping traffic remains the canary's job. To see what is actually
+being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
+printed, tagged `[sw]` or `[page]`.
+
+**Any uncaught page error or `console.error` fails the run.** That is the point:
+a `ReferenceError` from a used-but-not-imported identifier is invisible to
+`make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
+and this suite exists because exactly that class of bug shipped twice.
+
+`make test-e2e` is deliberately **not** part of `make check` or `make test`.
+`REPO_POLICIES.md` caps `make test` at 20 seconds and a browser suite does not
+fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot pick it up
+either. It is also not wired into the Gitea workflow yet — docker-in-docker in
+CI is a separate question. Run it locally before changing anything under
+`src/popup/views/`.
+
 ## Rationale

 Common popular EVM wallets have become bloated with swap UIs, portfolio
@@ -676,6 +752,36 @@ battle-tested.
 Exceptions require explicit authorization in a code comment referencing this
 policy, but as of now there are none.

+### Content Security Policy
+
+Both manifests declare the same policy for extension pages —
+`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
+`content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
+a bare string in `manifest/firefox.json` (MV2).
+
+`'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
+build and a `wasm2js` translation of it in one file, tries WASM first, and
+silently falls back to the translation if instantiation throws. Under a plain
+`script-src 'self'` the fallback was taken on every popup load, announced by
+nothing but an uncaught `CompileError`. Measured on the same Argon2id parameters
+the vault uses (`OPSLIMIT_INTERACTIVE`, `MEMLIMIT_INTERACTIVE`), WASM derives a
+key in 141-198ms and `wasm2js` in 3204-3660ms. The work factor is identical — it
+is set by the ops and memory parameters, not by wall time — so the fallback
+bought nothing and cost about three and a half seconds on every operation that
+asks for the password, which is every signature.
+
+The keyword permits compiling WebAssembly and nothing else: not `eval()` of
+strings, not inline script, not remote script. Using it requires already
+executing script in an extension page, which is complete compromise on its own.
+`'unsafe-eval'` is a different proposition and is not granted.
+
+The grant is pinned in both directions. `tests/manifest.test.js` asserts the
+exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
+20x regression on the key derivation) and adding anything beyond it both fail
+`make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
+backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
+under the real manifest.
+
 ### DEBUG Mode Policy

 The `DEBUG` constant in the popup JS enables a red "DEBUG / INSECURE" banner and
@@ -905,7 +1011,7 @@ Currently supported:

 ### Wallet Management

- [ ] Delete wallet (with confirmation)
+- [x] Delete wallet (with confirmation)
 - [ ] Delete address from HD wallet (with confirmation)
 - [ ] Show wallet's recovery phrase (requires password)

--- a/TODO.md
+++ b/TODO.md
@@ -1,34 +1,84 @@
 # Workflow

- branch (from `main`)
- do the work in Next Step
- move Next Step to the top of Completed Steps
- move the top item of Future Steps into Next Step
- commit (`TODO.md` changes in the same commit as the work)
- merge to `main` if the branch is not protected, otherwise open a PR
- push
+- `git pull` `next` and cut a branch from it — one branch per issue, named
+  `issue-<N>-<slug>`. Never branch from `main`.
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
+  `TODO.md` update in that same commit.
+- Move Next Step to the top of Completed Steps; move the top item of Future
+  Steps into Next Step.
+- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
+  `main` may not.
+- Rebase onto current `next` immediately before pushing — other branches land on
+  `next` continuously — and re-run `make check` after resolving, because a clean
+  textual merge can still break the build.
+- Push the branch and open one PR per issue with base `next`. Never base `main`.
+- An independent reviewer who did not write the change gates the merge. On a
+  passed review the PR is squash-merged into `next`.
+- `next` is the branch for the next milestone. It is kept green and mergeable to
+  `main` at any moment, without notice.
+- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
+  from `main`.

 # Status

-pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. No
-other branch is in flight: the settings About well landed as #145 on 2026-07-26
-and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
-question is resolved. Full policy file set present. `make check` verified
-passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
-#149-#168.
+pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
+milestone is in flight on `next`; its `next` -> `main` PR is
+[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
+green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
+`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
+compiled off.
+
+The backlog lives on the
+[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
+authoritative; this file does not duplicate it. Full policy file set present. A
+real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
+which cannot see a runtime `ReferenceError` in a popup view.

 # Next Step

-Land #149: make `DEBUG` a build-time constant that defaults to off, injected as
-the `__BUILD_DEBUG__` esbuild define from `AUTISTMASK_DEBUG=1`, so a plain
-`make build` stops handing every newly created wallet the publicly committed
-test recovery phrase. Branch `fix/issue-149-debug-build-flag`; PR open, awaiting
-review.
+Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
+`script/lint`. `make check` is `prettier --check` only today and cannot catch
+undefined identifiers, which is how
+[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
+[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.

 # Completed Steps

+- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
+  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
+  fallback at 20x the Argon2id cost, pinned in both directions by
+  `tests/manifest.test.js` and observed in the real popup by the e2e suite
+  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
+- 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
+  remaining wallets, the selection only moves when it was deleted, and the
+  active-address change is broadcast to connected sites
+  ([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
+- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
+  on `next`, with Status and Next Step refreshed
+  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
+- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
+  as the `__BUILD_DEBUG__` esbuild define and turned on with
+  `AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
+  created wallet the publicly committed test recovery phrase
+  ([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
+- 2026-08-09: dApp approval signing moved into the popup — the password no
+  longer crosses the extension messaging boundary; the background broadcasts and
+  resolves approvals only, and verifies the signed artifact against the approval
+  it holds (#157).
+- 2026-08-09: Post-build assertion that every emitted bundle containing
+  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
+  `make build` path (#170).
+- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
+  `script/test-e2e`) driving the real popup with all network intercepted, plus
+  the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
+  and TransactionDetail broken for every ERC-20 transfer (#151). Harness
+  demonstrated failing before the fixes and passing after (#181). Interception
+  covers the MV3 background service worker, not just the popup page, and a
+  launch-time canary aborts the suite if worker traffic starts escaping.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
  (#149-#168).
+- 2026-08-09: Test coverage for the address-poisoning defense in
+  `src/shared/transactions.js` (#160)
 - 2026-07-26: About well in settings with build info, repo link and the version
  click easter egg (#145); proper view navigation stack (#146).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
@@ -52,32 +102,15 @@ review.

 # Future Steps

- Fix the two `ReferenceError` crashes that make whole screens unreachable:
-  AddToken (#150) and TransactionDetail for every ERC-20 transfer (#151).
- Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
-  and cannot catch undefined identifiers, which is how #150 and #151 shipped.
- Make the Firefox target functional: Chrome callback APIs are used against the
-  promise-only `browser` namespace (#153).
- Send and transaction-flow correctness: gas fee excluded from the
-  insufficient-balance check (#154), WaitTx 60s timeout overwriting a rendered
-  success screen (#155), last-wallet deletion leaving inconsistent state (#156).
- Security: plaintext password crossing the extension messaging boundary during
-  dApp approvals (#157); MV3 service worker termination killing the background
-  refresh and the 24h phishing list update (#158).
- Test the crypto core — `wallet.js` derivation and `vault.js` encryption (#159)
-  — and the address-poisoning defense in `transactions.js` (#160).
- Wallet features for 1.0: show a wallet's recovery phrase behind the password
-  (#161), delete an address from an HD wallet (#162).
- Docs: `docs/README.md` contradicts the code on external services and names
-  competitors (#163); README Screen Map omits three shipped screens (#164).
- Owner decisions: Sepolia support versus "Non-Goals for 1.0", and `isMetaMask`
-  naming a competitor in shipped code (#165).
- Repo policy compliance sweep: test rerun pattern, `yarn`/`npx`, frozen
-  lockfile, undocumented Makefile targets (#166).
- Prune the 24 stale remote feature branches (#167).
- Remove dead exports and de-duplicate copy-pasted view helpers (#168).
+Only work that has no issue of its own belongs here; everything else is on the
+tracker.
+
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag; #149 and #157 are parts of it, but the
-  review is broader than either.
+  input validation) before any 1.0rc tag. Individual filed issues are parts of
+  it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
+  workflow. Extending the suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
+  [#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
  land.
--- a/build.js
+++ b/build.js
@@ -3,14 +3,43 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");

-const DIST_CHROME = path.join(__dirname, "dist", "chrome");
-const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
+const DIST = path.join(__dirname, "dist");
+const DIST_CHROME = path.join(DIST, "chrome");
+const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");

+// The module whose compiled DEBUG state script/verify-build asserts, and the
+// manifest naming every emitted bundle that ends up containing it. The
+// manifest is derived from esbuild's own dependency graph rather than from a
+// hardcoded list, so it tracks the bundle layout instead of rotting with it.
+const AUDITED_MODULE = "src/shared/constants.js";
+const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
+
 function ensureDir(dir) {
    fs.mkdirSync(dir, { recursive: true });
 }

+// Repo-relative, forward-slashed, so the manifest reads the same on every
+// platform and can be consumed by a POSIX shell script without further work.
+function repoRelative(p) {
+    return path.relative(__dirname, p).split(path.sep).join("/");
+}
+
+// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
+// reports every input that contributed to an output in the metafile, which is
+// the authoritative answer to "is constants.js in this bundle" — unlike
+// searching the minified text, it does not depend on what survived minification.
+function outputsContainingAuditedModule(metafile) {
+    return Object.entries(metafile.outputs)
+        .filter(([outFile, info]) => {
+            if (!outFile.endsWith(".js")) return false;
+            return Object.keys(info.inputs).some(
+                (input) => repoRelative(input) === AUDITED_MODULE,
+            );
+        })
+        .map(([outFile]) => repoRelative(outFile));
+}
+
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
@@ -72,68 +101,70 @@ async function build() {
        __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
    };

+    // Emitted bundles that contain constants.js, accumulated across every
+    // esbuild run below and written out for script/verify-build.
+    const auditedBundles = [];
+
    // compile tailwind CSS
    console.log("Compiling Tailwind CSS...");
    const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
-    ensureDir(path.join(__dirname, "dist"));
+    const tailwindOutput = path.join(DIST, "styles.css");
+    ensureDir(DIST);
+
+    // Drop any manifest from a previous build before emitting anything, so a
+    // build that never gets around to writing one cannot be verified against
+    // a stale list.
+    fs.rmSync(BUNDLE_MANIFEST, { force: true });
    execSync(
        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
        { stdio: "inherit" },
    );

+    // Every bundle goes through here, so metafile collection cannot be
+    // forgotten when a new entry point is added.
+    async function bundle(entryPoint, outfile) {
+        const result = await esbuild.build({
+            entryPoints: [entryPoint],
+            bundle: true,
+            format: "iife",
+            outfile,
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            metafile: true,
+            define,
+        });
+        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
+    }
+
    for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
        ensureDir(path.join(distDir, "src", "popup"));
        ensureDir(path.join(distDir, "src", "background"));
        ensureDir(path.join(distDir, "src", "content"));

        // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "popup", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "popup", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "popup", "index.js"),
+            path.join(distDir, "src", "popup", "index.js"),
+        );

        // bundle background script
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "background", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "background", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "background", "index.js"),
+            path.join(distDir, "src", "background", "index.js"),
+        );

        // bundle content script
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "content", "index.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "content", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "content", "index.js"),
+            path.join(distDir, "src", "content", "index.js"),
+        );

        // bundle inpage script (injected into page context, separate file)
-        await esbuild.build({
-            entryPoints: [path.join(SRC, "content", "inpage.js")],
-            bundle: true,
-            format: "iife",
-            outfile: path.join(distDir, "src", "content", "inpage.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
+        await bundle(
+            path.join(SRC, "content", "inpage.js"),
+            path.join(distDir, "src", "content", "inpage.js"),
+        );

        // copy popup HTML
        fs.copyFileSync(
@@ -158,6 +189,16 @@ async function build() {
        path.join(DIST_FIREFOX, "manifest.json"),
    );

+    // Written last so a build that died partway through leaves no manifest
+    // at all, which script/verify-build treats as a hard failure rather than
+    // as "nothing to check".
+    const manifest = [...new Set(auditedBundles)].sort();
+    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
+    console.log(
+        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
+            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
+    );
+
    console.log("Build complete: dist/chrome/ and dist/firefox/");
 }

