test: containerized Firefox end-to-end harness (closes #184)

Drives the real popup in a real Firefox with dist/firefox/ installed as an
unpacked MV2 temporary add-on, via geckodriver. Covers popup load, wallet
creation through the UI, and the Add Token screen. Outside make check, like
the Chrome suite.

Zero npm dependencies: tests/e2e/firefox/driver.js is a WebDriver client
over global fetch and child_process against geckodriver's HTTP API. The
Dockerfile pins the node base image, the Firefox 153.0.3 tarball and
geckodriver 0.36.0 by digest.

Errors are read from the privileged nsIConsoleService in Marionette's chrome
context, filtered to non-warning entries whose sourceName is the extension
origin. BiDi log.entryAdded delivers nothing at all for extension pages, so
a Playwright-BiDi or Puppeteer-BiDi harness would see nothing and report
success; the code says so where someone would be tempted to simplify it.
Errors logged during add-on install and background startup are drained and
folded into step 1, never discarded: a throw at the top of
src/background/index.js kills the background page and fails the run.
Content-script capture is left as unverified, because --network none leaves
no http:// page for a content script to be injected into.

Each drain reads the console and clears it in ONE chrome script. Splitting
the read from Services.console.reset() left a window between the two round
trips in which an error was logged into a buffer about to be discarded, and
destroyed unread rather than deferred to the next drain; a probe of 100
sequenced throws at 20ms spacing lost one. With the drain atomic the same
probe accounts for every throw that falls inside the observed window, on two
consecutive runs.

No driver layer is shared with the Chrome suite and the three UI steps are
written twice deliberately: the two backends have no common substrate, and
three steps do not pay for a shim.

Two limits are documented rather than papered over, with measurements rather
than absolutes. Error capture is poll-based, so an error is attributed to a
step and not to a moment within it; the drained window ends ~1.5s after the
last step returns (a 500ms settle, a 1000ms sleep and two drain round trips),
and that cut-off jitters run to run — three runs of throws at fixed offsets
reported everything up to +1.5s and one of the three also reported +1.6s.
Inside the window the atomic drain leaves no race, but nsIConsoleService
keeps a ring buffer of only 250 messages, so more than 250 console messages
between two drains evicts unread errors: 400 throws inside one step report
as exactly the newest 250, on three runs, while occupancy in a clean run
peaks at 4 of 250 at the install drain and 0 at every later drain. Nothing is
stubbed; the container runs with --network none instead, which proves no
request escaped, cannot report which were attempted, and runs only the
failure branches of network-dependent code.

.dockerignore

@@ -1,3 +1,6 @@
+# .git is deliberately NOT excluded: build.js shells out to `git rev-parse` for
+# build-info stamping and the Dockerfile runs `make build`, so excluding it
+# would make every built extension report commitHash "unknown".
 node_modules
 .DS_Store
 dist

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test lint fmt fmt-check check docker hooks build build-debug clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -11,11 +11,18 @@ setup:
 	@script/setup
 
 install:
-	@yarn install
+	@yarn install --frozen-lockfile
 
 test:
 	@script/test
 
+# Browser end-to-end suites. Both require docker; neither is part of check.
+test-e2e:
+	@script/test-e2e
+
+test-e2e-firefox:
+	@script/test-e2e-firefox
+
 lint:
 	@script/lint
 
@@ -37,6 +44,7 @@ hooks:
 build:
 	@echo "Building extension..."
 	@yarn run build 2>&1
+	@script/verify-build
 
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
 # the hardcoded test recovery phrase the output of wallet creation. Never
@@ -44,6 +52,12 @@ build:
 build-debug:
 	@echo "Building extension (DEBUG)..."
 	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
+	@AUTISTMASK_DEBUG=1 script/verify-build
+
+# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
+# the end of build and build-debug; separate target for re-running it alone.
+verify-build:
+	@script/verify-build
 
 clean:
 	@rm -rf dist/

TODO.md

@@ -1,34 +1,263 @@
 # Workflow
 
-- branch (from `main`)
+- `git pull` `next` and cut a branch from it — one branch per issue, named
-- do the work in Next Step
+  `issue-<N>-<slug>`. Never branch from `main`.
-- move Next Step to the top of Completed Steps
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
-- move the top item of Future Steps into Next Step
+  `TODO.md` update in that same commit.
-- commit (`TODO.md` changes in the same commit as the work)
+- Move Next Step to the top of Completed Steps; move the top item of Future
-- merge to `main` if the branch is not protected, otherwise open a PR
+  Steps into Next Step.
-- push
+- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
+  `main` may not.
+- Rebase onto current `next` immediately before pushing — other branches land on
+  `next` continuously — and re-run `make check` after resolving, because a clean
+  textual merge can still break the build.
+- Push the branch and open one PR per issue with base `next`. Never base `main`.
+- An independent reviewer who did not write the change gates the merge. On a
+  passed review the PR is squash-merged into `next`.
+- `next` is the branch for the next milestone. It is kept green and mergeable to
+  `main` at any moment, without notice.
+- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
+  from `main`.
 
 # Status
 
-pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. No
+pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
-other branch is in flight: the settings About well landed as #145 on 2026-07-26
+milestone is in flight on `next`; its `next` -> `main` PR is
-and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
+[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
-question is resolved. Full policy file set present. `make check` verified
+green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
-passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
+`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
-#149-#168.
+compiled off.
+
+The backlog lives on the
+[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
+authoritative; this file does not duplicate it. Full policy file set present.
+Real-browser end-to-end suites (`make test-e2e` for Chrome,
+`make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
+cannot see a runtime `ReferenceError` in a popup view.
 
 # Next Step
 
-Land #149: make `DEBUG` a build-time constant that defaults to off, injected as
+Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
-the `__BUILD_DEBUG__` esbuild define from `AUTISTMASK_DEBUG=1`, so a plain
+`script/lint`. `make check` is `prettier --check` only today and cannot catch
-`make build` stops handing every newly created wallet the publicly committed
+undefined identifiers, which is how
-test recovery phrase. Branch `fix/issue-149-debug-build-flag`; PR open, awaiting
+[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
-review.
+[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
 