--- a/manifest/chrome.json
+++ b/manifest/chrome.json
@@ -5,6 +5,9 @@
    "description": "Minimal Ethereum wallet for Chrome",
    "permissions": ["storage", "activeTab"],
    "host_permissions": ["<all_urls>"],
+    "content_security_policy": {
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
+    },
    "action": {
        "default_popup": "src/popup/index.html"
    },
--- a/manifest/firefox.json
+++ b/manifest/firefox.json
@@ -4,6 +4,7 @@
    "version": "0.1.0",
    "description": "Minimal Ethereum wallet for Firefox",
    "permissions": ["storage", "activeTab", "<all_urls>"],
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
    "browser_action": {
        "default_popup": "src/popup/index.html"
    },
--- a/package.json
+++ b/package.json
@@ -16,6 +16,7 @@
        "@tailwindcss/cli": "^4.2.1",
        "esbuild": "^0.27.3",
        "jest": "^30.2.0",
+        "playwright-core": "1.56.0",
        "prettier": "^3.8.1",
        "tailwindcss": "^4.2.1"
    },
--- a/script/test-e2e
+++ b/script/test-e2e
@@ -0,0 +1,64 @@
+#!/bin/sh
+# script/test-e2e: build the extension and drive the real popup in a real
+# Chromium inside a pinned container. Our own extension to
+# scripts-to-rule-them-all.
+#
+# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
+# caps make test at 20 seconds and a browser suite does not fit. Run it
+# yourself before touching popup views; it is the only check that can see
+# a used-but-not-imported identifier blow up at runtime.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
+
+main() {
+    cd "$ROOT"
+
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "test-e2e: docker is required to run the e2e suite" >&2
+        exit 1
+    fi
+
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
+
+    echo "Running e2e suite in the pinned Playwright container..."
+    # --ipc=host: Chromium's shared-memory needs more than the default
+    #   64MB /dev/shm or renderers crash.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
+    # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
+    #   ctx.route() intercepts page requests only, and every fetch made by
+    #   the MV3 background service worker — including the phishing
+    #   blocklist fetch that src/background/index.js issues at worker
+    #   startup — goes to the real internet. The flag is experimental and
+    #   Playwright may drop or rename it. It cannot break silently: the
+    #   harness probes service-worker interception at launch and aborts
+    #   the whole suite if it is not in effect (see the interception
+    #   canary in tests/e2e/harness.js). If a future Playwright removes
+    #   the flag, that probe is what will fail, and the fix is either a
+    #   replacement mechanism or an honest downgrade of the isolation
+    #   claim in tests/e2e/network.js and README.md — not deleting the
+    #   probe. The image is pinned by digest, so this can only ever bite
+    #   on a deliberate bump.
+    docker run --rm \
+        --ipc=host \
+        --user "$(id -u):$(id -g)" \
+        -e HOME=/tmp \
+        -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
+        -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
+        node tests/e2e/run.js
+}
+
+main "$@"
--- a/script/verify-build
+++ b/script/verify-build
@@ -0,0 +1,136 @@
+#!/bin/sh
+# script/verify-build: assert the compiled DEBUG state of the emitted
+# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
+# make build / make build-debug.
+#
+# Why this exists: DEBUG makes the publicly committed test recovery phrase the
+# output of wallet creation, so a release artifact built with it live hands
+# every new wallet to anyone who reads the repo. The test suite cannot see
+# this, because it loads src/shared/constants.js outside a bundle and takes
+# the fallback branch; the property only exists in the emitted output, so it
+# has to be asserted against the emitted output.
+#
+# What it reads: dist/constants-bundles.txt, written by build.js from
+# esbuild's metafile, naming every emitted bundle that contains
+# src/shared/constants.js. Each of those must carry exactly one of the two
+# BUILD_DEBUG_MARKER literals that constants.js folds down to.
+#
+# It fails rather than passes whenever it cannot determine a bundle's state.
+# Minified output is not a stable contract, so "matched neither form" is not
+# evidence of anything and must never read as green.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+MANIFEST="dist/constants-bundles.txt"
+MARKER_ON="autistmask-build-debug=on"
+MARKER_OFF="autistmask-build-debug=off"
+
+# Set by read_marker.
+MARKER=""
+
+fail() {
+    echo "verify-build: FAIL: $*" >&2
+    exit 1
+}
+
+has_marker() {
+    grep -q -F "$1" "$2" 2>/dev/null
+}
+
+# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
+# present. Both means the ternary in constants.js was never folded, which is
+# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
+# DEBUG stops being known at build time and the debug branch is live again.
+# Neither means we are reading output we do not understand. Both are hard
+# failures; neither is ever treated as absence of a problem.
+read_marker() {
+    _file="$1"
+    _on=no
+    _off=no
+    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
+    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
+
+    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
+        fail "$_file carries both debug markers, so the build-time DEBUG value
+    was never resolved and the debug branch is still live. Check that build.js
+    still defines __BUILD_DEBUG__."
+    fi
+    if [ "$_on" = no ] && [ "$_off" = no ]; then
+        fail "$_file carries no debug marker, so its DEBUG state cannot be
+    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
+    or the emitted output changed shape. Refusing to report success."
+    fi
+
+    if [ "$_on" = yes ]; then
+        MARKER="$MARKER_ON"
+    else
+        MARKER="$MARKER_OFF"
+    fi
+}
+
+# The manifest says which bundles must carry a marker. This says no other
+# emitted bundle may carry one, which catches a manifest that has gone stale
+# or short rather than trusting whatever it happens to list.
+check_unlisted_bundles() {
+    _listing="$(find dist -type f -name '*.js' | sort)"
+    while read -r _file; do
+        [ -n "$_file" ] || continue
+        if grep -q -x -F "$_file" "$MANIFEST"; then
+            continue
+        fi
+        if has_marker "$MARKER_ON" "$_file" ||
+            has_marker "$MARKER_OFF" "$_file"; then
+            fail "$_file carries a debug marker but is absent from $MANIFEST,
+    so the manifest no longer describes the emitted bundles."
+        fi
+    done <<EOF
+$_listing
+EOF
+}
+
+# The requested mode, read from our own environment using build.js's exact
+# rule: only the literal 1 opts in. Deliberately not taken from anything
+# build.js records about itself, so build.js cannot vouch for build.js.
+expected_marker() {
+    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
+        echo "$MARKER_ON"
+    else
+        echo "$MARKER_OFF"
+    fi
+}
+
+main() {
+    cd "$ROOT"
+
+    expected="$(expected_marker)"
+    echo "Verifying emitted bundles (expecting $expected)..."
+
+    [ -f "$MANIFEST" ] ||
+        fail "$MANIFEST is missing. build.js writes it at the end of a
+    successful build; run make build first."
+    [ -s "$MANIFEST" ] ||
+        fail "$MANIFEST is empty, so no emitted bundle was found to contain
+    src/shared/constants.js. That is never correct, so it is a failure and not
+    a pass."
+
+    count=0
+    while read -r file; do
+        [ -n "$file" ] || continue
+        [ -f "$file" ] ||
+            fail "$MANIFEST lists $file, which does not exist."
+        read_marker "$file"
+        [ "$MARKER" = "$expected" ] ||
+            fail "$file is $MARKER but this build expects $expected."
+        echo "  ok: $file ($MARKER)"
+        count=$((count + 1))
+    done <"$MANIFEST"
+
+    [ "$count" -gt 0 ] || fail "no bundles were inspected."
+
+    check_unlisted_bundles
+
+    echo "verify-build: $count bundle(s) verified $expected"
+}
+
+main "$@"
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -5,7 +5,6 @@
 const { DEFAULT_RPC_URL } = require("../shared/constants");
 const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
 const { onChainSwitch } = require("../shared/chainSwitch");
-const { getBytes } = require("ethers");
 const {
    state,
    loadState,
@@ -14,8 +13,7 @@ const {
 } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
 const { debugFetch } = require("../shared/log");
-const { decryptWithPassword } = require("../shared/vault");
-const { getSignerForAddress } = require("../shared/wallet");
+const { verifySignedTx, verifySignature } = require("../shared/approvalVerify");
 const {
    isPhishingDomain,
    updatePhishingList,
@@ -725,39 +723,28 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
            return true;
        }

+        // The popup signs; it reports back here when it could not. Fail the
+        // request the same way this handler used to when it did the signing.
+        if (msg.error) {
+            approval.resolve({ error: { message: msg.error } });
+            sendResponse({ error: msg.error });
+            return false;
+        }
+
        (async () => {
            try {
                await loadState();
                const activeAddress = await getActiveAddress();
-                let wallet, addrIndex;
-                for (const w of state.wallets) {
-                    for (let i = 0; i < w.addresses.length; i++) {
-                        if (w.addresses[i].address === activeAddress) {
-                            wallet = w;
-                            addrIndex = i;
-                            break;
-                        }
-                    }
-                    if (wallet) break;
-                }
-                if (!wallet) throw new Error("Wallet not found");
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
-                let decrypted = await decryptWithPassword(
-                    wallet.encryptedSecret,
-                    msg.password,
+                // The popup holds the secret, but the background stays the
+                // authority on what is broadcast: the raw transaction must be
+                // the approved one, signed by the approved address.
+                verifySignedTx(
+                    msg.rawSignedTx,
+                    approval.txParams,
+                    activeAddress,
                );
-                const signer = getSignerForAddress(
-                    wallet,
-                    addrIndex,
-                    decrypted,
-                );
-                // Best-effort: clear decrypted secret after use.
-                // Note: JS strings are immutable; this nulls the reference but
-                // the original string may persist in memory until GC.
-                decrypted = null;
                const provider = getProvider(state.rpcUrl);
-                const connected = signer.connect(provider);
-                const tx = await connected.sendTransaction(approval.txParams);
+                const tx = await provider.broadcastTransaction(msg.rawSignedTx);
                approval.resolve({ txHash: tx.hash });
                sendResponse({ txHash: tx.hash });
            } catch (e) {
@@ -784,55 +771,23 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
            return true;
        }

+        // The popup signs; it reports back here when it could not. Fail the
+        // request the same way this handler used to when it did the signing.
+        if (msg.error) {
+            approval.resolve({ error: { message: msg.error } });
+            sendResponse({ error: msg.error });
+            return false;
+        }
+
        (async () => {
            try {
-                await loadState();
                const activeAddress = await getActiveAddress();
-                let wallet, addrIndex;
-                for (const w of state.wallets) {
-                    for (let i = 0; i < w.addresses.length; i++) {
-                        if (w.addresses[i].address === activeAddress) {
-                            wallet = w;
-                            addrIndex = i;
-                            break;
-                        }
-                    }
-                    if (wallet) break;
-                }
-                if (!wallet) throw new Error("Wallet not found");
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
-                let decrypted = await decryptWithPassword(
-                    wallet.encryptedSecret,
-                    msg.password,
-                );
-                const signer = getSignerForAddress(
-                    wallet,
-                    addrIndex,
-                    decrypted,
-                );
-                // Best-effort: clear decrypted secret after use.
-                // Note: JS strings are immutable; this nulls the reference but
-                // the original string may persist in memory until GC.
-                decrypted = null;
-
-                const sp = approval.signParams;
-                let signature;
-
-                if (sp.method === "personal_sign" || sp.method === "eth_sign") {
-                    signature = await signer.signMessage(getBytes(sp.message));
-                } else {
-                    // eth_signTypedData_v4 / eth_signTypedData
-                    const typedData = JSON.parse(sp.typedData);
-                    const { domain, types, message } = typedData;
-                    // ethers handles EIP712Domain internally
-                    delete types.EIP712Domain;
-                    signature = await signer.signTypedData(
-                        domain,
-                        types,
-                        message,
-                    );
-                }
-
+                // The popup holds the secret, but the background stays the
+                // authority on what is handed back to the page: the signature
+                // must cover the approved payload and recover to the approved
+                // address.
+                const signature = msg.signature;
+                verifySignature(approval.signParams, signature, activeAddress);
                approval.resolve({ signature });
                sendResponse({ signature });
            } catch (e) {
--- a/src/popup/views/addToken.js
+++ b/src/popup/views/addToken.js
@@ -1,4 +1,4 @@
-const { $, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
--- a/src/popup/views/approval.js
+++ b/src/popup/views/approval.js
@@ -9,10 +9,19 @@ const {
    attachCopyHandlers,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
+const {
+    formatEther,
+    formatUnits,
+    getBytes,
+    Interface,
+    toUtf8String,
+} = require("ethers");
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
+const { decryptWithPassword } = require("../../shared/vault");
+const { getSignerForAddress } = require("../../shared/wallet");
+const { getProvider } = require("../../shared/balances");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
 const runtime =
@@ -153,6 +162,8 @@ function showTxApproval(details) {
        details.isPhishingDomain,
    );

+    pendingTxParams = details.txParams;
+
    const toAddr = details.txParams.to;
    const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
    const ethValue = formatEther(details.txParams.value || "0");
@@ -326,6 +337,7 @@ function showSignApproval(details) {
    );

    const sp = details.signParams;
+    pendingSignParams = sp;

    $("approve-sign-hostname").textContent = details.hostname;
    $("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
@@ -401,6 +413,36 @@ function show(id) {

 let approvalId = null;
 let pendingTxDetails = null;
+// The exact parameters shown to the user, kept so the popup signs what it
+// displayed rather than re-fetching anything at approval time. Both are
+// repopulated by show() when the popup is closed and reopened.
+let pendingTxParams = null;
+let pendingSignParams = null;
+
+// Approve buttons stay disabled and muted while the popup derives the key and
+// signs, which is slow enough (Argon2id) that a double click is likely.
+function setTxButtonBusy(busy) {
+    $("btn-approve-tx").disabled = busy;
+    $("btn-approve-tx").classList.toggle("text-muted", busy);
+}
+
+function setSignButtonBusy(busy) {
+    $("btn-approve-sign").disabled = busy;
+    $("btn-approve-sign").classList.toggle("text-muted", busy);
+}
+
+// Locate the wallet and the address index owning the currently active
+// address. Returns null when no wallet holds it.
+function findActiveWallet() {
+    for (const wallet of state.wallets) {
+        for (let i = 0; i < wallet.addresses.length; i++) {
+            if (wallet.addresses[i].address === state.activeAddress) {
+                return { wallet, addrIndex: i };
+            }
+        }
+    }
+    return null;
+}

 function init(ctx) {
    $("approve-remember").addEventListener("change", async () => {
@@ -430,34 +472,86 @@ function init(ctx) {
        window.close();
    });

-    $("btn-approve-tx").addEventListener("click", () => {
-        const password = $("approve-tx-password").value;
+    $("btn-approve-tx").addEventListener("click", async () => {
+        let password = $("approve-tx-password").value;
        if (!password) {
            showError("approve-tx-error", "Please enter your password.");
            return;
        }
        hideError("approve-tx-error");
-        $("btn-approve-tx").disabled = true;
-        $("btn-approve-tx").classList.add("text-muted");
+        setTxButtonBusy(true);

-        runtime.sendMessage(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: approvalId,
-                approved: true,
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
-                password: password,
-            },
-            (response) => {
-                if (response && response.txHash) {
-                    txStatus.showWait(pendingTxDetails, response.txHash);
-                } else {
-                    const msg =
-                        (response && response.error) || "Transaction failed.";
-                    txStatus.showError(pendingTxDetails, null, msg);
-                }
-            },
-        );
+        const active = findActiveWallet();
+        if (!active) {
+            password = null;
+            showError(
+                "approve-tx-error",
+                "No wallet was found for the active address.",
+            );
+            setTxButtonBusy(false);
+            return;
+        }
+
+        // Decrypt here, in the popup. The password must never cross the
+        // extension messaging boundary; only the signed transaction does.
+        let decryptedSecret;
+        try {
+            decryptedSecret = await decryptWithPassword(
+                active.wallet.encryptedSecret,
+                password,
+            );
+        } catch {
+            showError(
+                "approve-tx-error",
+                "That password is incorrect. Please try again.",
+            );
+            setTxButtonBusy(false);
+            return;
+        } finally {
+            // Best-effort: drop the password as soon as the key derivation
+            // is done. Note that JS strings are immutable; this clears the
+            // reference but the original string may persist until GC.
+            password = null;
+        }
+
+        const payload = {
+            type: "AUTISTMASK_TX_RESPONSE",
+            id: approvalId,
+            approved: true,
+        };
+        try {
+            const signer = getSignerForAddress(
+                active.wallet,
+                active.addrIndex,
+                decryptedSecret,
+            );
+            const provider = getProvider(state.rpcUrl);
+            const connected = signer.connect(provider);
+            // This is the sequence ethers' own sendTransaction() runs
+            // internally, so nonce, gas, fee and chain id population are
+            // identical to when the background did the signing.
+            const populated =
+                await connected.populateTransaction(pendingTxParams);
+            delete populated.from;
+            payload.rawSignedTx = await connected.signTransaction(populated);
+        } catch (e) {
+            payload.error =
+                e.shortMessage || e.message || "Transaction signing failed.";
+        } finally {
+            // Best-effort: clear the decrypted secret after use, with the
+            // same immutability caveat as the password above.
+            decryptedSecret = null;
+        }
+
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.txHash) {
+                txStatus.showWait(pendingTxDetails, response.txHash);
+            } else {
+                const msg =
+                    (response && response.error) || "Transaction failed.";
+                txStatus.showError(pendingTxDetails, null, msg);
+            }
+        });
    });

    $("btn-reject-tx").addEventListener("click", () => {
@@ -469,36 +563,93 @@ function init(ctx) {
        window.close();
    });

-    $("btn-approve-sign").addEventListener("click", () => {
-        const password = $("approve-sign-password").value;
+    $("btn-approve-sign").addEventListener("click", async () => {
+        let password = $("approve-sign-password").value;
        if (!password) {
            showError("approve-sign-error", "Please enter your password.");
            return;
        }
        hideError("approve-sign-error");
-        $("btn-approve-sign").disabled = true;
-        $("btn-approve-sign").classList.add("text-muted");
+        setSignButtonBusy(true);

-        runtime.sendMessage(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: approvalId,
-                approved: true,
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
-                password: password,
-            },
-            (response) => {
-                if (response && response.signature) {
-                    window.close();
-                } else {
-                    const msg =
-                        (response && response.error) || "Signing failed.";
-                    showError("approve-sign-error", msg);
-                    $("btn-approve-sign").disabled = false;
-                    $("btn-approve-sign").classList.remove("text-muted");
-                }
-            },
-        );
+        const active = findActiveWallet();
+        if (!active) {
+            password = null;
+            showError(
+                "approve-sign-error",
+                "No wallet was found for the active address.",
+            );
+            setSignButtonBusy(false);
+            return;
+        }
+
+        // Decrypt here, in the popup. The password must never cross the
+        // extension messaging boundary; only the signature does.
+        let decryptedSecret;
+        try {
+            decryptedSecret = await decryptWithPassword(
+                active.wallet.encryptedSecret,
+                password,
+            );
+        } catch {
+            showError(
+                "approve-sign-error",
+                "That password is incorrect. Please try again.",
+            );
+            setSignButtonBusy(false);
+            return;
+        } finally {
+            // Best-effort: drop the password as soon as the key derivation
+            // is done. Note that JS strings are immutable; this clears the
+            // reference but the original string may persist until GC.
+            password = null;
+        }
+
+        const payload = {
+            type: "AUTISTMASK_SIGN_RESPONSE",
+            id: approvalId,
+            approved: true,
+        };
+        try {
+            const signer = getSignerForAddress(
+                active.wallet,
+                active.addrIndex,
+                decryptedSecret,
+            );
+            const sp = pendingSignParams;
+            if (sp.method === "personal_sign" || sp.method === "eth_sign") {
+                payload.signature = await signer.signMessage(
+                    getBytes(sp.message),
+                );
+            } else {
+                // eth_signTypedData_v4 / eth_signTypedData
+                const typedData = JSON.parse(sp.typedData);
+                const { domain, types, message } = typedData;
+                // ethers handles EIP712Domain internally
+                delete types.EIP712Domain;
+                payload.signature = await signer.signTypedData(
+                    domain,
+                    types,
+                    message,
+                );
+            }
+        } catch (e) {
+            payload.error = e.shortMessage || e.message || "Signing failed.";
+        } finally {
+            // Best-effort: clear the decrypted secret after use, with the
+            // same immutability caveat as the password above.
+            decryptedSecret = null;
+        }
+
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.signature) {
+                window.close();
+            } else {
+                const msg = (response && response.error) || "Signing failed.";
+                showError("approve-sign-error", msg);
+                setSignButtonBusy(false);
+            }
+        });
    });

    $("btn-reject-sign").addEventListener("click", () => {
--- a/src/popup/views/deleteWallet.js
+++ b/src/popup/views/deleteWallet.js
@@ -1,6 +1,10 @@
 const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
+const {
+    removeWalletFromState,
+    broadcastActiveChanged,
+} = require("../../shared/walletDelete");

 let deleteWalletIndex = null;
 let ctx = null;
@@ -58,35 +62,24 @@ function init(_ctx) {
            return;
        }

-        // Collect addresses to clean up from allowedSites/deniedSites
-        const addresses = (wallet.addresses || []).map((a) => a.address);
-
-        // Remove wallet
-        state.wallets.splice(walletIdx, 1);
-
-        // Clean up site permissions for deleted addresses
-        for (const addr of addresses) {
-            delete state.allowedSites[addr];
-            delete state.deniedSites[addr];
-        }
+        // Remove the wallet and repair selection, permissions and hasWallet
+        const { activeAddressChanged } = removeWalletFromState(
+            state,
+            walletIdx,
+        );

        deleteWalletIndex = null;

-        if (state.wallets.length === 0) {
-            // No wallets left — reset selection and show welcome
-            state.selectedWallet = null;
-            state.selectedAddress = null;
-            state.activeAddress = null;
+        if (!state.hasWallet) {
            clearViewStack();
            await saveState();
+            // Save before broadcasting: the background reads the active
+            // address back out of storage to build accountsChanged.
+            if (activeAddressChanged) broadcastActiveChanged();
            showView("welcome");
        } else {
-            // Switch to first wallet if deleted wallet was active
-            state.selectedWallet = 0;
-            state.selectedAddress = 0;
-            state.activeAddress =
-                state.wallets[0].addresses[0]?.address || null;
            await saveState();
+            if (activeAddressChanged) broadcastActiveChanged();
            // Reset stack to [main] so Settings back goes home.
            // Use require() lazily to avoid circular dependency
            // (settings.js requires deleteWallet.js).
--- a/src/popup/views/transactionDetail.js
+++ b/src/popup/views/transactionDetail.js
@@ -7,6 +7,7 @@ const {
    showFlash,
    flashCopyFeedback,
    addressTitle,
+    addressDotHtml,
    escapeHtml,
    isoDate,
    timeAgo,
--- a/src/shared/approvalVerify.js
+++ b/src/shared/approvalVerify.js
@@ -0,0 +1,124 @@
+// Verification of the signed artifacts produced by the approval popup.
+//
+// Signing happens in the popup, where the password is entered; the background
+// only broadcasts the raw transaction and resolves the pending approval back
+// to the requesting page. So that moving the signing out of the background
+// does not turn the background into a blind relay, the background re-derives
+// the signer from the artifact and checks it against the approval it is
+// holding before acting on it. All recovery is delegated to ethers.
+//
+// Every failure message is a full sentence, because these strings are shown to
+// the user and returned to the dApp.
+
+const {
+    Transaction,
+    getAddress,
+    getBytes,
+    verifyMessage,
+    verifyTypedData,
+} = require("ethers");
+
+// Case-insensitive address comparison that tolerates absent values on either
+// side. Two absent addresses compare equal (contract creation has no `to`).
+function sameAddress(a, b) {
+    const aMissing = a === null || a === undefined || a === "";
+    const bMissing = b === null || b === undefined || b === "";
+    if (aMissing || bMissing) return aMissing && bMissing;
+    try {
+        return getAddress(a) === getAddress(b);
+    } catch {
+        return String(a).toLowerCase() === String(b).toLowerCase();
+    }
+}
+
+// Normalize a transaction value (hex string, decimal string, number or
+// bigint) to a bigint. An absent value is zero, matching ethers.
+function normalizeValue(v) {
+    if (v === null || v === undefined || v === "") return 0n;
+    return BigInt(v);
+}
+
+// Normalize call data to a lowercase hex string. Absent data is "0x".
+function normalizeData(v) {
+    if (v === null || v === undefined || v === "" || v === "0x") return "0x";
+    return String(v).toLowerCase();
+}
+
+// Assert that a raw signed transaction is the transaction the user approved,
+// signed by the address the approval was raised for. Returns the parsed
+// ethers Transaction on success, throws otherwise.
+function verifySignedTx(rawSignedTx, txParams, expectedFrom) {
+    if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
+        throw new Error("The signed transaction is missing or malformed.");
+    }
+
+    let parsed;
+    try {
+        parsed = Transaction.from(rawSignedTx);
+    } catch {
+        throw new Error("The signed transaction could not be decoded.");
+    }
+
+    if (!parsed.from) {
+        throw new Error("The signed transaction carries no valid signature.");
+    }
+    if (!sameAddress(parsed.from, expectedFrom)) {
+        throw new Error(
+            "The signed transaction was signed by a different address than the one that was approved.",
+        );
+    }
+    if (!sameAddress(parsed.to, txParams.to)) {
+        throw new Error(
+            "The signed transaction does not go to the approved recipient.",
+        );
+    }
+    if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
+        throw new Error(
+            "The signed transaction does not carry the approved value.",
+        );
+    }
+    if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
+        throw new Error(
+            "The signed transaction does not carry the approved call data.",
+        );
+    }
+
+    return parsed;
+}
+
+// Assert that a signature over the approved message or typed data was
+// produced by the address the approval was raised for. Returns the recovered
+// address on success, throws otherwise.
+function verifySignature(signParams, signature, expectedFrom) {
+    if (typeof signature !== "string" || !signature.startsWith("0x")) {
+        throw new Error("The signature is missing or malformed.");
+    }
+
+    let recovered;
+    try {
+        if (
+            signParams.method === "personal_sign" ||
+            signParams.method === "eth_sign"
+        ) {
+            recovered = verifyMessage(getBytes(signParams.message), signature);
+        } else {
+            const typedData = JSON.parse(signParams.typedData);
+            const { domain, types, message } = typedData;
+            // ethers derives EIP712Domain itself and rejects it as an input.
+            delete types.EIP712Domain;
+            recovered = verifyTypedData(domain, types, message, signature);
+        }
+    } catch {
+        throw new Error("The signature could not be verified.");
+    }
+
+    if (!sameAddress(recovered, expectedFrom)) {
+        throw new Error(
+            "The signature was produced by a different address than the one that was approved.",
+        );
+    }
+
+    return recovered;
+}
+
+module.exports = { verifySignedTx, verifySignature, sameAddress };
--- a/src/shared/constants.js
+++ b/src/shared/constants.js
@@ -7,6 +7,21 @@
 /* global __BUILD_DEBUG__ */
 const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;