 # Completed Steps
 
+- 2026-08-12: A containerized Firefox end-to-end harness
+  (`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
+  build installed as a temporary add-on. Zero npm dependencies — a WebDriver
+  client over `fetch` against geckodriver — with `node`, Firefox 153.0.3 and
+  geckodriver 0.36.0 all pinned by digest. Uncaught errors are read from the
+  privileged console service in Marionette's chrome context, because BiDi
+  `log.entryAdded` reports nothing at all for extension pages; each drain reads
+  and clears the console in one chrome round trip, so no error is destroyed
+  unread by the drain itself, and errors logged during add-on install and
+  background startup are folded into step 1 instead of being cleared. The two
+  measured limits are documented rather than claimed away: the console ring
+  buffer holds 250 messages (a clean run peaks at 4), and the drained window
+  ends ≈1.5s after the last step returns. Demonstrated discriminating by exiting
+  1 on a `throw` at the top of `src/background/index.js`, on a build with one
+  import removed, on a `setTimeout` throw whose UI assertions all pass, on an
+  unhandled `Promise.reject` and on an undefined identifier in `home.js`, and 0
+  on the branch as it stands
+  ([#184](https://git.eeqj.de/sneak/AutistMask/issues/184)).
+- 2026-08-12: The restored navigation stack is filtered against
+  `RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
+  render so that every surviving entry keeps the Back target it had. Back after
+  reopening can no longer land on a view the popup declined to restore, such as
+  `export-privkey` or `show-phrase`
+  ([#224](https://git.eeqj.de/sneak/AutistMask/issues/224)). Restorable views in
+  the stack are still unhidden without being re-rendered; that is tracked
+  separately in ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
+- 2026-08-12: One wording for a rejected password on every screen that asks for
+  one — the send confirmation and the delete-wallet confirmation no longer say
+  "Wrong password." (a fragment, which `RULES.md` Language & Labeling forbids)
+  and the two reveal screens no longer say "not correct", so all five
+  `decryptWithPassword` call sites now show the sentence the dApp approval paths
+  introduced. Strings only, no behaviour change, and each error container
+  measured at a 360px viewport in the pinned Playwright container
+  ([#172](https://git.eeqj.de/sneak/AutistMask/issues/172)).
+- 2026-08-12: Closed the empty-array hole in the end-to-end unstubbed-request
+  guard. `batch.every()` is vacuously true on `[]`, so a POST with body `[]` was
+  answered `200 []` instead of failing the suite; the guard now rejects an empty
+  batch, demonstrated green-before/red-after with a throwaway probe. The comment
+  claiming `postData()` returns `null` for undecodable bodies was corrected to
+  the two real paths — an absent or empty body decodes to `null`, a binary body
+  decodes lossily into invalid JSON
+  ([#187](https://git.eeqj.de/sneak/AutistMask/issues/187)).
+- 2026-08-12: The transaction confirmation screen has browser coverage. The
+  end-to-end suite reaches ConfirmTx for both the native ETH and the ERC-20 path
+  off a funded-balance fixture, and asserts the pending, funded, over-balance
+  and estimate-failed states, the fee block quoting the estimate and the reserve
+  separately, and a constant view height across every one of those transitions.
+  The load-bearing assertion is that the spend gate reads the reserve and not
+  the displayed estimate: swapping the two fails the suite
+  ([#238](https://git.eeqj.de/sneak/AutistMask/issues/238)).
+- 2026-08-12: The dust threshold field now explains a rejection instead of
+  snapping back in silence, with the parse in a pure, unit-tested module that
+  accepts plain decimal digits only — hex and exponent notation are refused
+  rather than read as 16 and 1000
+  ([#233](https://git.eeqj.de/sneak/AutistMask/issues/233)).
+- 2026-08-12: Approval verification became an allowlist — transaction type
+  restricted to 0/1/2 so an EIP-7702 delegation can no longer ride along on an
+  approved transfer, every consequential field compared, the artifact
+  re-serialized from the checked fields alone and its exact bytes required to be
+  the canonical encoding of what was broadcast. One approval now yields at most
+  one broadcast, and every path that retires a pending approval — popup close,
+  active-address change, a late reject — goes through a single chokepoint that
+  refuses to settle an attempt already claimed for signing and broadcast
+  ([#174](https://git.eeqj.de/sneak/AutistMask/issues/174)).
+- 2026-08-12: An address can be removed from an HD or xprv wallet behind a
+  confirmation screen that states nothing is destroyed, sharing the deletion
+  state transitions with wallet deletion so the selection, site permissions and
+  active-address broadcast follow the same rules
+  ([#162](https://git.eeqj.de/sneak/AutistMask/issues/162)).
+- 2026-08-12: The known-symbol spoof rule moved into `src/shared/symbolSpoof.js`
+  and is now the only copy. The balance list had exempted symbols the token list
+  maps to `null` — `"ETH"` alone — so a fake ETH ERC-20 was hidden from the
+  transaction history and the Send selector but listed as a holding named ETH. A
+  symbol with no legitimate contract may now be borne by no contract on any of
+  the three surfaces, and the native exemption is "has no contract address", so
+  a second null-mapped symbol needs no call-site change. The user's real ETH
+  balance is read over RPC and never passes through the rule
+  ([#235](https://git.eeqj.de/sneak/AutistMask/issues/235)).
+- 2026-08-12: `script/verify-build`'s failure modes are now a committed target,
+  `script/test-verify-build`, run by `make check`. It asserts the exit status
+  and the message of every case against a fixture tree in a temp dir, and drops
+  privileges (proving the runner against a mode-000 file first) for the cases
+  that only mean something when file permissions are in force
+  ([#227](https://git.eeqj.de/sneak/AutistMask/issues/227)).
+- 2026-08-12: WaitTx lifecycle: a receipt and the 60-second timeout can no
+  longer both render on one tick, no timer or in-flight lookup outlives its
+  wait, a failed receipt lookup no longer counts as a timeout (but six in a row
+  end the wait, reported as an unreachable network rather than as a timeout),
+  and the wait now resumes after a popup close
+  ([#155](https://git.eeqj.de/sneak/AutistMask/issues/155)).
+- 2026-08-12: The private key export screen now wipes the key from the page
+  whenever it is left by any route, and a decrypt still in flight when the
+  screen is left is discarded instead of written; the same `onViewLeave()`
+  cleanup was extended to every other screen holding secret material in the DOM
+  (AddWallet, ConfirmTx, DeleteWallet, ApproveTx, ApproveSign)
+  ([#221](https://git.eeqj.de/sneak/AutistMask/issues/221)).
+- 2026-08-12: An xprv wallet already in storage that was imported from a
+  non-master key is detected from the depth of its stored `xpub`, explained in
+  the wallet list, and blocked from signing, sending and private-key export
+  instead of throwing on the send screen
+  ([#234](https://git.eeqj.de/sneak/AutistMask/issues/234)).
+- 2026-08-12: An unreported `holders_count` is now parsed as `null` rather than
+  `0`, so the low-holder rule declines to judge an unknown count instead of
+  hiding a legitimate token as spam, in both the transaction history and the
+  Send token selector ([#230](https://git.eeqj.de/sneak/AutistMask/issues/230)).
+- 2026-08-12: Bundled token list documentation no longer states a count. The
+  four "top 250" claims in `README.md` and the "roughly 500" claim in
+  `docs/README.md` are replaced with a description of how the list is actually
+  selected — a point-in-time CoinGecko snapshot of the highest-market-cap
+  Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
+  the authoritative set
+  ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
+- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
+  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
+  fallback at 20x the Argon2id cost, pinned in both directions by
+  `tests/manifest.test.js` and observed in the real popup by the e2e suite
+  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
+- 2026-08-11: Known-symbol spoof verification became a Settings toggle
+  (`hideSpoofedSymbols`), on by default, governing the transaction-history
+  filter and the fraud-contract learning it feeds
+  ([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)).
+- 2026-08-11: `script/verify-build` now walks `dist/` NUL-delimited and asserts
+  `dist/` is a real directory, so a path with a trailing space or a newline can
+  no longer carry a debug marker past the unlisted-bundle check
+  ([#223](https://git.eeqj.de/sneak/AutistMask/issues/223)).
+- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
+  into Display, next to the theme selector
+  ([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
+- 2026-08-11: Network fee counted in the confirmation-screen balance check for
+  both ETH and ERC-20 sends, reserving what the node actually charges a type-2
+  transaction, with the arithmetic in a pure, unit-tested
+  `src/shared/txValidation.js`
+  ([#154](https://git.eeqj.de/sneak/AutistMask/issues/154)).
+- 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of
+  falling back to the 100,000 gwei default, and every address comparison in
+  `src/shared/transactions.js` goes through one case-normalising helper so a
+  checksummed genuine contract is no longer read as a spoof
+  ([#179](https://git.eeqj.de/sneak/AutistMask/issues/179)).
+- 2026-08-11: Password-gated recovery phrase display for HD wallets, reached
+  from the wallet row in Settings, wiped on leaving the screen and excluded from
+  the views the popup can reopen onto
+  ([#161](https://git.eeqj.de/sneak/AutistMask/issues/161)).
+- 2026-08-11: Extended-key import hardened — the base58 checksum is now enforced
+  on every xprv and xpub, and a non-master key is refused with an explanation
+  instead of being derived beneath
+  ([#210](https://git.eeqj.de/sneak/AutistMask/issues/210)).
+- 2026-08-11: the balance refresh and the 24-hour phishing list refresh moved
+  from `setInterval` to the extension alarms API, with the phishing delta and
+  its fetch timestamps persisted to extension storage, so neither job dies with
+  the MV3 service worker. Each job's freshness guard was decoupled from its
+  alarm period at the same time — timed to the period, a guard vetoes its own
+  scheduled tick and halves the real refresh rate
+  ([#158](https://git.eeqj.de/sneak/AutistMask/issues/158)).
+- 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
+  Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
+  the Makefile-only targets documented in the README
+  ([#166](https://git.eeqj.de/sneak/AutistMask/issues/166)).
+- 2026-08-11: `script/verify-build` diagnostics corrected: the both-markers
+  message now states what is and is not proven, an unreadable bundle is
+  diagnosed as an I/O fault rather than as changed output, the `*.js` assumption
+  lives only in `build.js`, and the unlisted-bundle scan hard-fails when it
+  cannot enumerate `dist/`
+  ([#180](https://git.eeqj.de/sneak/AutistMask/issues/180)).
+- 2026-08-11: Known-answer test coverage for the crypto core — BIP-39/BIP-32
+  derivation in `wallet.js` and the Argon2id vault in `vault.js`
+  ([#159](https://git.eeqj.de/sneak/AutistMask/issues/159)).
+- 2026-08-11: Three `README.md` claims corrected against the code — blocklist
+  attribution, token-display rule, navigation model
+  ([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
+- 2026-08-11: README Screen Map rebuilt from the code — every screen, element
+  and transition re-verified against `src/popup/`
+  ([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).
+- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
+  all five network destinations documented, password/Settings/Add Wallet
+  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
+- 2026-08-11: `loadState()` now derives `hasWallet` from the wallet list instead
+  of trusting the persisted flag, so a profile already saved inconsistent no
+  longer stays broken on every load
+  ([#195](https://git.eeqj.de/sneak/AutistMask/issues/195)).
+- 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
+  remaining wallets, the selection only moves when it was deleted, and the
+  active-address change is broadcast to connected sites
+  ([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
+- 2026-08-11: One row per on-chain value movement in transaction history: the
+  merge moved into the pure `mergeTransactions` and the zero-ETH native side of
+  a plain ERC-20 transfer absorbed into its token row
+  ([#177](https://git.eeqj.de/sneak/AutistMask/issues/177)).
+- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
+  on `next`, with Status and Next Step refreshed
+  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
+- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
+  as the `__BUILD_DEBUG__` esbuild define and turned on with
+  `AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
+  created wallet the publicly committed test recovery phrase
+  ([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
+- 2026-08-09: dApp approval signing moved into the popup — the password no
+  longer crosses the extension messaging boundary; the background broadcasts and
+  resolves approvals only, and verifies the signed artifact against the approval
+  it holds (#157).
+- 2026-08-09: Post-build assertion that every emitted bundle containing
+  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
+  `make build` path (#170).
+- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
+  `script/test-e2e`) driving the real popup with all network intercepted, plus
+  the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
+  and TransactionDetail broken for every ERC-20 transfer (#151). Harness
+  demonstrated failing before the fixes and passing after (#181). Interception
+  covers the MV3 background service worker, not just the popup page, and a
+  launch-time canary aborts the suite if worker traffic starts escaping.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
   (#149-#168).
+- 2026-08-09: Test coverage for the address-poisoning defense in
+  `src/shared/transactions.js` (#160)
 - 2026-07-26: About well in settings with build info, repo link and the version
   click easter egg (#145); proper view navigation stack (#146).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
@@ -52,32 +281,15 @@ review.
 
 # Future Steps
 
-- Fix the two `ReferenceError` crashes that make whole screens unreachable:
+Only work that has no issue of its own belongs here; everything else is on the
-  AddToken (#150) and TransactionDetail for every ERC-20 transfer (#151).
+tracker.
-- Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
+
-  and cannot catch undefined identifiers, which is how #150 and #151 shipped.
-- Make the Firefox target functional: Chrome callback APIs are used against the
-  promise-only `browser` namespace (#153).
-- Send and transaction-flow correctness: gas fee excluded from the
-  insufficient-balance check (#154), WaitTx 60s timeout overwriting a rendered
-  success screen (#155), last-wallet deletion leaving inconsistent state (#156).
-- Security: plaintext password crossing the extension messaging boundary during
-  dApp approvals (#157); MV3 service worker termination killing the background
-  refresh and the 24h phishing list update (#158).
-- Test the crypto core — `wallet.js` derivation and `vault.js` encryption (#159)
-  — and the address-poisoning defense in `transactions.js` (#160).
-- Wallet features for 1.0: show a wallet's recovery phrase behind the password
-  (#161), delete an address from an HD wallet (#162).
-- Docs: `docs/README.md` contradicts the code on external services and names
-  competitors (#163); README Screen Map omits three shipped screens (#164).
-- Owner decisions: Sepolia support versus "Non-Goals for 1.0", and `isMetaMask`
-  naming a competitor in shipped code (#165).
-- Repo policy compliance sweep: test rerun pattern, `yarn`/`npx`, frozen
-  lockfile, undocumented Makefile targets (#166).
-- Prune the 24 stale remote feature branches (#167).
-- Remove dead exports and de-duplicate copy-pasted view helpers (#168).
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag; #149 and #157 are parts of it, but the
+  input validation) before any 1.0rc tag. Individual filed issues are parts of
-  review is broader than either.
+  it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` and
+  `make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
+  suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.

build.js

@@ -3,14 +3,49 @@ const path = require("path");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
 
-const DIST_CHROME = path.join(__dirname, "dist", "chrome");
+const DIST = path.join(__dirname, "dist");
-const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
+const DIST_CHROME = path.join(DIST, "chrome");
+const DIST_FIREFOX = path.join(DIST, "firefox");
 const SRC = path.join(__dirname, "src");
 
+// The module whose compiled DEBUG state script/verify-build asserts, and the
+// manifest naming every emitted bundle that ends up containing it. The
+// manifest is derived from esbuild's own dependency graph rather than from a
+// hardcoded list, so it tracks the bundle layout instead of rotting with it.
+const AUDITED_MODULE = "src/shared/constants.js";
+const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
+
 function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
 }
 