+// Machine-readable record of the compiled DEBUG state, read out of the emitted
+// bundles by script/verify-build. It is derived from DEBUG itself so the two
+// cannot disagree, and it is a plain string literal rather than a minifier
+// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
+// staying byte-stable across versions.
+//
+// The ambiguity is the point. When DEBUG is known at build time the bundler
+// folds this to exactly one of the two literals. When it is not — which is
+// exactly what happens if the __BUILD_DEBUG__ define goes missing from
+// build.js — the ternary survives, both literals appear in the bundle, and
+// verify-build fails rather than guessing.
+const BUILD_DEBUG_MARKER = DEBUG
+    ? "autistmask-build-debug=on"
+    : "autistmask-build-debug=off";
+
 const DEBUG_MNEMONIC =
    "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";

@@ -44,6 +59,7 @@ function isBurnAddress(address) {

 module.exports = {
    DEBUG,
+    BUILD_DEBUG_MARKER,
    DEBUG_MNEMONIC,
    ETHEREUM_MAINNET_CHAIN_ID,
    ETHEREUM_SEPOLIA_CHAIN_ID,
--- a/src/shared/vault.js
+++ b/src/shared/vault.js
@@ -1,14 +1,75 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
+//
+// Backend: WebAssembly, deliberately (#182).
+//
+// libsodium ships one file containing both a WebAssembly build and a
+// wasm2js ("asm.js") translation of it. It tries WASM first and, if
+// instantiation throws, silently swaps in the translation. An extension
+// CSP of plain script-src 'self' refuses WASM, so every popup load used
+// to take that fallback — announced by nothing but an uncaught
+// CompileError in the console.
+//
+// Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
+// MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
+// WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
+// identical either way — it is set by the ops/mem parameters, not by wall
+// time — so the fallback bought no security, it only made every password
+// operation take three and a half seconds, and the wallet asks for the
+// password on every signature.
+//
+// So both manifests declare 'wasm-unsafe-eval' for extension pages. That
+// keyword permits compiling WebAssembly and nothing else: not eval() of
+// strings, not inline script, not remote script. Reaching it requires
+// already executing script in the extension page, which is total
+// compromise on its own. 'unsafe-eval' would be a different matter and is
+// not granted. tests/manifest.test.js pins both policies to exactly
+// "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
+// strictness can drift unnoticed.
+//
+// The fallback still exists, and a wallet that refuses to decrypt is
+// worse than a slow one, so it is not disabled — it is made loud:
+// cryptoBackend() reports which backend this realm can run, ensureReady()
+// logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
+// unit tests exercise the WASM backend, and the end-to-end suite asserts
+// it in the real popup under the real manifest.

 const sodium = require("libsodium-wrappers-sumo");
+const { log } = require("./log");
+
+// An empty WebAssembly module: the 8-byte magic number and version header,
+// no sections. Compiling it asks the cheapest possible form of the only
+// question that matters here — may this realm compile WebAssembly at all —
+// which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
+// exactly what decides which backend libsodium ends up on.
+const EMPTY_WASM_MODULE = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+]);
+
+// "wasm" or "asmjs": the libsodium backend in use in this realm.
+async function cryptoBackend() {
+    try {
+        await WebAssembly.compile(EMPTY_WASM_MODULE);
+        return "wasm";
+    } catch (_) {
+        return "asmjs";
+    }
+}

 let ready = false;

 async function ensureReady() {
    if (!ready) {
        await sodium.ready;
+        if ((await cryptoBackend()) !== "wasm") {
+            log.errorf(
+                "libsodium is running on the wasm2js fallback: this realm " +
+                    "refuses to compile WebAssembly, so every password " +
+                    "derivation costs roughly 20x what it should. See the " +
+                    "backend note in src/shared/vault.js.",
+            );
+        }
        ready = true;
    }
 }
@@ -59,4 +120,4 @@ async function decryptWithPassword(encrypted, password) {
    return sodium.to_string(plaintext);
 }

-module.exports = { encryptWithPassword, decryptWithPassword };
+module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };
--- a/src/shared/walletDelete.js
+++ b/src/shared/walletDelete.js
@@ -0,0 +1,70 @@
+// Wallet deletion state transition, kept out of the view so the selection
+// and broadcast rules are testable without a DOM.
+
+// Remove wallet `walletIdx` from `state` and repair the derived state.
+//
+// Rules:
+//   - `hasWallet` tracks whether any wallet remains.
+//   - Site permissions are dropped for every address of the deleted wallet.
+//   - `selectedWallet` follows the splice: it is decremented when a wallet
+//     before it was removed, and falls back to the first remaining wallet's
+//     first address only when the selection itself was deleted.
+//   - `activeAddress` is only moved when it belonged to the deleted wallet;
+//     the fallback is the first remaining wallet's first address, or null
+//     when no wallet remains.
+//
+// Returns whether `activeAddress` changed, so the caller can broadcast it.
+function removeWalletFromState(state, walletIdx) {
+    const wallet = state.wallets[walletIdx];
+    const addresses = (wallet.addresses || []).map((a) => a.address);
+    const previousActive = state.activeAddress;
+    const activeWasDeleted =
+        previousActive !== null &&
+        previousActive !== undefined &&
+        addresses.some(
+            (a) => a.toLowerCase() === String(previousActive).toLowerCase(),
+        );
+
+    state.wallets.splice(walletIdx, 1);
+
+    for (const addr of addresses) {
+        delete state.allowedSites[addr];
+        delete state.deniedSites[addr];
+    }
+
+    state.hasWallet = state.wallets.length > 0;
+
+    const fallbackAddress = state.hasWallet
+        ? state.wallets[0].addresses[0]?.address || null
+        : null;
+
+    if (!state.hasWallet) {
+        state.selectedWallet = null;
+        state.selectedAddress = null;
+    } else if (state.selectedWallet === walletIdx) {
+        state.selectedWallet = 0;
+        state.selectedAddress = 0;
+    } else if (
+        typeof state.selectedWallet === "number" &&
+        state.selectedWallet > walletIdx
+    ) {
+        state.selectedWallet -= 1;
+    }
+
+    if (activeWasDeleted || !state.hasWallet) {
+        state.activeAddress = fallbackAddress;
+    }
+
+    return { activeAddressChanged: state.activeAddress !== previousActive };
+}
+
+// Tell the background the active address changed, so it re-emits
+// accountsChanged to connected sites. Same call shape as the address
+// switch in the home view.
+function broadcastActiveChanged() {
+    const runtime =
+        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+    runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+}
+
+module.exports = { removeWalletFromState, broadcastActiveChanged };
--- a/tests/approvalVerify.test.js
+++ b/tests/approvalVerify.test.js
@@ -0,0 +1,355 @@
+const { Network, Transaction, Wallet } = require("ethers");
+const {
+    verifySignedTx,
+    verifySignature,
+    sameAddress,
+} = require("../src/shared/approvalVerify");
+const { getSignerForAddress } = require("../src/shared/wallet");
+
+// Fixed test keys — never used for anything but these tests.
+const SIGNER_KEY =
+    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
+const OTHER_KEY =
+    "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a";
+
+const signer = new Wallet(SIGNER_KEY);
+const other = new Wallet(OTHER_KEY);
+
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const OTHER_RECIPIENT = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+
+// Approved parameters as a dApp would supply them over eth_sendTransaction.
+const TX_PARAMS = {
+    from: signer.address,
+    to: RECIPIENT,
+    value: "0x2386f26fc10000",
+    data: "0xdeadbeef",
+    gas: "0x5208",
+};
+
+// Build a signable transaction from approved params. The popup does the same
+// thing through populateTransaction(); here the fields are fixed so the test
+// needs no provider.
+function txFor(params) {
+    return {
+        chainId: 1,
+        nonce: 7,
+        gasLimit: 100000n,
+        maxFeePerGas: 2000000000n,
+        maxPriorityFeePerGas: 1000000000n,
+        type: 2,
+        to: params.to,
+        value: params.value === undefined ? 0n : BigInt(params.value),
+        data: params.data || "0x",
+    };
+}
+
+async function signedFor(params, withWallet) {
+    return (withWallet || signer).signTransaction(txFor(params));
+}
+
+describe("sameAddress", () => {
+    test("compares checksummed and lowercase forms as equal", () => {
+        expect(sameAddress(RECIPIENT, RECIPIENT.toLowerCase())).toBe(true);
+    });
+
+    test("treats two absent addresses as equal (contract creation)", () => {
+        expect(sameAddress(null, undefined)).toBe(true);
+        expect(sameAddress("", null)).toBe(true);
+    });
+
+    test("treats one absent address as unequal", () => {
+        expect(sameAddress(RECIPIENT, null)).toBe(false);
+        expect(sameAddress(null, RECIPIENT)).toBe(false);
+    });
+
+    test("does not throw on values that are not addresses", () => {
+        expect(sameAddress("not-an-address", RECIPIENT)).toBe(false);
+    });
+});
+
+describe("verifySignedTx", () => {
+    test("accepts the approved transaction signed by the approved address", async () => {
+        const raw = await signedFor(TX_PARAMS);
+        const parsed = verifySignedTx(raw, TX_PARAMS, signer.address);
+        expect(parsed.from).toBe(signer.address);
+        expect(parsed.hash).toBe(Transaction.from(raw).hash);
+    });
+
+    test("accepts a contract creation with no recipient", async () => {
+        const params = { to: undefined, value: "0x0", data: "0x600160005500" };
+        const raw = await signedFor(params);
+        expect(() => verifySignedTx(raw, params, signer.address)).not.toThrow();
+    });
+
+    test("accepts an absent value as zero", async () => {
+        const approved = { to: RECIPIENT, data: "0x" };
+        const raw = await signedFor(approved);
+        expect(() =>
+            verifySignedTx(raw, approved, signer.address),
+        ).not.toThrow();
+    });
+
+    test("accepts call data whose case differs from the approval", async () => {
+        const approved = { to: RECIPIENT, value: "0x0", data: "0xDEADBEEF" };
+        const raw = await signedFor(approved);
+        expect(() =>
+            verifySignedTx(raw, approved, signer.address),
+        ).not.toThrow();
+    });
+
+    test("rejects a swapped recipient", async () => {
+        const raw = await signedFor({
+            ...TX_PARAMS,
+            to: OTHER_RECIPIENT,
+        });
+        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
+            /approved recipient/,
+        );
+    });
+
+    test("rejects an inflated value", async () => {
+        const raw = await signedFor({
+            ...TX_PARAMS,
+            value: "0x4563918244f40000",
+        });
+        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
+            /approved value/,
+        );
+    });
+
+    test("rejects substituted call data", async () => {
+        const raw = await signedFor({ ...TX_PARAMS, data: "0xc0ffee" });
+        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
+            /approved call data/,
+        );
+    });
+
+    test("rejects a transaction signed by a different address", async () => {
+        const raw = await signedFor(TX_PARAMS, other);
+        expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
+            /different address/,
+        );
+    });
+
+    test("rejects an unsigned transaction", () => {
+        const unsigned = Transaction.from(txFor(TX_PARAMS)).unsignedSerialized;
+        expect(() =>
+            verifySignedTx(unsigned, TX_PARAMS, signer.address),
+        ).toThrow(/no valid signature/);
+    });
+
+    test("rejects a missing or malformed payload", () => {
+        expect(() =>
+            verifySignedTx(undefined, TX_PARAMS, signer.address),
+        ).toThrow(/missing or malformed/);
+        expect(() => verifySignedTx("nope", TX_PARAMS, signer.address)).toThrow(
+            /missing or malformed/,
+        );
+        expect(() =>
+            verifySignedTx("0xc0ffee", TX_PARAMS, signer.address),
+        ).toThrow(/could not be decoded/);
+    });
+
+    test("every rejection message is a full sentence", async () => {
+        const raw = await signedFor({ ...TX_PARAMS, to: OTHER_RECIPIENT });
+        try {
+            verifySignedTx(raw, TX_PARAMS, signer.address);
+            throw new Error("expected a rejection");
+        } catch (e) {
+            expect(e.message).toMatch(/^[A-Z].*\.$/);
+        }
+    });
+});
+
+const TYPED_DATA = JSON.stringify({
+    domain: {
+        name: "AutistMask Test",
+        version: "1",
+        chainId: 1,
+        verifyingContract: OTHER_RECIPIENT,
+    },
+    primaryType: "Mail",
+    types: {
+        EIP712Domain: [
+            { name: "name", type: "string" },
+            { name: "version", type: "string" },
+            { name: "chainId", type: "uint256" },
+            { name: "verifyingContract", type: "address" },
+        ],
+        Mail: [
+            { name: "from", type: "address" },
+            { name: "to", type: "address" },
+            { name: "contents", type: "string" },
+        ],
+    },
+    message: {
+        from: signer.address,
+        to: RECIPIENT,
+        contents: "hello",
+    },
+});
+
+describe("verifySignature", () => {
+    // "Hello AutistMask" as the hex string a dApp passes to personal_sign.
+    const MESSAGE = "0x48656c6c6f204175746973744d61736b";
+    const personalParams = {
+        method: "personal_sign",
+        message: MESSAGE,
+        from: signer.address,
+    };
+    const typedParams = {
+        method: "eth_signTypedData_v4",
+        typedData: TYPED_DATA,
+        from: signer.address,
+    };
+
+    async function signPersonal(withWallet) {
+        return (withWallet || signer).signMessage(
+            Buffer.from(MESSAGE.slice(2), "hex"),
+        );
+    }
+
+    async function signTyped(withWallet) {
+        const { domain, types, message } = JSON.parse(TYPED_DATA);
+        delete types.EIP712Domain;
+        return (withWallet || signer).signTypedData(domain, types, message);
+    }
+
+    test("accepts a personal_sign signature from the approved address", async () => {
+        const signature = await signPersonal();
+        expect(verifySignature(personalParams, signature, signer.address)).toBe(
+            signer.address,
+        );
+    });
+
+    test("accepts an eth_sign signature the same way", async () => {
+        const signature = await signPersonal();
+        const params = { ...personalParams, method: "eth_sign" };
+        expect(() =>
+            verifySignature(params, signature, signer.address),
+        ).not.toThrow();
+    });
+
+    test("accepts a typed data signature from the approved address", async () => {
+        const signature = await signTyped();
+        expect(verifySignature(typedParams, signature, signer.address)).toBe(
+            signer.address,
+        );
+    });
+
+    test("does not mutate the approved typed data while verifying", async () => {
+        const signature = await signTyped();
+        const before = typedParams.typedData;
+        verifySignature(typedParams, signature, signer.address);
+        expect(typedParams.typedData).toBe(before);
+        expect(
+            JSON.parse(typedParams.typedData).types.EIP712Domain,
+        ).toBeDefined();
+    });
+
+    test("rejects a personal_sign signature from a different address", async () => {
+        const signature = await signPersonal(other);
+        expect(() =>
+            verifySignature(personalParams, signature, signer.address),
+        ).toThrow(/different address/);
+    });
+
+    test("rejects a typed data signature from a different address", async () => {
+        const signature = await signTyped(other);
+        expect(() =>
+            verifySignature(typedParams, signature, signer.address),
+        ).toThrow(/different address/);
+    });
+
+    test("rejects a signature over a different message", async () => {
+        const signature = await signer.signMessage(
+            Buffer.from("00112233", "hex"),
+        );
+        expect(() =>
+            verifySignature(personalParams, signature, signer.address),
+        ).toThrow(/different address/);
+    });
+
+    test("rejects a missing or malformed signature", async () => {
+        expect(() =>
+            verifySignature(personalParams, undefined, signer.address),
+        ).toThrow(/missing or malformed/);
+        expect(() =>
+            verifySignature(personalParams, "0x1234", signer.address),
+        ).toThrow(/could not be verified/);
+    });
+});
+
+// End-to-end over the messaging boundary, without a browser: run the exact
+// sequence the approval popup runs, then hand the artifact to the exact check
+// the background runs before it broadcasts or resolves. Only what the popup
+// puts on the wire is passed along, so this also pins down that the wire
+// payload is sufficient on its own.
+describe("popup signing sequence to background verification", () => {
+    // Stand-in for the JSON-RPC provider. populateTransaction only needs the
+    // nonce, the gas estimate, the network and the fee data.
+    const fakeProvider = {
+        getNetwork: async () => Network.from(1),
+        getTransactionCount: async () => 7,
+        estimateGas: async () => 21000n,
+        getFeeData: async () => ({
+            gasPrice: 2000000000n,
+            maxFeePerGas: 2000000000n,
+            maxPriorityFeePerGas: 1000000000n,
+        }),
+    };
+
+    // A private-key wallet as it is persisted in state, so the test goes
+    // through getSignerForAddress() the way the popup does.
+    const walletData = { type: "privkey" };
+
+    async function popupSignsTx(txParams) {
+        const localSigner = getSignerForAddress(walletData, 0, SIGNER_KEY);
+        const connected = localSigner.connect(fakeProvider);
+        const populated = await connected.populateTransaction(txParams);
+        delete populated.from;
+        return connected.signTransaction(populated);
+    }
+
+    test("a populated, signed transaction is accepted and broadcastable", async () => {
+        const rawSignedTx = await popupSignsTx(TX_PARAMS);
+        const parsed = verifySignedTx(rawSignedTx, TX_PARAMS, signer.address);
+        expect(parsed.nonce).toBe(7);
+        expect(parsed.chainId).toBe(1n);
+        expect(parsed.gasLimit).toBe(21000n);
+        expect(parsed.to).toBe(RECIPIENT);
+        expect(parsed.value).toBe(BigInt(TX_PARAMS.value));
+        expect(parsed.data).toBe(TX_PARAMS.data);
+        expect(parsed.signature).not.toBeNull();
+    });
+
+    test("the wire payload carries no password and no secret", async () => {
+        const rawSignedTx = await popupSignsTx(TX_PARAMS);
+        const payload = {
+            type: "AUTISTMASK_TX_RESPONSE",
+            id: "test-approval-id",
+            approved: true,
+            rawSignedTx,
+        };
+        expect(Object.keys(payload).sort()).toEqual([
+            "approved",
+            "id",
+            "rawSignedTx",
+            "type",
+        ]);
+        const wire = JSON.stringify(payload).toLowerCase();
+        expect(wire).not.toContain("password");
+        expect(wire).not.toContain(SIGNER_KEY.slice(2).toLowerCase());
+    });
+
+    test("the background rejects a transaction the popup did not approve", async () => {
+        const rawSignedTx = await popupSignsTx({
+            ...TX_PARAMS,
+            to: OTHER_RECIPIENT,
+        });
+        expect(() =>
+            verifySignedTx(rawSignedTx, TX_PARAMS, signer.address),
+        ).toThrow(/approved recipient/);
+    });
+});
--- a/tests/constants.test.js
+++ b/tests/constants.test.js
@@ -1,4 +1,6 @@
 const {
+    DEBUG,
+    BUILD_DEBUG_MARKER,
    ETHEREUM_MAINNET_CHAIN_ID,
    DEFAULT_RPC_URL,
    BIP44_ETH_PATH,
@@ -19,6 +21,24 @@ describe("constants", () => {
        expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
    });