+// Repo-relative, forward-slashed, so the manifest reads the same on every
+// platform and can be consumed by a POSIX shell script without further work.
+function repoRelative(p) {
+    return path.relative(__dirname, p).split(path.sep).join("/");
+}
+
+// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
+// reports every input that contributed to an output in the metafile, which is
+// the authoritative answer to "is constants.js in this bundle" — unlike
+// searching the minified text, it does not depend on what survived minification.
+//
+// The ".js" filter below is the only place that assumption lives:
+// script/verify-build searches every file and symlink under dist/ for a
+// marker, without filtering by extension, and hard-fails if it cannot walk the
+// whole tree, so a bundle emitted under some other extension fails there as
+// unlisted rather than escaping both checks at once.
+function outputsContainingAuditedModule(metafile) {
+    return Object.entries(metafile.outputs)
+        .filter(([outFile, info]) => {
+            if (!outFile.endsWith(".js")) return false;
+            return Object.keys(info.inputs).some(
+                (input) => repoRelative(input) === AUDITED_MODULE,
+            );
+        })
+        .map(([outFile]) => repoRelative(outFile));
+}
+
 // DEBUG is a build-time flag, off unless explicitly requested. It is the only
 // thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
 // exact: anything other than the literal "1" (unset, empty, "true", a typo)
@@ -72,68 +107,79 @@ async function build() {
         __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
     };
 
+    // Emitted bundles that contain constants.js, accumulated across every
+    // esbuild run below and written out for script/verify-build.
+    const auditedBundles = [];
+
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
-    const tailwindOutput = path.join(__dirname, "dist", "styles.css");
+    const tailwindOutput = path.join(DIST, "styles.css");
-    ensureDir(path.join(__dirname, "dist"));
+    ensureDir(DIST);
+
+    // Drop any manifest from a previous build before emitting anything, so a
+    // build that never gets around to writing one cannot be verified against
+    // a stale list.
+    fs.rmSync(BUNDLE_MANIFEST, { force: true });
+    // The locally installed binary, not `npx` — npx silently fetches from the
+    // registry when the binary is absent, which is an unpinned network fetch
+    // in the middle of a build.
+    const tailwindBin = path.join(
+        __dirname,
+        "node_modules",
+        ".bin",
+        "tailwindcss",
+    );
     execSync(
-        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
+        `"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
         { stdio: "inherit" },
     );
 
+    // Every bundle goes through here, so metafile collection cannot be
+    // forgotten when a new entry point is added.
+    async function bundle(entryPoint, outfile) {
+        const result = await esbuild.build({
+            entryPoints: [entryPoint],
+            bundle: true,
+            format: "iife",
+            outfile,
+            platform: "browser",
+            target: ["chrome110", "firefox110"],
+            minify: true,
+            metafile: true,
+            define,
+        });
+        auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
+    }
+
     for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
         ensureDir(path.join(distDir, "src", "popup"));
         ensureDir(path.join(distDir, "src", "background"));
         ensureDir(path.join(distDir, "src", "content"));
 
         // bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
-        await esbuild.build({
+        await bundle(
-            entryPoints: [path.join(SRC, "popup", "index.js")],
+            path.join(SRC, "popup", "index.js"),
-            bundle: true,
+            path.join(distDir, "src", "popup", "index.js"),
-            format: "iife",
+        );
-            outfile: path.join(distDir, "src", "popup", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
 
         // bundle background script
-        await esbuild.build({
+        await bundle(
-            entryPoints: [path.join(SRC, "background", "index.js")],
+            path.join(SRC, "background", "index.js"),
-            bundle: true,
+            path.join(distDir, "src", "background", "index.js"),
-            format: "iife",
+        );
-            outfile: path.join(distDir, "src", "background", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
 
         // bundle content script
-        await esbuild.build({
+        await bundle(
-            entryPoints: [path.join(SRC, "content", "index.js")],
+            path.join(SRC, "content", "index.js"),
-            bundle: true,
+            path.join(distDir, "src", "content", "index.js"),
-            format: "iife",
+        );
-            outfile: path.join(distDir, "src", "content", "index.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
 
         // bundle inpage script (injected into page context, separate file)
-        await esbuild.build({
+        await bundle(
-            entryPoints: [path.join(SRC, "content", "inpage.js")],
+            path.join(SRC, "content", "inpage.js"),
-            bundle: true,
+            path.join(distDir, "src", "content", "inpage.js"),
-            format: "iife",
+        );
-            outfile: path.join(distDir, "src", "content", "inpage.js"),
-            platform: "browser",
-            target: ["chrome110", "firefox110"],
-            minify: true,
-            define,
-        });
 
         // copy popup HTML
         fs.copyFileSync(
@@ -158,6 +204,16 @@ async function build() {
         path.join(DIST_FIREFOX, "manifest.json"),
     );
 
+    // Written last so a build that died partway through leaves no manifest
+    // at all, which script/verify-build treats as a hard failure rather than
+    // as "nothing to check".
+    const manifest = [...new Set(auditedBundles)].sort();
+    fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
+    console.log(
+        `Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
+            `(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
+    );
+
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
 

docs/README.md

@@ -6,10 +6,10 @@ and ERC-20 tokens, and connects to web3 sites. Nothing else.
 
 ## Why AutistMask Exists
 
-MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
+The most popular browser-based EVM wallet has become bloated with swap UIs,
-tracking, and advertisements. It is no longer a simple wallet. Most alternatives
+portfolio dashboards, analytics, tracking, and advertisements. It is no longer a
-(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
+simple wallet. The common alternatives only support Chromium browsers, leaving
-without a usable option.
+Firefox users without a usable option.
 
 AutistMask exists because a wallet should be a wallet. You should be able to see
 your balances, send tokens, receive tokens, and connect to sites. That is all a
@@ -27,9 +27,10 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **Encrypt your recovery phrase and private keys at rest.** Your secrets are
   encrypted on disk using Argon2id key derivation and XSalsa20-Poly1305
-  authenticated encryption (via libsodium). Your password is required only when
+  authenticated encryption (via libsodium). Your password is required whenever a
-  signing a transaction. Viewing balances and addresses never requires a
+  secret has to be decrypted: signing a transaction, signing a message or typed
-  password.
+  data, exporting a private key, and deleting a wallet. Viewing balances and
+  addresses never requires a password.
 
 - **Let you choose your own RPC endpoint.** The default is a public Ethereum
   RPC, but you can point it at your own node or any provider you trust. No
@@ -56,23 +57,25 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No token auto-discovery.** AutistMask does not scan the blockchain for
+- **No third-party token list APIs.** Token balances come from the same block
-  tokens you might hold. You add tokens manually by contract address. This
+  explorer you configure for transaction history, and the extension ships its
-  prevents scam tokens from appearing in your wallet uninvited.
+  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
+  detection. Any token you want tracked across all your addresses, you add
+  yourself by contract address.
 
-- **No phishing blocklists from third parties.** AutistMask does not phone home
+- **No backend servers operated by the developer.** Nothing is sent to any
-  to check URLs against a remote blocklist. It does maintain a local list of
+  server run by AutistMask. Every network destination is listed below.
-  known scam addresses, but this is shipped with the extension, not fetched from
-  a server.
 
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with three external services:
+not have a backend server. It communicates with five external destinations:
+three you configure yourself, and two fixed ones used for scam detection.
 
 ### External Services
 
-**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`)
+**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`;
+`ethereum-sepolia-rpc.publicnode.com` on Sepolia)
 
 This is how AutistMask talks to the Ethereum network. Every wallet needs an
 Ethereum node to check balances, estimate gas, broadcast transactions, and
@@ -80,27 +83,77 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-What gets sent: standard Ethereum JSON-RPC requests (balance queries,
+When it is contacted: on every balance refresh (every 10 seconds while the popup
-transaction broadcasts, gas estimates, ENS lookups). Your addresses are
+is open, every 60 seconds in the background), when you type an ENS name into the
-necessarily visible to the RPC provider when querying balances.
+Send screen, when a send is prepared and broadcast, while a pending transaction
+is polled for its receipt, and for the reverse ENS lookups used to label
+addresses (cached for 12 hours).
 
-**Blockscout API** (default: `eth.blockscout.com/api/v2`)
+What gets sent: standard Ethereum JSON-RPC requests (balance queries,
+transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
+addresses are necessarily visible to the RPC provider when querying balances.
+
+**Blockscout API** (default: `eth.blockscout.com/api/v2`;
+`eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
 Used to fetch token balances and transaction history. Blockscout is an
 open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances and recent transactions. You can change this in Settings to a
+balances (including the holder counts used for spam filtering) and your recent
+transactions and token transfers. You can change this in Settings to a
 self-hosted Blockscout instance.
 
+When it is contacted: on every balance refresh, and whenever a screen showing
+transaction history is opened.
+
 What gets sent: your Ethereum addresses (to look up balances and transactions).
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
-Used to fetch current USD prices for ETH and ERC-20 tokens. Prices are cached
+Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
-for 5 minutes. No API key is required. No user data is sent -- only a list of
+cached for 5 minutes. No API key is required. This endpoint is not
-token symbols (e.g. "ETH", "USDC") to get their prices.
+user-configurable, and it is not contacted at all while you are on a testnet,
+where no USD values are shown.
 
-What gets sent: token symbol names. No addresses, no balances, no identifying
+When it is contacted: while the popup is open, at most once every 5 minutes.
-information.
+
+What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
+balances, no identifying information. As with any request, CoinDesk sees your IP
+address.
+
+**Phishing domain blocklist** (`raw.githubusercontent.com`)
+
+A community-maintained list of phishing domains, used to warn you when a site
+that asks to connect, or to have a transaction or signature approved, is a known
+scam. A copy is bundled into the extension at build time, so the protection
+works before any network request happens. At runtime the extension fetches the
+live list to pick up newly added domains, keeping only the entries not already
+in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
+user-configurable.
+
+When it is contacted: when the background script starts, if the last fetch was
+more than 24 hours ago, and every 24 hours after that. The time of the last
+fetch is remembered across browser and background restarts, so restarting does
+not cause a re-download. If a fetch fails, or the list is too large to keep, the
+extension waits an hour before trying again outside that 24-hour schedule rather
+than retrying on every restart. It is a plain download of a public file —
+nothing about you is sent, but the host sees your IP address. If the fetch
+fails, the bundled copy is still used.
+
+**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
+
+When you review a send, AutistMask fetches the recipient's public Etherscan
+address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
+warning, and shows a red warning if it finds one. This is a plain page fetch
+with no API key, made by your browser. It is best-effort: if it fails, it is
+silently ignored. This endpoint is not user-configurable.
+
+When it is contacted: each time you reach the send confirmation screen.
+
+What gets sent: the recipient address you are about to send to, and your IP
+address. Your own addresses are not sent.
+
+Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
+contracts) are ordinary links. They contact nothing until you click them.
 
 ### What Stays Local
 
@@ -123,8 +176,11 @@ word recovery phrase can restore your wallet on any device without your
 password. The password only protects the copy stored in this browser. If you
 lose your recovery phrase, your password cannot help you recover it.
 
-Your password is only requested when you send a transaction. Viewing balances,
+Your password is requested whenever an encrypted secret must be decrypted: when
-receiving funds, and browsing transaction history never require your password.
+you send a transaction, when a site asks you to sign a message or typed data,
+when you export an address's private key, and when you delete a wallet. Viewing
+balances, receiving funds, and browsing transaction history never require your
+password.
 
 ## Installation
 
@@ -147,34 +203,46 @@ receiving funds, and browsing transaction history never require your password.
 ### Creating a New Wallet
 
 1. Click the AutistMask icon in your browser toolbar.
-2. Click "Add wallet".
+2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
-3. Click the die button to generate a random 12-word recovery phrase.
+3. On the "From Phrase" tab, click the die button to generate a random 12-word
+   recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
    words can take your funds. If you lose them, your wallet is gone. AutistMask
    cannot recover them for you.
-5. Choose a password. This encrypts your recovery phrase on this device.
+5. Choose a password and confirm it. This encrypts your recovery phrase on this
-6. Click "Add".
+   device.
+6. Click "Import".
 
 ### Importing an Existing Wallet
 
-**From a recovery phrase:** Follow the same steps as creating a wallet, but
+The Add Wallet screen has three tabs:
-paste your existing 12 or 24 word recovery phrase instead of generating a new
-one. AutistMask uses the same derivation path as MetaMask (`m/44'/60'/0'/0`), so
-your addresses will match.
 
-**From a private key:** On the Add Wallet screen, click "Have a private key
+**From Phrase:** Paste your existing 12 or 24 word recovery phrase instead of
-instead?" and paste your private key. This creates a single-address wallet.
+generating a new one. AutistMask uses the standard BIP-44 Ethereum derivation
+path (`m/44'/60'/0'/0`), which is what other wallets use by default, so your
+addresses will match and your phrase stays portable in both directions.
+
+**From Key:** Paste a single private key. This creates a single-address wallet.
+
+**From xprv:** Paste an extended private key. This imports the HD wallet and
+scans for used addresses.
+
+All three tabs ask for the same password fields, and the "Import" button
+finishes the job.
 
 ### Adding More Addresses
 
-HD wallets (created from a recovery phrase) can derive multiple addresses. On
+HD wallets (created from a recovery phrase or an xprv) can derive multiple
-the home screen, click the "+" button next to a wallet name to add the next
+addresses. On the home screen, click the "+" button next to a wallet name to add
-address. These are deterministic -- the same recovery phrase will always produce
+the next address. These are deterministic -- the same recovery phrase will
-the same sequence of addresses.
+always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-AutistMask does not auto-discover tokens. To track a token:
+Tokens you hold show up automatically only if they are in the extension's
+bundled list of well-known tokens or have at least 1,000 holders; everything
+else is treated as spam and hidden. To track a token explicitly (which also
+shows it at zero balance), add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -183,12 +251,13 @@ AutistMask does not auto-discover tokens. To track a token:
 4. Click "Add".
 
 The token balance will appear on the address detail screen and on the home
-screen.
+screen. Tokens can also be added from Settings, under "Tracked Tokens".
 
 ## Sending
 
 1. Click "Send" from the home screen or an address detail view.
-2. Select what to send (ETH or any tracked ERC-20 token).
+2. Select what to send (ETH, or any ERC-20 token with a balance on this address
+   that survives the spam filters).
 3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
 4. Enter the amount.
 5. Click "Review" to see the confirmation screen.
@@ -200,12 +269,18 @@ The confirmation screen shows:
 - **From and To addresses** with identicons and Etherscan links
 - **Amount** with USD estimate
 - **Your current balance** with USD estimate
-- **Estimated network fee** in ETH with USD estimate
+- **Network fee** — what the transfer is expected to cost, in ETH with a USD
+  estimate, and below it the larger amount reserved until it confirms. The
+  reserve is what the network requires up front and what the balance check gates
+  on; the refund of the difference is why the two differ
+- **Warnings** if the recipient is a contract, a burn address, one of your own
+  addresses, on the bundled scam-address list, or labelled as a phisher on
+  Etherscan
 
-After reviewing, click "Send" and enter your password. The transaction will be
+After reviewing, enter your password and click "Sign & Send". The transaction
-broadcast to the network and you will see a waiting screen with a timer. Once
+will be broadcast to the network and you will see a waiting screen with a timer.
-confirmed (or after 60 seconds), you will see either a success or error screen
+Once confirmed (or after 60 seconds), you will see either a success or error
-with the transaction hash and an Etherscan link.
+screen with the transaction hash and an Etherscan link.
 
 ### Sending a Specific Token
 
@@ -219,10 +294,10 @@ cannot accidentally switch to a different one.
 1. Click "Receive" from the home screen or an address detail view.
 2. Share the QR code or copy the address using the "Copy address" button.
 
-When receiving ERC-20 tokens, make sure the sender is sending on the Ethereum
+When receiving ERC-20 tokens, make sure the sender is sending on the network you
-network. AutistMask is an Ethereum mainnet wallet. Tokens sent on other networks
+are using. AutistMask supports Ethereum mainnet and the Sepolia testnet. Tokens
-(Polygon, Arbitrum, BSC, etc.) to the same address will not appear and may be
+sent on other networks (Polygon, Arbitrum, BSC, etc.) to the same address will
-permanently lost.
+not appear and may be permanently lost.
 
 ## Connecting to Web3 Sites
 
@@ -237,7 +312,12 @@ pages. When a site requests access to your wallet:
 
 When a connected site requests a transaction, a separate approval popup appears
 showing the transaction details (from, to, value, data). You must enter your
-password and click "Confirm" to authorize it.
+password and click "Confirm" to authorize it. Message and typed-data signature
+requests work the same way, with a "Sign" button, and also require your
+password.
+
+If the requesting site's domain is on the phishing blocklist, all three approval
+screens show a red phishing warning before you decide.
 
 You can manage site permissions in Settings. Allowed and denied sites can be
 individually removed to reset their permissions.
@@ -247,15 +327,25 @@ individually removed to reset their permissions.
 AutistMask includes several defenses against common Ethereum scams, all enabled
 by default:
 
-**Known token symbol verification.** AutistMask ships a list of ~250 legitimate
+**Known token symbol verification.** AutistMask ships a bundled list of
-ERC-20 tokens with their contract addresses. If a transaction claims to involve
+high-market-cap ERC-20 tokens with their legitimate contract addresses — a
-a known symbol (like "ETH" or "USDT") but comes from an unrecognized contract,
+point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
-it is identified as a spoof and hidden.
+at build time and updated only when a new release ships a newer snapshot. If a
+transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
+but comes from an unrecognized contract, it is identified as a spoof and hidden.
+In your transaction history this is the "Hide fake tokens impersonating a known
+symbol" setting, which you can switch off; doing so also stops new entries being
+added to the fraud contract blocklist below, since detecting a spoof is what
+fills it. The send token list always applies the check. Your balances apply it
+too, with one exception: a token claiming the symbol "ETH" is not filtered
+there, so a fake "ETH" token can still show up in your balance list even though
+it is hidden from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
-from transaction history and the send token list. Legitimate tokens have
+from transaction history and the send token list, and are left out of your
-substantial holder counts; scam tokens deployed for address poisoning typically
+balances unless they are on the bundled known-token list or you added them
-have zero.
+yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
+for address poisoning typically have zero.
 
 **Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
 adds the contract address to a local blocklist. Future transactions from that
@@ -266,15 +356,29 @@ ETH by default) are hidden. Scammers send dust from look-alike addresses to
 plant them in your transaction history. The threshold is configurable in
 Settings.
 
-All of these filters can be individually disabled in Settings if you prefer to
+**Scam address list.** A list of known fraud, drainer, and phishing addresses is
+shipped with the extension. Sending to one of them raises a warning on the
+confirmation screen. It contains only addresses involved in fraud -- it is not a
+sanctions list.
+
+**Phishing domain warnings.** Sites asking to connect or to have something
+approved are checked against the phishing domain blocklist described under
+External Services, and flagged with a red banner if they match.
+
+The first four filters can be individually disabled in Settings if you prefer to
 see everything unfiltered.
 
 ## Settings
 
 Click the gear icon on the home screen to access settings:
 
-- **Wallets**: Add a new wallet.
+- **Wallets**: Your wallets, and "+ Add wallet".
-- **Display**: Toggle whether tracked tokens with zero balance are shown.
+- **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
+  token".
+- **Display**: Toggle whether tracked tokens with zero balance are shown, switch
+  timestamps to UTC, and choose the theme (System, Light, or Dark).
+- **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
+  resets the RPC and Blockscout endpoints to that network's defaults.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and
@@ -282,15 +386,17 @@ Click the gear icon on the home screen to access settings:
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
+- **About**: License, author, version, release date, and a link to the commit
+  this build came from.
 
 ## Frequently Asked Questions
 
-**Is AutistMask compatible with MetaMask?**
+**Can I use AutistMask alongside another wallet?**
 
-Yes. AutistMask uses the same derivation path (`m/44'/60'/0'/0`) as MetaMask. If
+Yes. AutistMask uses the standard `m/44'/60'/0'/0` derivation path, so importing
-you import the same recovery phrase, you will get the same addresses. You can
+the same recovery phrase gives you the same addresses as any other wallet using
-use both wallets side by side, though only one can be the active
+that path. Two wallet extensions can be installed side by side, though only one
-`window.ethereum` provider at a time.
+can be the active `window.ethereum` provider at a time.
 
 **Can I use AutistMask with a hardware wallet?**
 
@@ -298,8 +404,9 @@ Not yet. Hardware wallet support may be added in the future.
 
 **Does AutistMask support networks other than Ethereum mainnet?**
 
-Not currently. AutistMask is Ethereum mainnet only. Multi-chain support may be
+Ethereum mainnet and the Sepolia testnet, selectable in Settings. No other
-added in the future.
+networks are supported today. On Sepolia, USD values are not shown, because
+testnet tokens have no market value.
 
 **Where is my data stored?**
 
@@ -312,7 +419,7 @@ to any server operated by AutistMask.
 
 Your data is deleted. Make sure you have your recovery phrase backed up before
 uninstalling. With your recovery phrase, you can restore your wallet in
-AutistMask or any other compatible wallet (MetaMask, etc.) at any time.
+AutistMask or any other wallet that uses the standard derivation path.
 