+    // This does not replace script/verify-build, which is the only thing that
+    // can see the compiled DEBUG state of a real bundle. It pins the source
+    // invariant that the marker tracks DEBUG, so the two cannot be edited
+    // apart and leave verify-build asserting something that is no longer the
+    // flag the code branches on.
+    test("build debug marker is derived from DEBUG", () => {
+        expect(BUILD_DEBUG_MARKER).toBe(
+            DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
+        );
+    });
+
+    // Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
+    // must be the safe one.
+    test("DEBUG is off when loaded outside a bundle", () => {
+        expect(DEBUG).toBe(false);
+        expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
+    });
+
    test("exports ERC-20 ABI with expected functions", () => {
        expect(Array.isArray(ERC20_ABI)).toBe(true);
        expect(ERC20_ABI.length).toBeGreaterThan(0);
--- a/tests/e2e/harness.js
+++ b/tests/e2e/harness.js
@@ -0,0 +1,304 @@
+// End-to-end harness: launches a real Chromium with the unpacked MV3
+// build loaded, collects every uncaught page error and console.error, and
+// exposes the popup flows the tests drive.
+//
+// This runs inside the pinned Playwright container; see script/test-e2e.
+// It is deliberately NOT part of make check — REPO_POLICIES.md caps
+// make test at 20 seconds and a browser suite does not fit.
+
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const { chromium } = require("playwright-core");
+const { installNetworkStubs } = require("./network");
+
+const REPO_ROOT = path.resolve(__dirname, "..", "..");
+const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
+
+// Page errors that are known, tracked, and deliberately tolerated. Every
+// entry must name the issue that will remove it. This list is the one
+// concession in an otherwise zero-tolerance policy: an uncaught error is
+// how this harness caught issue #150 in the first place.
+//
+// Empty, and worth keeping that way. Its only entry was the WASM
+// CompileError libsodium provoked on every popup load, deleted with #182
+// when both manifests started allowing WASM; the run that used to need it
+// is now the run that proves the fix.
+const ALLOWED_ERRORS = [];
+
+function isAllowed(text) {
+    return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
+}
+
+// Collects every uncaught page error, console.error and unstubbed
+// request, and hands each one to exactly one reporter.
+//
+// This deliberately has NO window API. It used to expose mark()/since()
+// so a test could ask for "the errors since I started", and that shape
+// produced a green run that proved nothing twice over: first the mark
+// started after test 1, so everything recorded during launch was
+// discarded, then the tail after the final test was never read at all. In
+// both cases a record fell outside somebody's window and vanished, which
+// is the precise failure this harness exists to prevent.
+//
+// So there is no window left to fall outside of. take() is the only
+// reader and it always takes everything outstanding, so successive takes
+// partition the entire record stream with no gaps, and the runner turns
+// every record it reads into a failure.
+//
+// Observation ends when the browser context is closed. Nothing records
+// after that — the route handler and the console listeners are gone with
+// the context — so there is no post-teardown phase to collect, and this
+// class deliberately offers no mechanism pretending to cover one.
+class ErrorCollector {
+    constructor() {
+        this.entries = [];
+        this.taken = 0;
+    }
+
+    record(kind, text) {
+        const line = kind + ": " + String(text).split("\n")[0];
+        if (isAllowed(line)) return;
+        this.entries.push(line);
+    }
+
+    // Everything recorded since the previous take(). Never yields a
+    // record twice and never skips one.
+    take() {
+        const out = this.entries.slice(this.taken);
+        this.taken = this.entries.length;
+        return out;
+    }
+}
+
+function attachErrorListeners(ctx, errors) {
+    const attachPage = (page) => {
+        page.on("pageerror", (err) => {
+            errors.record("pageerror", err.message || String(err));
+        });
+        page.on("console", (msg) => {
+            if (msg.type() === "error") {
+                errors.record("console.error", msg.text());
+            }
+        });
+    };
+    ctx.pages().forEach(attachPage);
+    ctx.on("page", attachPage);
+    // Per-page listeners only: the context-level "weberror" event covers
+    // the same page exceptions and would double-report them. Playwright
+    // exposes no error EVENT for service workers, so an uncaught
+    // exception in the background worker is not visible here — everything
+    // this suite drives lives in the popup page. That is an error-channel
+    // gap only: worker NETWORK traffic is intercepted and reported like
+    // any other, and assertWorkerTrafficIntercepted() below fails the run
+    // if it ever stops being.
+}
+
+async function serviceWorker(ctx) {
+    const [existing] = ctx.serviceWorkers();
+    if (existing) return existing;
+    return ctx.waitForEvent("serviceworker", { timeout: 30000 });
+}
+
+// How long to wait for the background worker's first outbound request.
+//
+// The margin that actually decides whether this check is sound is not
+// this timeout — it is whether the route handler is installed before the
+// worker fetches. Measured over several runs: route installation
+// completes 11-23ms after the context comes up, and the worker's
+// blocklist fetch arrives 525-883ms after that, so the route wins by
+// roughly 25-50x. This 30s figure is only slack for a loaded machine on
+// top of that; losing the race fails the run rather than passing it
+// quietly, which was verified by forcing a 3s delay before route
+// installation.
+const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
+
+// ctx.route() only sees service-worker requests when Playwright runs with
+// PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
+// sets. Without it the worker's traffic — notably the phishing blocklist
+// fetch src/background/index.js issues at startup — goes to the real
+// internet, and nothing says so, because src/shared/phishingDomains.js
+// swallows fetch failures. A harness whose isolation can lapse in silence
+// is worthless, so this does not take the flag on trust: the background
+// worker's own startup fetch has to show up in the route handler, or the
+// suite refuses to run.
+//
+// Deliberately NOT a synthetic probe fetched through worker.evaluate():
+// evaluating in an extension worker this early kills it (the call fails
+// with "Target page, context or browser has been closed" and the worker
+// disappears), which would break the very thing being measured. Observing
+// traffic the extension already generates costs nothing and cannot
+// perturb it.
+async function assertWorkerTrafficIntercepted(stubs) {
+    const seen = await stubs.waitForServiceWorkerTraffic(
+        WORKER_TRAFFIC_TIMEOUT_MS,
+    );
+    if (seen) return seen;
+
+    // State the observation, not a conclusion. This fires for at least
+    // two quite different causes and the harness cannot tell them apart
+    // from here, so guessing one of them in the message sends the reader
+    // the wrong way.
+    throw new Error(
+        "observed no service-worker request in the route handler within " +
+            WORKER_TRAFFIC_TIMEOUT_MS +
+            "ms. Under working interception the background worker's " +
+            "startup blocklist fetch (src/background/index.js) reaches the " +
+            "handler about half a second after the route is installed. " +
+            "Two causes are plausible and this check cannot distinguish " +
+            "them: (1) service-worker interception is not in effect, so " +
+            "that traffic went to the real internet unobserved — the suite " +
+            "must be run through script/test-e2e, which sets " +
+            "PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
+            "Playwright upgrade may have dropped or renamed that flag; " +
+            "(2) no worker request was made in the first place — the route " +
+            "lost the startup race, or the worker no longer fetches at " +
+            "startup, in which case this check needs a new anchor because " +
+            "there is no longer any worker traffic to observe. Either way " +
+            "the fix is a replacement mechanism or an honest downgrade of " +
+            "the isolation claims in tests/e2e/network.js and README.md — " +
+            "not deleting this check",
+    );
+}
+
+async function launch(routeOpts) {
+    if (!fs.existsSync(path.join(EXT_PATH, "manifest.json"))) {
+        throw new Error(
+            "no unpacked build at " +
+                EXT_PATH +
+                " — run make build before the e2e suite",
+        );
+    }
+
+    const userDir = fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-e2e-"));
+    const ctx = await chromium.launchPersistentContext(userDir, {
+        // channel: "chromium" is load-bearing. The default headless mode
+        // uses the headless shell, which silently refuses to load
+        // extensions: there is no error at all, the service worker simply
+        // never appears. This cost real debugging time once already.
+        channel: "chromium",
+        headless: true,
+        args: [
+            "--disable-extensions-except=" + EXT_PATH,
+            "--load-extension=" + EXT_PATH,
+            // The container runs unprivileged; Chrome's sandbox needs
+            // capabilities the harness deliberately does not grant it.
+            "--no-sandbox",
+            // Belt to the interception braces: nothing that slips past
+            // the route handler can resolve a name, so a request that
+            // escapes cannot actually reach the internet. Detection is
+            // still assertWorkerTrafficIntercepted()'s job — this only
+            // bounds the damage while a gap goes unnoticed. Playwright
+            // fulfils routed requests without touching the resolver, and
+            // it drives the browser over a pipe, so neither is affected.
+            "--host-resolver-rules=MAP * ~NOTFOUND",
+        ],
+    });
+
+    const cleanup = async () => {
+        await ctx.close().catch(() => {});
+        fs.rmSync(userDir, { recursive: true, force: true });
+    };
+
+    try {
+        const errors = new ErrorCollector();
+        attachErrorListeners(ctx, errors);
+        routeOpts.report = (text) => errors.record("network", text);
+        const stubs = await installNetworkStubs(ctx, routeOpts);
+
+        await assertWorkerTrafficIntercepted(stubs);
+
+        // The extension id is derived from the unpacked path, so it
+        // changes and must never be hardcoded. It is the host part of the
+        // service worker URL.
+        const sw = await serviceWorker(ctx);
+        const id = new URL(sw.url()).host;
+
+        return {
+            ctx,
+            errors,
+            extensionId: id,
+            popupUrl: "chrome-extension://" + id + "/src/popup/index.html",
+            close: cleanup,
+        };
+    } catch (e) {
+        // Anything that fails after the browser is up has to tear it down
+        // on the way out: an orphaned context keeps node alive forever,
+        // turning a clean failure into a hung run.
+        await cleanup();
+        throw e;
+    }
+}
+
+// ---------------------------------------------------------------- flows
+
+const PASSWORD = "e2e-harness-password";
+
+async function visible(page, selector, timeout = 15000) {
+    await page.waitForSelector(selector, { state: "visible", timeout });
+}
+
+// An empty WebAssembly module: magic number and version header, no
+// sections. Compiling it in the popup asks the one question that decides
+// libsodium's backend — may this realm compile WebAssembly — of the real
+// page under the real shipped manifest, which is the only place the
+// answer can be observed. Kept independent of src/shared/vault.js on
+// purpose: a bundle asked to grade itself proves less than an outside
+// observation of the same realm.
+const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
+
+async function pageCompilesWasm(page) {
+    return page.evaluate(async (bytes) => {
+        try {
+            await WebAssembly.compile(new Uint8Array(bytes));
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }, EMPTY_WASM_MODULE);
+}
+
+async function openPopup(ctx, popupUrl) {
+    const page = await ctx.newPage();
+    await page.goto(popupUrl);
+    return page;
+}
+
+// Full wallet creation through the real UI: BIP-39 generation, libsodium
+// vault encryption and extension storage persistence, for real.
+async function createWallet(page) {
+    await page.click("#btn-welcome-add");
+    await visible(page, "#view-add-wallet");
+    await page.click("#btn-generate-phrase");
+    await page.waitForFunction(() => {
+        const el = document.getElementById("wallet-mnemonic");
+        return el && el.value.trim().split(/\s+/).length >= 12;
+    });
+    await page.fill("#add-wallet-password", PASSWORD);
+    await page.fill("#add-wallet-password-confirm", PASSWORD);
+    await page.click("#btn-add-wallet-confirm");
+    await visible(page, "#view-main", 60000);
+}
+
+// Reach the address detail screen from wherever the popup restored to.
+// Clicking .address-row does not open it; the [info] button does.
+async function openAddressDetail(page) {
+    const onAddress = await page.isVisible("#view-address");
+    if (!onAddress) {
+        await visible(page, "#view-main");
+        await page.click("#wallet-list .btn-addr-info");
+    }
+    await visible(page, "#view-address");
+}
+
+module.exports = {
+    createWallet,
+    launch,
+    openAddressDetail,
+    openPopup,
+    pageCompilesWasm,
+    visible,
+};
--- a/tests/e2e/network.js
+++ b/tests/e2e/network.js
@@ -0,0 +1,334 @@
+// Browser-level network interception for the end-to-end suite.
+//
+// Every http(s) request the extension makes — from the popup page AND
+// from the MV3 background service worker — is fulfilled from these
+// fixtures, so the suite is deterministic and runs entirely offline. The
+// probe that motivated this harness (see issue #181) observed live calls
+// to Blockscout returning 401 inside the container, which would make any
+// assertion about rendered transaction data worthless.
+//
+// Service-worker coverage is not free: ctx.route() only sees worker
+// traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
+// the environment, which script/test-e2e does. Without it the phishing
+// blocklist fetch that src/background/index.js issues at worker startup
+// silently reaches raw.githubusercontent.com on the open internet, and
+// src/shared/phishingDomains.js swallows the failure so nothing surfaces
+// it. That is not left to trust: waitForServiceWorkerTraffic() below
+// backs the launch-time canary in harness.js, which fails the entire
+// suite if worker requests stop being visible here.
+//
+// Anything not explicitly stubbed here is aborted AND reported to the
+// error collector, so a newly added outbound call shows up as a test
+// failure rather than as intermittent flakiness.
+
+"use strict";
+
+// Fictional ERC-20 used to seed the transaction-detail test. The symbol
+// must not collide with any entry in src/shared/tokenList.js, or
+// isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
+// symbol-spoofing attempt; holders_count must be >= 1000 or the default
+// hideLowHolderTokens filter drops it. Either would make the test pass
+// vacuously by never rendering a row at all.
+const STUB_TOKEN = {
+    address: "0xe2e0000000000000000000000000000000000e2e",
+    symbol: "E2E",