 **What happens if a transaction times out?**
 

manifest/chrome.json

@@ -3,8 +3,11 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Chrome",
-    "permissions": ["storage", "activeTab"],
+    "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
+    "content_security_policy": {
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
+    },
     "action": {
         "default_popup": "src/popup/index.html"
     },

manifest/firefox.json

@@ -3,7 +3,8 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
-    "permissions": ["storage", "activeTab", "<all_urls>"],
+    "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

package.json

@@ -7,6 +7,7 @@
     "private": true,
     "scripts": {
         "test": "jest --forceExit",
+        "test:verbose": "jest --forceExit --verbose",
         "build": "node build.js",
         "lint": "prettier --check .",
         "fmt": "prettier --write .",
@@ -16,6 +17,7 @@
         "@tailwindcss/cli": "^4.2.1",
         "esbuild": "^0.27.3",
         "jest": "^30.2.0",
+        "playwright-core": "1.56.0",
         "prettier": "^3.8.1",
         "tailwindcss": "^4.2.1"
     },

script/check

@@ -1,12 +1,13 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
+# script/check: run all checks (test, test-verify-build, lint, fmt-check).
-# extension to scripts-to-rule-them-all. Must not modify any files.
+# Our own extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 
 main() {
     "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/test-verify-build"
     "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
 }

script/test

@@ -7,7 +7,13 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     echo "Running tests..."
-    timeout 30 yarn run test 2>&1
+    timeout 30 yarn run test 2>&1 || {
+        echo "--- Rerunning with --verbose for details ---"
+        timeout 30 yarn run test:verbose 2>&1 || true
+        # Always fail: the first run already proved the tests are broken, so a
+        # flaky pass on the rerun must not turn the build green.
+        exit 1
+    }
 }
 
 main "$@"

script/test-e2e

@@ -0,0 +1,64 @@
+#!/bin/sh
+# script/test-e2e: build the extension and drive the real popup in a real
+# Chromium inside a pinned container. Our own extension to
+# scripts-to-rule-them-all.
+#
+# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
+# caps make test at 20 seconds and a browser suite does not fit. Run it
+# yourself before touching popup views; it is the only check that can see
+# a used-but-not-imported identifier blow up at runtime.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
+
+main() {
+    cd "$ROOT"
+
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "test-e2e: docker is required to run the e2e suite" >&2
+        exit 1
+    fi
+
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
+
+    echo "Running e2e suite in the pinned Playwright container..."
+    # --ipc=host: Chromium's shared-memory needs more than the default
+    #   64MB /dev/shm or renderers crash.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
+    # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
+    #   ctx.route() intercepts page requests only, and every fetch made by
+    #   the MV3 background service worker — including the phishing
+    #   blocklist fetch that src/background/index.js issues at worker
+    #   startup — goes to the real internet. The flag is experimental and
+    #   Playwright may drop or rename it. It cannot break silently: the
+    #   harness probes service-worker interception at launch and aborts
+    #   the whole suite if it is not in effect (see the interception
+    #   canary in tests/e2e/harness.js). If a future Playwright removes
+    #   the flag, that probe is what will fail, and the fix is either a
+    #   replacement mechanism or an honest downgrade of the isolation
+    #   claim in tests/e2e/network.js and README.md — not deleting the
+    #   probe. The image is pinned by digest, so this can only ever bite
+    #   on a deliberate bump.
+    docker run --rm \
+        --ipc=host \
+        --user "$(id -u):$(id -g)" \
+        -e HOME=/tmp \
+        -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
+        -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
+        node tests/e2e/run.js
+}
+
+main "$@"

script/test-e2e-firefox

@@ -0,0 +1,63 @@
+#!/bin/sh
+# script/test-e2e-firefox: build the extension and drive the real popup in
+# a real Firefox inside a pinned container. The Firefox counterpart to
+# script/test-e2e. Our own extension to scripts-to-rule-them-all.
+#
+# Deliberately NOT called by script/check or script/test, for the same
+# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
+# and a browser suite does not fit.
+#
+# Unlike script/test-e2e this builds its image locally, because no
+# published image carries both a pinned Firefox and a matching geckodriver.
+# All three external artifacts are pinned by digest inside the Dockerfile;
+# see tests/e2e/firefox/Dockerfile.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
+
+main() {
+    cd "$ROOT"
+
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
+        exit 1
+    fi
+
+    echo "Building extension for e2e..."
+    yarn run build 2>&1
+
+    # The build context is tests/e2e/firefox/ and holds nothing but the
+    # Dockerfile: the harness itself arrives over the bind mount below, so
+    # editing it never invalidates an image layer.
+    echo "Building the pinned Firefox e2e image..."
+    docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
+
+    echo "Running the Firefox e2e suite..."
+    # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
+    # --network none: the suite stubs nothing, so this is what keeps the
+    #   run offline and deterministic. The extension swallows its own
+    #   fetch failures, so the popup flows work unchanged; see the
+    #   network note in README.md. Weaker than the Chrome suite's
+    #   fixture interception, and honestly so — it proves no request
+    #   escaped, but it cannot report which ones were attempted.
+    # --user: keep files the suite touches owned by the caller, not root.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
+    #
+    # No --privileged. Firefox's sandbox logs
+    # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
+    # it is cosmetic and headless Firefox runs fine without it.
+    docker run --rm \
+        --shm-size=1g \
+        --network none \
+        --user "$(id -u):$(id -g)" \
+        -e HOME=/tmp \
+        -v "$ROOT:/work" \
+        -w /work \
+        "$IMAGE" \
+        node tests/e2e/firefox/run.js dist/firefox
+}
+
+main "$@"