+    name: "End To End Test Token",
+    decimals: "6",
+    holders: "12345",
+};
+
+const STUB_COUNTERPARTY = "0xc0ffee0000000000000000000000000000c0ffee";
+
+const STUB_TX_HASH =
+    "0xe2e0000000000000000000000000000000000000000000000000000000000e2e";
+
+const STUB_BLOCK_NUMBER = 21000000;
+
+// Fixed instant so timeAgo() output is stable across runs.
+const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
+
+// A 32-byte zero word. Returned for every eth_call, which is what makes
+// ethers' ENS reverse lookup resolve to "no resolver set" and return null
+// instead of throwing. A throw would be logged by src/shared/ens.js via
+// log.errorf(), i.e. console.error, which fails the run on its own.
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+const RPC_RESULTS = {
+    eth_chainId: "0x1",
+    net_version: "1",
+    eth_blockNumber: "0x1406f40",
+    eth_getBalance: "0x0",
+    eth_call: ZERO_WORD,
+    eth_gasPrice: "0x3b9aca00",
+    eth_estimateGas: "0x5208",
+    eth_getTransactionCount: "0x0",
+    eth_maxPriorityFeePerGas: "0x3b9aca00",
+};
+
+function tokenObject() {
+    return {
+        address_hash: STUB_TOKEN.address,
+        address: STUB_TOKEN.address,
+        symbol: STUB_TOKEN.symbol,
+        name: STUB_TOKEN.name,
+        decimals: STUB_TOKEN.decimals,
+        holders_count: STUB_TOKEN.holders,
+        type: "ERC-20",
+    };
+}
+
+// One received ERC-20 transfer of 1.5 E2E to the address under test.
+function tokenTransferItems(address) {
+    return [
+        {
+            transaction_hash: STUB_TX_HASH,
+            block_number: STUB_BLOCK_NUMBER,
+            timestamp: STUB_TX_TIMESTAMP,
+            from: { hash: STUB_COUNTERPARTY },
+            to: { hash: address },
+            total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
+            token: tokenObject(),
+        },
+    ];
+}
+
+// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
+// decoder short-circuits; the on-chain detail fields still populate.
+function transactionDetails() {
+    return {
+        hash: STUB_TX_HASH,
+        block_number: STUB_BLOCK_NUMBER,
+        nonce: 7,
+        gas_used: "51000",
+        gas_price: "1000000000",
+        fee: { value: "51000000000000" },
+        raw_input: "0x",
+        status: "ok",
+    };
+}
+
+function jsonResponse(route, body) {
+    return route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(body),
+    });
+}
+
+// Extract the address from a Blockscout /addresses/<addr>/... path.
+function blockscoutAddress(pathname) {
+    const m = pathname.match(/\/addresses\/(0x[0-9a-fA-F]{40})\//);
+    return m ? m[1] : null;
+}
+
+function handleRpc(route, postData, report) {
+    let payload;
+    try {
+        payload = JSON.parse(postData || "null");
+    } catch {
+        report("unstubbed RPC: unparseable body " + String(postData));
+        return route.abort();
+    }
+    // ethers batches by default, so the body may be an array.
+    const batch = Array.isArray(payload) ? payload : [payload];
+
+    // Anything that is not a JSON-RPC object, or a batch of them, is not
+    // RPC at all and must be reported like any other unrecognised
+    // outbound traffic rather than dereferenced. request.postData()
+    // returns null both for a bodyless POST and for a body Playwright
+    // cannot decode as UTF-8 (sendBeacon with a Blob, or any binary
+    // payload), so this is not an empty-string special case: it rejects
+    // every non-object payload, exactly as the catch above rejects every
+    // unparseable one.
+    if (
+        payload === null ||
+        typeof payload !== "object" ||
+        !batch.every((req) => req !== null && typeof req === "object")
+    ) {
+        report("unstubbed request: POST " + route.request().url());
+        return route.abort();
+    }
+    const replies = batch.map((req) => {
+        const result = RPC_RESULTS[req.method];
+        if (result === undefined) {
+            report("unstubbed RPC method: " + req.method);
+            return {
+                jsonrpc: "2.0",
+                id: req.id,
+                error: { code: -32601, message: "unstubbed in e2e harness" },
+            };
+        }
+        return { jsonrpc: "2.0", id: req.id, result };
+    });
+    return jsonResponse(route, Array.isArray(payload) ? replies : replies[0]);
+}
+
+const TRACE_TRUE = ["1", "true", "yes", "on"];
+const TRACE_FALSE = ["", "0", "false", "no", "off"];
+
+// Whether E2E_TRACE_NETWORK asks for the request trace.
+//
+// A set-but-unrecognised value is a hard error rather than a quiet
+// "off": E2E_TRACE_NETWORK=true asking for a trace and getting silence
+// is the operator being lied to about what the harness is doing, which
+// is the whole failure mode this suite exists to eliminate. Refusing to
+// guess costs one line and one obvious error message.
+function traceEnabled(raw) {
+    if (raw === undefined || raw === null) return false;
+    const v = String(raw).trim().toLowerCase();
+    if (TRACE_TRUE.includes(v)) return true;
+    if (TRACE_FALSE.includes(v)) return false;
+    throw new Error(
+        "E2E_TRACE_NETWORK is set to " +
+            JSON.stringify(String(raw)) +
+            ", which is not a recognised on/off value. Use one of " +
+            TRACE_TRUE.join(", ") +
+            " to enable the request trace, or one of " +
+            TRACE_FALSE.slice(1).join(", ") +
+            " to disable it. Refusing to guess: a diagnostic that silently " +
+            "does nothing is worse than one that is not there",
+    );
+}
+
+/**
+ * Route every http(s) request through local fixtures.
+ *
+ * @param {import("playwright-core").BrowserContext} ctx
+ * @param {object} opts
+ * @param {(text: string) => void} opts.report  called for unstubbed traffic
+ * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
+ *   transfer. Read at request time, so a test can flip it on the same
+ *   options object without re-registering the route.
+ * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
+ *   Promise<string|null>}>}
+ */
+async function installNetworkStubs(ctx, opts) {
+    const report = opts.report;
+
+    // First request seen that originated in a service worker, and the
+    // resolver waiting for it. This is what proves worker interception is
+    // actually in force; see waitForServiceWorkerTraffic below.
+    let firstWorkerRequest = null;
+    let announceWorkerRequest = null;
+
+    // E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
+    // tagged [sw] when it originated in the background service worker.
+    // It exists so the isolation claim above can be re-checked by anyone
+    // in one command, without editing files: the phishing blocklist fetch
+    // showing up with an [sw] tag is the proof that the worker really is
+    // intercepted and that the raw.githubusercontent.com stub below is
+    // live code rather than decoration.
+    const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
+
+    // Regex rather than a glob so chrome-extension:// resource loads are
+    // never touched — routing those would break the popup itself.
+    await ctx.route(/^https?:\/\//, async (route) => {
+        const req = route.request();
+        const url = new URL(req.url());
+        const p = url.pathname;
+        const fromWorker = !!req.serviceWorker();
+
+        if (fromWorker && !firstWorkerRequest) {
+            firstWorkerRequest = req.method() + " " + req.url();
+            if (announceWorkerRequest)
+                announceWorkerRequest(firstWorkerRequest);
+        }
+
+        if (trace) {
+            const origin = fromWorker ? "[sw] " : "[page] ";
+            console.log("# routed " + origin + req.method() + " " + req.url());
+        }
+
+        // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
+        if (req.method() === "POST") {
+            return handleRpc(route, req.postData(), report);
+        }
+
+        // Blockscout v2
+        if (p.includes("/api/v2/")) {
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
+                return jsonResponse(route, { items: [] });
+            }
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
+                const addr = blockscoutAddress(p);
+                return jsonResponse(route, {
+                    items:
+                        opts.seedTokenTransfer && addr
+                            ? tokenTransferItems(addr)
+                            : [],
+                });
+            }
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
+                return jsonResponse(route, []);
+            }
+            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
+                return jsonResponse(route, transactionDetails());
+            }
+        }
+
+        // CoinDesk price tick
+        if (url.hostname.endsWith("coindesk.com")) {
+            return jsonResponse(route, { Data: {} });
+        }
+
+        // MetaMask phishing blocklist
+        if (
+            url.hostname === "raw.githubusercontent.com" ||
+            p.endsWith("/eth-phishing-detect/main/src/config.json")
+        ) {
+            return jsonResponse(route, {
+                version: 2,
+                tolerance: 2,
+                fuzzylist: [],
+                whitelist: [],
+                blacklist: [],
+            });
+        }
+
+        // Best-effort Etherscan address labels: served as an empty page.
+        if (url.hostname.endsWith("etherscan.io")) {
+            return route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: "<html><body></body></html>",
+            });
+        }
+
+        report("unstubbed request: " + req.method() + " " + req.url());
+        return route.abort();
+    });
+
+    return {
+        /**
+         * Resolve with the first service-worker-originated request this
+         * handler saw, or null if none arrives within `ms`.
+         *
+         * The background worker fetches the phishing blocklist at
+         * startup, unconditionally, within about a second of the context
+         * coming up — so under working interception this resolves almost
+         * immediately. Nothing arriving means worker traffic is bypassing
+         * the handler entirely and going to the real internet, which the
+         * caller turns into a hard failure of the whole suite.
+         */
+        waitForServiceWorkerTraffic(ms) {
+            if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    announceWorkerRequest = null;
+                    resolve(null);
+                }, ms);
+                announceWorkerRequest = (req) => {
+                    clearTimeout(timer);
+                    announceWorkerRequest = null;
+                    resolve(req);
+                };
+            });
+        },
+    };
+}
+
+module.exports = {
+    installNetworkStubs,
+    STUB_TOKEN,
+    STUB_TX_HASH,
+};
--- a/tests/e2e/run.js
+++ b/tests/e2e/run.js
@@ -0,0 +1,286 @@
+// End-to-end suite entrypoint. Run via script/test-e2e (which builds
+// dist/chrome/ and starts the pinned container); running it directly
+// requires a Chromium that playwright-core can find.
+//
+// A plain runner rather than jest on purpose: jest's default testMatch
+// would pull these files into script/test, and browser tests do not fit
+// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
+// here is named *.test.js for the same reason.
+
+"use strict";
+
+const {
+    createWallet,
+    launch,
+    openAddressDetail,
+    openPopup,
+    pageCompilesWasm,
+    visible,
+} = require("./harness");
+const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
+
+const TEST_TIMEOUT_MS = 120000;
+
+// How long to keep collecting after the final test returns; see the
+// trailing drain in main().
+const TRAILING_WATCH_MS = 1500;
+
+const tests = [];
+
+function test(name, fn) {
+    tests.push({ name, fn });
+}
+
+function assert(cond, message) {
+    if (!cond) throw new Error(message);
+}
+
+function withTimeout(promise, name) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(
+            () =>
+                reject(new Error("timed out after " + TEST_TIMEOUT_MS + "ms")),
+            TEST_TIMEOUT_MS,
+        );
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+// ----------------------------------------------------------------- tests
+
+test("popup loads and reaches the welcome view", async (env) => {
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, "#view-welcome");
+    const title = await env.page.title();
+    assert(title === "AutistMask", "unexpected popup title: " + title);
+});
+
+// The empirical half of #182. The manifest change is only a claim about
+// what the CSP permits; this is the observation. Two things have to hold
+// together, and the run covers both: the popup realm compiles WASM (here),
+// and no WASM refusal or abort is recorded anywhere in the run — the
+// harness allowlist that used to excuse exactly that error is now empty,
+// so a recurrence fails whichever test it lands in rather than being
+// tolerated. Since libsodium's WASM module is embedded in the bundle and
+// needs no fetch, a realm that compiles WASM is a realm where libsodium
+// takes the WASM path, and the next test drives a real vault encryption
+// through it.
+test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
+    const ok = await pageCompilesWasm(env.page);
+    assert(
+        ok,
+        "the popup refused to compile WebAssembly. The shipped manifest CSP " +
+            "has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
+            "fallback and every password derivation costs roughly 20x what it " +
+            "should — see the backend note in src/shared/vault.js",
+    );
+});
+
+test("wallet creation through the UI reaches the main view", async (env) => {
+    await createWallet(env.page);
+    const addrCount = await env.page
+        .locator("#wallet-list .btn-addr-info")
+        .count();
+    assert(addrCount > 0, "no addresses rendered in the wallet list");
+});
+
+test("add token screen opens from address detail (#150)", async (env) => {
+    await openAddressDetail(env.page);
+    await env.page.click("#btn-add-token");
+    await visible(env.page, "#view-add-token");
+    const quickPicks = await env.page
+        .locator("#common-token-list .common-token")
+        .count();
+    assert(quickPicks > 0, "no common-token quick-pick buttons rendered");
+});
+
+test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
+    // Serve the stubbed token transfer from here on, then reload so the
+    // address detail screen refetches its transaction list.
+    env.routeOpts.seedTokenTransfer = true;
+    await env.page.reload();
+    await openAddressDetail(env.page);
+
+    await visible(env.page, "#tx-list .tx-row");
+    const rowText = await env.page
+        .locator("#tx-list .tx-row")
+        .first()
+        .innerText();
+    assert(
+        rowText.includes(STUB_TOKEN.symbol),
+        "token transfer row missing symbol " +
+            STUB_TOKEN.symbol +
+            ", got: " +
+            JSON.stringify(rowText),
+    );
+
+    await env.page.locator("#tx-list .tx-row").first().click();
+    await visible(env.page, "#view-transaction");
+
+    const hash = await env.page.locator("#tx-detail-hash").innerText();
+    assert(
+        hash.includes(STUB_TX_HASH),
+        "transaction detail shows the wrong hash: " + hash,
+    );
+
+    // The token contract row is the field that crashes when
+    // addressDotHtml is not imported: it renders only for transfers with
+    // a contractAddress, which is every ERC-20 transfer.
+    await visible(env.page, "#tx-detail-token-contract-section");
+    const contract = env.page.locator("#tx-detail-token-contract");
+    const contractText = await contract.innerText();
+    assert(
+        contractText.toLowerCase().includes(STUB_TOKEN.address),
+        "token contract row missing the contract address, got: " +
+            JSON.stringify(contractText),
+    );
+    const dots = await contract.locator('span[style*="border-radius"]').count();
+    assert(dots > 0, "token contract row rendered without its colour dot");
+});
+
+// ---------------------------------------------------------------- runner
+
+async function main() {
+    // A suite that runs nothing must never report success. If a refactor
+    // drops the registrations above, or a require() of this file stops
+    // reaching them, the only honest outcome is a red run — reporting
+    // "0/0 passed" and exiting 0 is the same vacuous-check failure this
+    // whole harness exists to prevent.
+    if (tests.length === 0) {
+        console.log("1..0");
+        console.log("# FAILED: the e2e suite registered no tests");
+        process.exitCode = 1;
+        return;
+    }
+
+    const routeOpts = { seedTokenTransfer: false };
+
+    let session;
+    try {
+        session = await launch(routeOpts);
+    } catch (e) {
+        // Never skip and report success: a browser we cannot start, or
+        // one whose network interception is not in force, is a failure of
+        // the suite, not an absent one.
+        console.error("e2e: cannot run the suite: " + e.message);
+        process.exitCode = 1;
+        return;
+    }
+
+    console.log("# extension id: " + session.extensionId);
+    console.log("1.." + tests.length);
+
+    const env = {
+        ctx: session.ctx,
+        popupUrl: session.popupUrl,
+        routeOpts,
+        page: null,
+    };
+
+    // Attribution of collected errors is total. session.errors has no
+    // window API at all: take() always drains everything outstanding, so
+    // successive takes partition the whole stream, and the phases below
+    // cover the entire life of the run. Nothing the collector holds can
+    // go unread.
+    //
+    //   launch .. end of test 1     -> test 1 (so the worker's startup
+    //                                  fetches land on a test, not
+    //                                  nowhere)
+    //   end of test k .. end of k+1 -> test k+1
+    //   last test .. teardown       -> the suite, via the trailing drain
+    //
+    // Those three phases cover the entire life of the browser context.
+    // There is no fourth: once the context is closed nothing can record,
+    // because the route handler and the console listeners died with it.
+    // Traffic that a test defers past the trailing drain is therefore
+    // never observed at all — a real limit of this design, stated in the
+    // README, and not one any post-teardown hook could close.
+    //
+    // Two green-but-vacuous runs on this harness were the same shape: a
+    // record falling outside somebody's window and being dropped. First
+    // the mark started after test 1, discarding launch-time records;
+    // then the tail after the last test was never read. Patching a
+    // second boundary would have invited a third, so the window concept
+    // is gone rather than fixed.
+    let failed = 0;
+    let n = 0;
+    for (const t of tests) {
+        n += 1;
+        let failure = null;
+        try {
+            await withTimeout(t.fn(env), t.name);
+        } catch (e) {
+            failure = e.message;
+        }
+
+        // Any uncaught page error, console.error or unstubbed request
+        // fails the test that provoked it, whether or not its assertions
+        // passed. This is the mechanism that caught #150.
+        const newErrors = session.errors.take();
+        if (!failure && newErrors.length > 0) {
+            failure = "uncaught browser errors during this test";
+        }
+
+        if (failure) {
+            failed += 1;
+            console.log("not ok " + n + " - " + t.name);
+            console.log("  " + failure);
+            for (const line of newErrors) {
+                console.log("  " + line);
+            }
+        } else {
+            console.log("ok " + n + " - " + t.name);
+        }
+    }
+
+    // Keep watching after the last test returns, before tearing the
+    // browser down. A request a test fires without awaiting is still in
+    // flight when its function resolves; measured here it reaches the
+    // route handler about 10ms later, but closing the context does not
+    // wait for it — with no window at all the request dies unobserved
+    // and the run goes green, which is exactly how escaping traffic
+    // stays invisible.
+    //
+    // A fixed bounded window rather than a quiescence poll on purpose:
+    // the collector being quiet is not evidence, because a request that
+    // has not been dispatched yet has recorded nothing to be quiet
+    // about. Playwright offers no "is anything in flight" question to
+    // ask either — the route handler is the only observation point — so
+    // a grace period is the mechanism available, and this one is ~150x
+    // the measured latency for 1.5s on a ~25s suite.
+    await new Promise((resolve) => setTimeout(resolve, TRAILING_WATCH_MS));
+
+    await session.close();
+
+    // The tail. These cannot be blamed on any single test, so they are
+    // reported against the suite rather than guessed at — but they are
+    // reported, and they fail the run.
+    const trailing = session.errors.take();
+
+    console.log(
+        "# " + (tests.length - failed) + "/" + tests.length + " tests passed",
+    );
+
+    if (trailing.length > 0) {
+        console.log(
+            "# " +
+                trailing.length +
+                " browser error(s) recorded after the last test finished, " +
+                "not attributable to any single test:",
+        );
+        for (const line of trailing) {
+            console.log("#   " + line);
+        }
+    }
+
+    if (failed > 0 || trailing.length > 0) {
+        console.log("# FAILED");
+        process.exitCode = 1;
+    }
+}
+
+main().catch((e) => {
+    console.error("e2e: " + (e && e.stack ? e.stack : e));
+    process.exitCode = 1;
+});
--- a/tests/manifest.test.js
+++ b/tests/manifest.test.js
@@ -0,0 +1,100 @@
+// The shipped Content Security Policy, pinned in both directions.
+//
+// This is the anti-regression check for #182. libsodium decides its
+// backend by trying to compile WebAssembly and catching the failure, so a
+// CSP that refuses WASM demotes the vault to the wasm2js translation —
+// roughly 20x slower per Argon2id derivation — and says so only in a
+// console message nobody reads. Dropping 'wasm-unsafe-eval' from either
+// manifest therefore has to fail a check, not a log line.
+//
+// It is equally a check against loosening. 'wasm-unsafe-eval' is granted
+// deliberately and narrowly (see the backend note in src/shared/vault.js);
+// 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
+// an exact match on the token set is what keeps the next edit from
+// smuggling one in alongside.
+//
+// build.js copies these files to dist/<target>/manifest.json verbatim, so
+// what is asserted here is what ships.
+
+const fs = require("fs");
+const path = require("path");
+
+const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
+
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
+
+const FORBIDDEN_SOURCES = [
+    "'unsafe-eval'",
+    "'unsafe-inline'",
+    "http:",
+    "https:",
+    "data:",
+    "blob:",
+    "*",
+];
+
+function readManifest(name) {
+    return JSON.parse(
+        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
+    );
+}
+
+// "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
+function parseCsp(policy) {
+    const directives = {};
+    for (const part of policy.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length === 0) continue;
+        directives[tokens[0]] = tokens.slice(1);
+    }
+    return directives;
+}
+
+function assertPolicy(policy) {
+    const directives = parseCsp(policy);
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
+    );
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
+    }
+}
+
+describe("shipped Content Security Policy", () => {
+    // MV3 takes an object and applies extension_pages to the popup and the
+    // background service worker, which is where libsodium runs.
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("chrome").content_security_policy;
+        expect(typeof csp).toBe("object");
+        expect(Object.keys(csp)).toEqual(["extension_pages"]);
+        assertPolicy(csp.extension_pages);
+    });
+
+    // MV2 takes the policy as a bare string, and Firefox 102 and later
+    // require 'wasm-unsafe-eval' for extension pages exactly as Chrome
+    // does. Same policy, different manifest shape.
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("firefox").content_security_policy;
+        expect(typeof csp).toBe("string");
+        assertPolicy(csp);
+    });
+
+    // The two targets share one codebase and one crypto path; a policy
+    // that drifts apart between them means one of the two builds is
+    // running a backend nothing tests.
+    test("both targets ship the same policy", () => {
+        const chrome =
+            readManifest("chrome").content_security_policy.extension_pages;
+        const firefox = readManifest("firefox").content_security_policy;
+        expect(firefox).toBe(chrome);
+    });
+});
--- a/tests/transactions.test.js
+++ b/tests/transactions.test.js
--- a/tests/vaultBackend.test.js
+++ b/tests/vaultBackend.test.js
@@ -0,0 +1,52 @@
+// The unit tests must exercise the libsodium backend that actually ships
+// (#182). Before this, they could not: node compiles WebAssembly happily,
+// the extension CSP refused it, and so the browser silently ran the
+// wasm2js translation while every test ran the WASM build.
+//
+// With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
+// hold that agreement in place from the node side. tests/manifest.test.js
+// holds up the CSP end of it, and the end-to-end suite observes the real
+// popup.
+
+const { cryptoBackend } = require("../src/shared/vault");
+
+// The module libsodium-wrappers-sumo itself requires and drives. Not a new
+// dependency: it is inspected here, never used to perform crypto, because
+// it is the only thing that can say which backend is loaded.
+const SODIUM_CORE = "libsodium-sumo";
+
+describe("libsodium backend", () => {
+    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
+        await expect(cryptoBackend()).resolves.toBe("wasm");
+    });
+
+    test("libsodium did not swap in the wasm2js fallback", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        // useBackupModule is the entry point to the fallback; taking it
+        // replaces the module's exports with the translation's, and the
+        // entry point goes with them. Still present after ready means the
+        // WASM module is the one in place. The test below is what keeps
+        // that inference honest.
+        expect(typeof core.useBackupModule).toBe("function");
+    });
+
+    // Deliberately last, and deliberately destructive: it takes the
+    // fallback, which replaces the loaded module for the rest of this
+    // file. Jest gives each test file its own module registry, so nothing
+    // outside sees it.
+    //
+    // Without this, the check above would be a claim about libsodium's
+    // internals with nothing holding it to account: if a future version
+    // kept useBackupModule on the fallback module too, the marker would
+    // quietly become true in both backends and the test would pass while
+    // measuring nothing. Forcing the fallback and watching the marker
+    // disappear is what makes its presence mean something.
+    test("the fallback marker distinguishes the two backends", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        expect(typeof core.useBackupModule).toBe("function");
+        await core.useBackupModule();
+        expect(typeof core.useBackupModule).toBe("undefined");
+    });
+});
--- a/tests/walletDelete.test.js
+++ b/tests/walletDelete.test.js
@@ -0,0 +1,129 @@
+const {
+    removeWalletFromState,
+    broadcastActiveChanged,
+} = require("../src/shared/walletDelete");
+
+// Fixed addresses — never used for anything but these tests.
+const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
+const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+
+function wallet(name, addresses) {
+    return {
+        name,
+        addresses: addresses.map((address) => ({ address })),
+    };
+}
+
+// A three-wallet state; wallet A is an HD wallet with two addresses.
+function makeState(overrides = {}) {
+    return {
+        hasWallet: true,
+        wallets: [wallet("A", [A0, A1]), wallet("B", [B0]), wallet("C", [C0])],
+        selectedWallet: 0,
+        selectedAddress: 0,
+        activeAddress: A0,
+        allowedSites: {
+            [A0]: ["a.example"],
+            [A1]: ["b.example"],
+            [B0]: ["c.example"],
+        },
+        deniedSites: { [A1]: ["d.example"], [C0]: ["e.example"] },
+        ...overrides,
+    };
+}
+
+describe("removeWalletFromState", () => {
+    test("deleting the last wallet clears hasWallet", () => {
+        const state = makeState({
+            wallets: [wallet("A", [A0])],
+            allowedSites: { [A0]: ["a.example"] },
+            deniedSites: {},
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 0);
+
+        expect(state.hasWallet).toBe(false);
+        expect(state.wallets).toEqual([]);
+        expect(state.selectedWallet).toBeNull();
+        expect(state.selectedAddress).toBeNull();
+        expect(state.activeAddress).toBeNull();
+        expect(activeAddressChanged).toBe(true);
+    });
+
+    test("deleting a non-selected wallet leaves the selection intact", () => {
+        const state = makeState({
+            selectedWallet: 2,
+            selectedAddress: 0,
+            activeAddress: C0,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 1);
+
+        // Wallet C moved from index 2 to index 1 by the splice.
+        expect(state.wallets.map((w) => w.name)).toEqual(["A", "C"]);
+        expect(state.selectedWallet).toBe(1);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(C0);
+        expect(activeAddressChanged).toBe(false);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    test("deleting a wallet after the selection does not shift it", () => {
+        const state = makeState({
+            selectedWallet: 1,
+            selectedAddress: 0,
+            activeAddress: B0,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 2);
+
+        expect(state.selectedWallet).toBe(1);
+        expect(state.activeAddress).toBe(B0);
+        expect(activeAddressChanged).toBe(false);
+    });
+
+    test("deleting the active wallet falls back to the first remaining address", () => {
+        const state = makeState({
+            selectedWallet: 0,
+            selectedAddress: 1,
+            activeAddress: A1,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 0);
+
+        expect(state.wallets.map((w) => w.name)).toEqual(["B", "C"]);
+        expect(state.selectedWallet).toBe(0);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(B0);
+        expect(activeAddressChanged).toBe(true);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    test("site permissions are dropped for every address of the wallet", () => {
+        const state = makeState();
+
+        removeWalletFromState(state, 0);
+
+        expect(state.allowedSites).toEqual({ [B0]: ["c.example"] });
+        expect(state.deniedSites).toEqual({ [C0]: ["e.example"] });
+    });
+});
+
+describe("broadcastActiveChanged", () => {
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("sends AUTISTMASK_ACTIVE_CHANGED to the background", () => {
+        const sendMessage = jest.fn();
+        global.chrome = { runtime: { sendMessage } };
+
+        broadcastActiveChanged();
+
+        expect(sendMessage).toHaveBeenCalledWith({
+            type: "AUTISTMASK_ACTIVE_CHANGED",
+        });
+    });
+});
--- a/yarn.lock
+++ b/yarn.lock
@@ -2547,6 +2547,11 @@ pkg-dir@^4.2.0:
  dependencies:
    find-up "^4.0.0"