script/test-verify-build

@@ -0,0 +1,444 @@
+#!/bin/sh
+# script/test-verify-build: exercise every failure mode of
+# script/verify-build. Our own extension to scripts-to-rule-them-all, run
+# from script/check so make check covers it.
+#
+# Why this exists: verify-build is the build-integrity guard, and three
+# separate reviews of it each found a fresh vacuous pass — the grep exit-2
+# conflation, the discarded find status, the line-delimited walk. Every one
+# was caught by someone building a tree by hand, because nothing in make check
+# could catch it. This is that hand battery, committed and automated.
+#
+# Each case asserts the exit status AND a substring of the message. A guard
+# that fails for the wrong reason (right status, different fault) is itself a
+# defect, so matching the status alone would not be a test of anything.
+#
+# The fixture is a temp tree containing script/verify-build as a SYMLINK to
+# the real script: verify-build takes its ROOT from dirname "$0"/.., so it
+# operates on the fixture's dist/ and never reads or writes the repo's build
+# output. The symlink rather than a copy is what makes a deliberate break in
+# the real script fail here.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+VERIFY_BUILD="$ROOT/script/verify-build"
+
+MARKER_ON="autistmask-build-debug=on"
+MARKER_OFF="autistmask-build-debug=off"
+
+NEWLINE='
+'
+
+PASSED=0
+FAILED=0
+SKIPPED=0
+SKIPPED_NAMES=""
+
+# The command prefix that runs the permission-dependent cases as a user who
+# is actually subject to file permissions, and whether those cases can run at
+# all. Both are decided by probe_permission_runner, never assumed.
+UNPRIV=""
+PERM_ENABLED=no
+PERM_HOW=""
+
+WORK=""
+
+cleanup() {
+    [ -n "$WORK" ] || return 0
+    # The cases chmod 000 files and directories on purpose.
+    chmod -R u+rwX "$WORK" 2>/dev/null || true
+    rm -rf "$WORK"
+}
+trap cleanup EXIT INT TERM
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-test-verify-build.XXXXXX")"
+FIXTURE="$WORK/fixture"
+
+# verify-build mktemps its dist/ listing under TMPDIR. Pointing that inside
+# our work dir keeps the run leaving no residue, and keeps it writable for the
+# unprivileged user the permission cases run as.
+TMPDIR="$WORK/tmp"
+export TMPDIR
+mkdir -p "$TMPDIR"
+chmod 1777 "$TMPDIR"
+chmod 755 "$WORK"
+
+# --- fixture ---------------------------------------------------------------
+
+# A stand-in for an emitted bundle: some text plus one marker literal, which
+# is all verify-build reads out of the real thing.
+write_bundle() {
+    printf 'var a=1;/* %s */\nvar b=2;\n' "$2" >"$1"
+}
+
+# A dist/ shaped like a real build: two listed bundles under different
+# browsers, an unlisted subtree to make unwalkable, and unlisted files that
+# carry no marker and must not be objected to.
+build_fixture() {
+    chmod -R u+rwX "$FIXTURE" 2>/dev/null || true
+    rm -rf "$FIXTURE"
+
+    mkdir -p "$FIXTURE/script"
+    ln -s "$VERIFY_BUILD" "$FIXTURE/script/verify-build"
+
+    mkdir -p "$FIXTURE/dist/chrome/src/popup" \
+        "$FIXTURE/dist/chrome/src/content" \
+        "$FIXTURE/dist/firefox/src/popup"
+
+    write_bundle "$FIXTURE/dist/chrome/src/popup/index.js" "$MARKER_OFF"
+    write_bundle "$FIXTURE/dist/firefox/src/popup/index.js" "$MARKER_OFF"
+    printf 'body{color:#000}\n' >"$FIXTURE/dist/styles.css"
+    printf 'var c=3;\n' >"$FIXTURE/dist/chrome/src/content/content.js"
+
+    {
+        echo "dist/chrome/src/popup/index.js"
+        echo "dist/firefox/src/popup/index.js"
+    } >"$FIXTURE/dist/constants-bundles.txt"
+
+    # Readable and traversable by the unprivileged user the permission cases
+    # run as, before those cases take that away again on purpose.
+    chmod -R a+rX "$FIXTURE"
+}
+
+# --- permission runner ------------------------------------------------------
+
+# Run a command through the current unprivileged runner. Unquoted on purpose:
+# UNPRIV is a command prefix that has to word-split.
+run_unpriv() {
+    # shellcheck disable=SC2086
+    $UNPRIV "$@"
+}
+
+# Decide whether the permission-dependent cases can run, and prove it rather
+# than assuming it.
+#
+# The problem: the CI image declares no USER, so CI runs as root, and root is
+# not subject to file permissions — chmod 000 stops neither find nor grep. A
+# permission case run as root passes vacuously, which is worse than no case at
+# all because it reads as coverage.
+#
+# So the runner is validated with two probes before any permission case is
+# counted:
+#
+#   - a mode-644 file MUST be readable through it. If not, the runner itself
+#     is broken (missing helper, no such user, sandbox), and every case run
+#     through it would fail for the wrong reason.
+#   - a mode-000 file MUST NOT be readable through it. If it is, permissions
+#     are not in force and the cases would pass without proving anything.
+#
+# Unprivileged: the runner is empty and both probes are about this process,
+# which is the honest answer. Root: setpriv and runuser are tried, both
+# present in the pinned CI base image. Only when no candidate passes both
+# probes are the cases skipped, and a skipped run says so unmistakably.
+probe_permission_runner() {
+    _probe="$WORK/probe"
+    mkdir -p "$_probe"
+    printf 'readable\n' >"$_probe/public"
+    printf 'secret\n' >"$_probe/private"
+    chmod 755 "$_probe"
+    chmod 644 "$_probe/public"
+    chmod 000 "$_probe/private"
+
+    if [ "$(id -u)" -eq 0 ]; then
+        _candidates="setpriv|setpriv --reuid=65534 --regid=65534 --clear-groups --
+runuser|runuser -u nobody --"
+    else
+        _candidates="direct|"
+    fi
+
+    _tried=""
+    _saved_ifs="$IFS"
+    IFS="$NEWLINE"
+    for _line in $_candidates; do
+        IFS="$_saved_ifs"
+        _label="${_line%%|*}"
+        _cmd="${_line#*|}"
+        _tried="${_tried:+$_tried, }$_label"
+
+        if [ -n "$_cmd" ]; then
+            _bin="${_cmd%% *}"
+            command -v "$_bin" >/dev/null 2>&1 || continue
+        fi
+
+        UNPRIV="$_cmd"
+        # Broken or unusable runner: the cases would fail for the wrong
+        # reason. Reaching the script under test is part of usable.
+        run_unpriv cat "$_probe/public" >/dev/null 2>&1 || continue
+        run_unpriv cat "$VERIFY_BUILD" >/dev/null 2>&1 || continue
+        # Permissions not in force through this runner: the cases would pass
+        # without testing anything.
+        if run_unpriv cat "$_probe/private" >/dev/null 2>&1; then
+            continue
+        fi
+
+        PERM_ENABLED=yes
+        PERM_HOW="$_label"
+        IFS="$_saved_ifs"
+        return 0
+    done
+    IFS="$_saved_ifs"
+
+    UNPRIV=""
+    PERM_ENABLED=no
+    PERM_HOW="$_tried"
+}
+
+# --- case runner ------------------------------------------------------------
+
+# check_case <name> <perm:yes|no> <mode:release|debug> <status> <text> <setup>
+#
+# Rebuilds the fixture, applies <setup> inside it, runs verify-build, and
+# requires both the exit status and the message. <perm> marks a case that only
+# means anything when file permissions are in force.
+check_case() {
+    _name="$1"
+    _perm="$2"
+    _mode="$3"
+    _want_status="$4"
+    _want_text="$5"
+    _setup="$6"
+
+    if [ "$_perm" = yes ] && [ "$PERM_ENABLED" != yes ]; then
+        SKIPPED=$((SKIPPED + 1))
+        SKIPPED_NAMES="$SKIPPED_NAMES##   - $_name$NEWLINE"
+        echo "  SKIP (permissions not in force): $_name"
+        return 0
+    fi
+
+    build_fixture
+    if ! (cd "$FIXTURE" && "$_setup") >/dev/null 2>&1; then
+        FAILED=$((FAILED + 1))
+        echo "  FAIL: $_name"
+        echo "    the case's own setup failed, so nothing was tested."
+        return 0
+    fi
+
+    if [ "$_mode" = debug ]; then
+        _debug=1
+    else
+        _debug=""
+    fi
+
+    # Exported rather than set as a command prefix: run_unpriv is a function,
+    # and an assignment prefixed to a function call is not portable.
+    AUTISTMASK_DEBUG="$_debug"
+    export AUTISTMASK_DEBUG
+
+    _status=0
+    if [ "$_perm" = yes ]; then
+        _out="$(run_unpriv "$FIXTURE/script/verify-build" 2>&1)" || _status=$?
+    else
+        _out="$("$FIXTURE/script/verify-build" 2>&1)" || _status=$?
+    fi
+
+    _ok=yes
+    _why=""
+
+    if [ "$_status" -ne "$_want_status" ]; then
+        _ok=no
+        _why="exit status $_status, wanted $_want_status"
+    fi
+
+    # Same discipline verify-build itself applies to grep: 0 and 1 are
+    # answers, anything else is not, and must not be read as "no match".
+    _g=0
+    printf '%s\n' "$_out" | grep -q -F -e "$_want_text" || _g=$?
+    case "$_g" in
+    0) ;;
+    1)
+        _ok=no
+        _why="${_why:+$_why; }message did not contain: $_want_text"
+        ;;
+    *)
+        _ok=no
+        _why="${_why:+$_why; }grep exited $_g matching the message, so the
+      message was never checked"
+        ;;
+    esac
+
+    if [ "$_ok" = yes ]; then
+        PASSED=$((PASSED + 1))
+        echo "  ok: $_name"
+        return 0
+    fi
+
+    FAILED=$((FAILED + 1))
+    echo "  FAIL: $_name"
+    echo "    $_why"
+    echo "    --- verify-build output ---"
+    printf '%s\n' "$_out" | sed 's/^/    /'
+    echo "    --- end output ---"
+}
+
+# --- cases ------------------------------------------------------------------
+#
+# Each runs with the fixture as its working directory.
+
+c_control() { :; }
+
+c_trailing_space() {
+    cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js "
+}
+
+c_embedded_newline() {
+    cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js$NEWLINE"
+}
+
+c_dist_symlink() {
+    mv dist dist.real
+    ln -s dist.real dist
+}
+
+c_unwalkable_subtree() { chmod 000 dist/chrome/src/content; }
+
+c_dangling_symlink() {
+    ln -s /nonexistent-target-for-test-verify-build dist/chrome/dangling.js
+}
+
+c_dir_symlink() { ln -s src dist/chrome/link-to-dir; }
+
+c_alias_symlink() { ln -s popup/index.js dist/chrome/src/aliased.js; }
+
+c_manifest_missing() { rm dist/constants-bundles.txt; }
+
+c_manifest_empty() { : >dist/constants-bundles.txt; }
+
+c_manifest_unreadable() { chmod 000 dist/constants-bundles.txt; }
+
+c_bundle_missing() { rm dist/chrome/src/popup/index.js; }
+
+c_bundle_empty() { : >dist/chrome/src/popup/index.js; }
+
+c_bundle_unreadable() { chmod 000 dist/chrome/src/popup/index.js; }
+
+c_unlisted_extension() {
+    cp dist/chrome/src/popup/index.js dist/chrome/src/popup/extra.mjs
+}
+
+c_no_marker() { printf 'var d=4;\n' >dist/chrome/src/popup/index.js; }
+
+c_both_markers() {
+    printf '/* %s */\n' "$MARKER_ON" >>dist/chrome/src/popup/index.js
+}
+
+run_cases() {
+    check_case "control: untouched dist passes" \
+        no release 0 "2 bundle(s) verified $MARKER_OFF" c_control
+
+    check_case "unlisted marker-carrying file, trailing space in name" \
+        no release 1 "carries a debug marker but is absent from" \
+        c_trailing_space
+
+    check_case "unlisted marker-carrying file, newline in name" \
+        no release 1 "carries a debug marker but is absent from" \
+        c_embedded_newline
+
+    check_case "dist/ replaced by a symlink" \
+        no release 1 "dist is a symlink, not a directory." c_dist_symlink
+
+    check_case "unwalkable subtree under dist/" \
+        yes release 1 "enumerating dist/, so part of the tree" \
+        c_unwalkable_subtree
+
+    check_case "dangling symlink under dist/" \
+        no release 1 \
+        "reading dist/chrome/dangling.js, so the file could not be" \
+        c_dangling_symlink
+
+    check_case "symlink to a directory under dist/" \
+        no release 1 \
+        "reading dist/chrome/link-to-dir, so the file could not be" \
+        c_dir_symlink
+
+    check_case "symlink to a listed bundle under an unlisted path" \
+        no release 1 \
+        "dist/chrome/src/aliased.js carries a debug marker but is absent" \
+        c_alias_symlink
+
+    check_case "manifest missing" \
+        no release 1 "dist/constants-bundles.txt is missing." \
+        c_manifest_missing
+
+    check_case "manifest empty" \
+        no release 1 "is empty, so no emitted bundle was found to contain" \
+        c_manifest_empty
+
+    check_case "manifest unreadable" \
+        yes release 1 "is not readable, so nothing was inspected." \
+        c_manifest_unreadable
+
+    check_case "listed bundle missing" \
+        no release 1 \
+        "lists dist/chrome/src/popup/index.js, which does not exist." \
+        c_bundle_missing
+
+    check_case "listed bundle empty" \
+        no release 1 "which is empty. An empty bundle" c_bundle_empty
+
+    check_case "listed bundle unreadable" \
+        yes release 1 \
+        "reading dist/chrome/src/popup/index.js, so the file could not be" \
+        c_bundle_unreadable
+
+    check_case "unlisted extension carrying a marker" \
+        no release 1 \
+        "dist/chrome/src/popup/extra.mjs carries a debug marker but is" \
+        c_unlisted_extension
+
+    check_case "listed bundle carries no marker" \
+        no release 1 "carries no debug marker, so its DEBUG state cannot be" \
+        c_no_marker
+
+    check_case "listed bundle carries both markers" \
+        no release 1 "carries both debug markers, so DEBUG was not resolved" \
+        c_both_markers
+
+    check_case "wrong marker for the requested mode" \
+        no debug 1 "is $MARKER_OFF but this build expects $MARKER_ON" \
+        c_control
+}
+
+# --- main --------------------------------------------------------------------
+
+main() {
+    cd "$ROOT"
+
+    [ -x "$VERIFY_BUILD" ] || {
+        echo "test-verify-build: $VERIFY_BUILD is missing or not executable" >&2
+        exit 1
+    }
+
+    echo "Testing script/verify-build failure modes..."
+    probe_permission_runner
+    if [ "$PERM_ENABLED" = yes ]; then
+        echo "  permission cases: enabled (runner: $PERM_HOW, proved against" \
+            "a mode-000 file)"
+    fi
+
+    run_cases
+
+    if [ "$FAILED" -ne 0 ]; then
+        echo "test-verify-build: $FAILED case(s) FAILED," \
+            "$PASSED passed, $SKIPPED skipped" >&2
+        exit 1
+    fi
+
+    if [ "$SKIPPED" -ne 0 ]; then
+        cat <<EOF
+################################################################################
+## WARNING: $SKIPPED PERMISSION CASE(S) DID NOT RUN, AND THIS RUN DOES NOT
+## PROVE THEM. This process is uid $(id -u), and no runner subject to file
+## permissions was available. Tried: $PERM_HOW.
+## Under root, chmod 000 stops neither find nor grep, so these cases would
+## have passed without testing anything. They were skipped, not counted:
+$SKIPPED_NAMES################################################################################
+EOF
+        echo "test-verify-build: $PASSED case(s) passed," \
+            "$SKIPPED SKIPPED AND NOT PROVEN (see the warning above)"
+        return 0
+    fi
+
+    echo "test-verify-build: $PASSED case(s) passed"
+}
+
+main "$@"

script/verify-build

@@ -0,0 +1,295 @@
+#!/bin/sh
+# script/verify-build: assert the compiled DEBUG state of the emitted
+# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
+# make build / make build-debug.
+#
+# Why this exists: DEBUG makes the publicly committed test recovery phrase the
+# output of wallet creation, so a release artifact built with it live hands
+# every new wallet to anyone who reads the repo. The test suite cannot see
+# this, because it loads src/shared/constants.js outside a bundle and takes
+# the fallback branch; the property only exists in the emitted output, so it
+# has to be asserted against the emitted output.
+#
+# What it reads: dist/constants-bundles.txt, written by build.js from
+# esbuild's metafile, naming every emitted bundle that contains
+# src/shared/constants.js. Each of those must carry exactly one of the two
+# BUILD_DEBUG_MARKER literals that constants.js folds down to.
+#
+# It fails rather than passes whenever it cannot determine a bundle's state.
+# Minified output is not a stable contract, so "matched neither form" is not
+# evidence of anything and must never read as green.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Absolute path to this script, resolved before anything cd's anywhere.
+# check_unlisted_bundles re-invokes it through xargs, and $0 on its own may be
+# relative to a directory we are about to leave.
+SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
+
+# Internal re-entry flag; see scan_dist_paths.
+SCAN_FLAG="--scan-dist-paths"
+
+# A literal newline, for the is_listed guard.
+NEWLINE='
+'
+
+MANIFEST="dist/constants-bundles.txt"
+MARKER_ON="autistmask-build-debug=on"
+MARKER_OFF="autistmask-build-debug=off"
+
+# Set by read_marker.
+MARKER=""
+
+# Temporary file holding the NUL-delimited dist/ listing, removed by the EXIT
+# trap because fail() exits from wherever it is called.
+LISTING=""
+
+fail() {
+    echo "verify-build: FAIL: $*" >&2
+    exit 1
+}
+
+cleanup() {
+    [ -z "$LISTING" ] || rm -f "$LISTING"
+}
+trap cleanup EXIT
+
+# Is the literal $1 present in the file $2? Match (grep exit 0) and no-match
+# (exit 1) are answers about the emitted output. Anything else (exit 2: the
+# file could not be read) is not an answer at all, and must not be reported as
+# "no marker" — that would blame the bundle for a permissions or I/O fault.
+has_marker() {
+    _hm_status=0
+    grep -q -F -e "$1" -- "$2" || _hm_status=$?
+    case "$_hm_status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *)
+        fail "grep exited $_hm_status reading $2, so the file could not be
+    searched and its DEBUG state was not checked at all. That is a permissions
+    or I/O fault on the artifact, not a change in the emitted output. Refusing
+    to report success."
+        ;;
+    esac
+}
+
+# Does the manifest list the path $1, as a whole line? Same discipline as
+# has_marker: exit 0 and 1 are answers about the manifest, exit 2 means the
+# manifest could not be read and is not an answer at all. Without this, an
+# unreadable manifest reads as "this file is not listed" and every emitted
+# bundle gets reported as an unlisted one.
+#
+# A path containing a newline is answered without asking grep, because grep
+# would read the pattern as two patterns and report a match on either. That is
+# how such a path escaped this check even once the walk stopped splitting it:
+# the half before the newline matched a listed line and the file was skipped.
+# The manifest is line-delimited, so it cannot name such a path at all, and
+# "not listed" is the only true answer.
+is_listed() {
+    case "$1" in
+    *"$NEWLINE"*) return 1 ;;
+    esac
+    _il_status=0
+    grep -q -x -F -e "$1" -- "$MANIFEST" || _il_status=$?
+    case "$_il_status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *)
+        fail "grep exited $_il_status reading $MANIFEST, so it could not be
+    searched and nothing was established about which bundles it lists. That is
+    a permissions or I/O fault on the manifest, not a stale manifest. Refusing
+    to report success."
+        ;;
+    esac
+}
+
+# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
+# present. Both means the ternary in constants.js was never folded, which is
+# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
+# DEBUG stops being known at build time. Neither means we are reading output
+# we do not understand. Both are hard failures; neither is ever treated as
+# absence of a problem.
+read_marker() {
+    _file="$1"
+    _on=no
+    _off=no
+    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
+    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
+
+    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
+        fail "$_file carries both debug markers, so DEBUG was not resolved at
+    build time: the ternary in src/shared/constants.js survived into the
+    emitted output. This does not mean the debug branch is live in this
+    artifact: an unresolved __BUILD_DEBUG__ is undeclared in extension
+    context, so DEBUG evaluates to false at runtime. It does mean the
+    release/debug distinction is no longer enforced at build time, and which
+    way that fallback happens to evaluate is then an accident a refactor can
+    flip. Check that build.js still defines __BUILD_DEBUG__."
+    fi
+    if [ "$_on" = no ] && [ "$_off" = no ]; then
+        fail "$_file carries no debug marker, so its DEBUG state cannot be
+    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
+    or the emitted output changed shape. Refusing to report success."
+    fi
+
+    if [ "$_on" = yes ]; then
+        MARKER="$MARKER_ON"
+    else
+        MARKER="$MARKER_OFF"
+    fi
+}
+
+# The manifest says which bundles must carry a marker. This says no other
+# emitted file may carry one, which catches a manifest that has gone stale
+# or short rather than trusting whatever it happens to list.
+#
+# Deliberately unfiltered by extension. build.js selects manifest entries with
+# an endsWith(".js") test; repeating that literal here would mean a bundle
+# emitted under some other extension escaped the manifest AND this check at
+# once, which is the correlated blind spot the two-source design exists to
+# avoid. Every regular file and every symlink under dist/ is searched — that
+# is the whole of what a build emits — so build.js's filter is the only place
+# the assumption lives and this check is what catches it being wrong.
+#
+# That claim only holds if the walk is exhaustive and every name survives it
+# intact, so four things are enforced here rather than assumed:
+#
+#   - the walk is NUL-delimited and the paths reach the check as arguments, so
+#     no name can be reshaped on the way in. Read line by line, a name with a
+#     trailing space lost it to read's field splitting and the remnant then
+#     matched a manifest line, and a name containing a newline arrived as a
+#     listed path plus an empty one. Both left a marker-carrying, unlisted file
+#     unchecked while the script still reported success. Delivering such a name
+#     intact is only half of it; is_listed also has to keep it out of grep's
+#     pattern, for the same reason.
+#   - find's exit status is checked. A subtree it cannot descend is reported on
+#     stderr and then simply missing from the listing, so an unchecked status
+#     turns "could not look" into "nothing was there" — the same conflation
+#     has_marker exists to prevent. The status cannot be read off a pipeline,
+#     so the listing lands in a file that xargs then reads back.
+#   - symlinks are walked too (-type l), not skipped. A marker-carrying bundle
+#     reachable under an unlisted path in dist/ is a stale manifest whether the
+#     path is a link or a file, and grep reads through the link. A link that
+#     cannot be read through — dangling, or pointing at a directory — fails
+#     hard via has_marker's exit-2 path, which is the fail-closed answer: the
+#     build emits neither, so their DEBUG state is unproven, not fine.
+#   - dist/ itself must be a directory and not a symlink, which main asserts
+#     before anything reads through it. find does not follow a symlink named on
+#     its own command line, so a linked dist/ collapses this walk to one entry
+#     and cross-checks nothing.
+#
+# Types other than regular files and symlinks are left out on purpose: a build
+# emits none of them, and grep on a fifo would hang rather than fail.
+check_unlisted_bundles() {
+    LISTING="$(mktemp "${TMPDIR:-/tmp}/verify-build-dist.XXXXXX")" ||
+        fail "could not create a temporary file for the dist/ listing, so the
+    tree was never walked. Refusing to report success."
+
+    _find_status=0
+    find dist \( -type f -o -type l \) -print0 >"$LISTING" || _find_status=$?
+    [ "$_find_status" -eq 0 ] ||
+        fail "find exited $_find_status enumerating dist/, so part of the tree
+    was never walked and nothing was established about the files in it. Any
+    unlisted bundle there went unchecked. That is a permissions or I/O fault on
+    the artifact, not a stale manifest. Refusing to report success."
+
+    _scan_status=0
+    xargs -0 "$SELF" "$SCAN_FLAG" <"$LISTING" || _scan_status=$?
+    [ "$_scan_status" -eq 0 ] ||
+        fail "the unlisted-bundle scan exited $_scan_status: either a path
+    under dist/ failed the check reported above, or the scan could not be run
+    at all. Refusing to report success."
+}
+
+# The per-path half of check_unlisted_bundles. It runs in a re-invocation of
+# this script, so it uses the same is_listed and has_marker as the rest of the
+# file rather than a second copy of them that could drift. Paths arrive as
+# arguments and are never split, joined or trimmed.
+scan_dist_paths() {
+    for _file in "$@"; do
+        if is_listed "$_file"; then
+            continue
+        fi
+        if has_marker "$MARKER_ON" "$_file" ||
+            has_marker "$MARKER_OFF" "$_file"; then
+            fail "$_file carries a debug marker but is absent from $MANIFEST,
+    so the manifest no longer describes the emitted bundles."
+        fi
+    done
+}
+
+# The requested mode, read from our own environment using build.js's exact
+# rule: only the literal 1 opts in. Deliberately not taken from anything
+# build.js records about itself, so build.js cannot vouch for build.js.
+expected_marker() {
+    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
+        echo "$MARKER_ON"
+    else
+        echo "$MARKER_OFF"
+    fi
+}
+
+main() {
+    cd "$ROOT"
+
+    # Internal re-entry from check_unlisted_bundles' xargs. Not part of the
+    # command-line interface: nothing else invokes it, and it is a distinct
+    # entry point rather than a mode flag threaded through the checks below.
+    if [ "${1-}" = "$SCAN_FLAG" ]; then
+        shift
+        scan_dist_paths "$@"
+        return 0
+    fi
+
+    expected="$(expected_marker)"
+    echo "Verifying emitted bundles (expecting $expected)..."
+
+    # Asserted here rather than left to grep. A symlinked dist/ used to fail
+    # only because GNU grep exits 2 on a directory, so check_unlisted_bundles'
+    # single entry hit has_marker's I/O path by luck; under a grep that exits 1
+    # instead, the whole cross-check would have collapsed into a pass.
+    if [ -h dist ]; then
+        fail "dist is a symlink, not a directory. find does not follow a
+    symlink named on its own command line, so the unlisted-bundle cross-check
+    would see one entry instead of the emitted tree and establish nothing about
+    it. Refusing to report success."
+    fi
+    [ -d dist ] ||
+        fail "dist is not a directory, so there is no emitted tree to verify.
+    build.js writes it; run make build first."
+
+    [ -f "$MANIFEST" ] ||
+        fail "$MANIFEST is missing. build.js writes it at the end of a
+    successful build; run make build first."
+    [ -s "$MANIFEST" ] ||
+        fail "$MANIFEST is empty, so no emitted bundle was found to contain
+    src/shared/constants.js. That is never correct, so it is a failure and not
+    a pass."
+    [ -r "$MANIFEST" ] ||
+        fail "$MANIFEST is not readable, so nothing was inspected. That is a
+    permissions or I/O fault, not a pass."
+
+    count=0
+    while read -r file; do
+        [ -n "$file" ] || continue
+        [ -f "$file" ] ||
+            fail "$MANIFEST lists $file, which does not exist."
+        [ -s "$file" ] ||
+            fail "$MANIFEST lists $file, which is empty. An empty bundle
+    carries no marker and proves nothing, so this is a failure and not a pass."
+        read_marker "$file"
+        [ "$MARKER" = "$expected" ] ||
+            fail "$file is $MARKER but this build expects $expected."
+        echo "  ok: $file ($MARKER)"
+        count=$((count + 1))
+    done <"$MANIFEST"
+
+    [ "$count" -gt 0 ] || fail "no bundles were inspected."
+
+    check_unlisted_bundles
+
+    echo "verify-build: $count bundle(s) verified $expected"
+}
+
+main "$@"