+playwright-core@1.56.0:
+  version "1.56.0"
+  resolved "https://registry.yarnpkg.com/playwright-core/-/playwright-core-1.56.0.tgz#14b40ea436551b0bcefe19c5bfb8d1804c83739c"
+  integrity sha512-1SXl7pMfemAMSDn5rkPeZljxOCYAmQnYLBTExuh6E8USHXGSX3dx6lYZN/xPpTz1vimXmPA9CDnILvmJaB8aSQ==
+
 pngjs@^5.0.0:
  version "5.0.0"
  resolved "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz"
Author	SHA1	Message	Date
sneak	45c5f31971	fix: run libsodium on WebAssembly under the extension CSP (closes #182 ) Some checks failed check / check (push) Has been cancelled Details libsodium ships a WASM build and a wasm2js translation in one file, tries WASM first, and silently falls back if instantiation throws. Under a plain script-src 'self' the fallback was taken on every popup load, announced by nothing but an uncaught CompileError. Measured on the vault's own Argon2id parameters (OPSLIMIT_INTERACTIVE, MEMLIMIT_INTERACTIVE), node 22: WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is identical either way — it is set by the ops and memory parameters, not by wall time — so the fallback bought no security and cost about 3.5s on every operation that asks for the password, which is every signature. Both manifests now declare script-src 'self' 'wasm-unsafe-eval'; object-src 'self' for extension pages: an object under content_security_policy.extension_pages for Chrome MV3, a bare string for Firefox MV2. The keyword permits compiling WebAssembly and nothing else — not eval() of strings, not inline script, not remote script — and reaching it requires already executing script in an extension page. 'unsafe-eval' is not granted. The silence is what made this dangerous, so the fallback is now loud at three levels: tests/manifest.test.js pins both policies to exactly that token set, failing make check if the grant is dropped or if anything is added beside it; tests/vaultBackend.test.js asserts the unit tests exercise the WASM backend, with a self-validating check that libsodium never swapped its fallback in; and the e2e suite compiles a WebAssembly module inside the real popup under the real manifest, with the harness allowlist entry that used to excuse the CompileError now deleted. The runtime fallback itself is kept — a wallet that refuses to decrypt is worse than a slow one — but vault.js now reports the backend and logs an error when it is not WASM.	2026-08-11 12:24:29 +00:00
clawbot	b882cede9f	fix: repair wallet state on delete (closes #156 ) Some checks failed check / check (push) Has been cancelled Details	2026-08-11 14:23:06 +02:00
clawbot	d93eda31a0	docs: rewrite TODO.md workflow for the branch-per-issue model on next (closes #191 ) All checks were successful check / check (push) Successful in 22s Details	2026-08-11 14:15:05 +02:00
clawbot	e9fa8bec47	build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170 ) All checks were successful check / check (push) Successful in 18s Details build.js records which emitted bundles contain src/shared/constants.js, and constants.js carries a marker constant-folded from DEBUG itself. script/verify-build cross-checks the two and fails on every way of not knowing, so deleting the __BUILD_DEBUG__ define now breaks the build instead of shipping a live debug branch.	2026-08-10 16:15:22 +02:00
clawbot	ad9162d057	security: decrypt and sign dApp approvals in the popup (closes #157 ) All checks were successful check / check (push) Successful in 24s Details The password no longer crosses the extension messaging boundary: the popup decrypts and signs, and sends only the raw signed transaction or the signature. The background re-derives the signer from the artifact and checks it against the approval it holds before broadcasting, so it is not a blind relay.	2026-08-10 15:59:30 +02:00
clawbot	188882d635	test: cover the address-poisoning filters in transactions.js (closes #160 ) Some checks failed check / check (push) Has been cancelled Details 47 tests over src/shared/transactions.js: both real address-poisoning attacks as fixtures, each of the four filters on and off, threshold boundaries, no false positives, and the per-address merge/dedup path. No source file changed.	2026-08-10 15:53:15 +02:00
clawbot	e8ad8325c8	test: containerized Chrome end-to-end harness that drives the real popup (closes #181 ) Some checks failed check / check (push) Has been cancelled Details Runs the real popup in a pinned containerized Chrome and fails on any uncaught page error or console.error. Also fixes the two defects it caught: the missing showView import in addToken.js and the missing addressDotHtml import in transactionDetail.js. closes #150 closes #151	2026-08-10 15:49:32 +02:00