src/background/index.js

@@ -5,7 +5,6 @@
 const { DEFAULT_RPC_URL } = require("../shared/constants");
 const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
 const { onChainSwitch } = require("../shared/chainSwitch");
-const { getBytes } = require("ethers");
 const {
     state,
     loadState,
@@ -13,14 +12,29 @@ const {
     currentNetwork,
 } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
-const { debugFetch } = require("../shared/log");
+const { debugFetch, log } = require("../shared/log");
-const { decryptWithPassword } = require("../shared/vault");
+const {
-const { getSignerForAddress } = require("../shared/wallet");
+    verifySignedTx,
+    verifySignature,
+    failureIsRetryable,
+    describeTxFailure,
+    TX_STAGE_SIGN,
+    TX_STAGE_VERIFY,
+    TX_STAGE_BROADCAST,
+    TX_STAGE_INFLIGHT,
+} = require("../shared/approvalVerify");
 const {
     isPhishingDomain,
-    updatePhishingList,
+    refreshPhishingListOnSchedule,
-    startPeriodicRefresh,
+    initPhishingList,
 } = require("../shared/phishingDomains");
+const {
+    BALANCE_REFRESH_ALARM,
+    PHISHING_REFRESH_ALARM,
+    BALANCE_REFRESH_PERIOD_MINUTES,
+    ensureRecurringAlarms,
+    registerAlarmHandlers,
+} = require("../shared/alarms");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -102,6 +116,55 @@ function resetPopupUrl() {
     }
 }
 
+// Settle a pending approval: hand `result` to the promise the requesting page
+// is waiting on and retire the approval. This is the ONLY place an approval is
+// resolved or removed — the popup closing, an active-address switch, a reject
+// from the popup and the attempt that signs and broadcasts all come through
+// here — because a settlement that bypasses the claim below is a fund-loss bug
+// and enumerating the call sites has repeatedly missed one.
+//
+// A claimed approval belongs to the attempt holding the claim, and only that
+// attempt may settle it. Anything else settling first would leave the attempt
+// running to completion against an already-settled promise: the transaction
+// reaches the chain while the page is told "User rejected the request", and the
+// user's natural response is to send it again at a fresh nonce.
+//
+// Returns false when the approval is gone or claimed by someone else, so the
+// caller can refuse instead of assuming it settled.
+function settleApproval(id, result, options) {
+    const approval = pendingApprovals[id];
+    if (!approval) return false;
+    const holdsClaim = !!(options && options.holdsClaim);
+    if (approval.attemptInFlight && !holdsClaim) return false;
+    delete pendingApprovals[id];
+    approval.resolve(result);
+    resetPopupUrl();
+    return true;
+}
+
+// Take exclusive hold of a pending approval for one attempt, or refuse.
+//
+// An approval that failed retryably has to stay in pendingApprovals, so its
+// presence cannot be the interlock against a second attempt; this flag is. It
+// is set synchronously, before the handler's first await, so a second response
+// carrying the same id — a reloaded approval window re-rendering a live
+// Approve button, a popup that emits the message twice — finds the attempt
+// already running instead of starting an independent verify and broadcast.
+// Without it one approval can put two transactions on the chain: with the
+// ordinary dApp approval shape the page fixes no nonce, so two artifacts
+// signed at different nonces both verify.
+function claimApproval(approval) {
+    if (approval.attemptInFlight) return false;
+    approval.attemptInFlight = true;
+    return true;
+}
+
+// Release an approval whose attempt failed in a way the user can retry.
+// Nothing was broadcast, so the next attempt may claim it.
+function releaseApproval(approval) {
+    approval.attemptInFlight = false;
+}
+
 // Open approval in a separate popup window.
 // This is the primary mechanism for tx/sign approvals (triggered programmatically,
 // not from a user gesture) and the fallback for site-connection approvals.
@@ -210,8 +273,7 @@ runtime.onConnect.addListener((port) => {
                     // Keep pending — user can reopen the toolbar popup
                     return;
                 }
-                approval.resolve({ approved: false, remember: false });
+                settleApproval(id, { approved: false, remember: false });
-                delete pendingApprovals[id];
             }
             resetPopupUrl();
         });
@@ -542,15 +604,21 @@ async function broadcastAccountsChanged() {
     for (const key of Object.keys(connectedSites)) {
         delete connectedSites[key];
     }
-    // Reject and close any pending approval popups so they don't hang
+    // Reject and close any pending approval popups so they don't hang. An
+    // approval an attempt has already claimed is left alone entirely: it is
+    // being signed and broadcast right now, and neither rejecting it to the
+    // page nor closing the window it is reporting into is survivable.
     for (const [id, approval] of Object.entries(pendingApprovals)) {
-        if (approval.type === "tx" || approval.type === "sign") {
+        const rejection =
-            approval.resolve({
+            approval.type === "tx" || approval.type === "sign"
-                error: { code: 4001, message: "User rejected the request." },
+                ? {
-            });
+                      error: {
-        } else {
+                          code: 4001,
-            approval.resolve({ approved: false, remember: false });
+                          message: "User rejected the request.",
-        }
+                      },
+                  }
+                : { approved: false, remember: false };
+        if (!settleApproval(id, rejection)) continue;
         if (approval.windowId) {
             windowsApi.remove(approval.windowId, () => {
                 if (runtime.lastError) {
@@ -558,7 +626,6 @@ async function broadcastAccountsChanged() {
                 }
             });
         }
-        delete pendingApprovals[id];
     }
     resetPopupUrl();
     const s = await getState();
@@ -593,12 +660,22 @@ async function broadcastAccountsChanged() {
 // Background balance refresh: every 60 seconds when the popup isn't open.
 // When the popup IS open, its 10-second interval keeps lastBalanceRefresh
 // fresh, so this naturally skips.
-const BACKGROUND_REFRESH_INTERVAL = 60000;
+//
+// The alarm period alone sets the cadence; this guard only suppresses a
+// refresh something else has just done, so it must stay strictly shorter than
+// the period. Timed to the period it would veto every tick it gates —
+// lastBalanceRefresh is stamped after the refresh runs, so a tick one period
+// after the last one always lands inside a guard of equal length and the real
+// cadence becomes two periods. Half the period keeps it comfortably above the
+// popup's 10-second refresh, so an open popup still suppresses the background
+// job, and comfortably below the alarm period, so the schedule always wins.
+const BALANCE_REFRESH_PERIOD_MS = BALANCE_REFRESH_PERIOD_MINUTES * 60 * 1000;
+const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 
 async function backgroundRefresh() {
     await loadState();
     const now = Date.now();
-    if (now - (state.lastBalanceRefresh || 0) < BACKGROUND_REFRESH_INTERVAL)
+    if (now - (state.lastBalanceRefresh || 0) < RECENT_BALANCE_REFRESH_MS)
         return;
     if (state.wallets.length === 0) return;
     await refreshBalances(
@@ -611,30 +688,79 @@ async function backgroundRefresh() {
     await saveState();
 }
 
-setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL);
+// Both recurring jobs run off alarms, not timers. On Chrome MV3 this file is
+// a service worker that the browser terminates after about 30 seconds idle,
+// so a setInterval would only ever survive until the first idle period and
+// module-level state does not outlive it. Alarms are held by the browser and
+// wake the worker to deliver them.
+registerAlarmHandlers({
+    [BALANCE_REFRESH_ALARM]: backgroundRefresh,
+    // The scheduled refresh, which restores persisted state on a freshly
+    // revived worker and then fetches unconditionally. The freshness guards
+    // belong to the startup path; applying them here would make the tick skip
+    // itself.
+    [PHISHING_REFRESH_ALARM]: refreshPhishingListOnSchedule,
+});
 
-// Fetch the phishing domain blocklist delta on startup and refresh every 24h.
+// Everything the background context needs re-established on start. This runs
-// The vendored blocklist is bundled at build time; this fetches only new entries.
+// on a fresh install, on browser startup, and on every revival of a
-updatePhishingList();
+// terminated worker, so it must be idempotent: ensureRecurringAlarms() only
-startPeriodicRefresh();
+// creates alarms that are missing or carrying a stale period, and
+// initPhishingList() fetches only when the persisted timestamps say the list
+// is stale.
+//
+// On a fresh install the top-level call and the onInstalled listener both run,
+// close enough together that both could see an alarm missing and create it.
+// Sharing one in-flight run makes the "create only when missing" check
+// race-free; the memo is dropped once it settles so a later onStartup runs
+// again.
+let backgroundJobsRun = null;
 
-// When approval window is closed without a response, treat as rejection
+function startBackgroundJobs() {
+    if (backgroundJobsRun) return backgroundJobsRun;
+    backgroundJobsRun = Promise.all([
+        ensureRecurringAlarms(),
+        initPhishingList(),
+    ])
+        .catch((err) => {
+            // An alarm that failed to schedule means a recurring job silently
+            // never runs again; it must not be an unhandled rejection.
+            log.errorf("background job startup failed:", err);
+        })
+        .finally(() => {
+            backgroundJobsRun = null;
+        });
+    return backgroundJobsRun;
+}
+
+if (runtime.onInstalled) {
+    runtime.onInstalled.addListener(startBackgroundJobs);
+}
+if (runtime.onStartup) {
+    runtime.onStartup.addListener(startBackgroundJobs);
+}
+startBackgroundJobs();
+
+// When approval window is closed without a response, treat as rejection.
+// "Without a response" is the operative part: the popup stays open across the
+// verify and broadcast it is waiting on, so a user closing an apparently-hung
+// window is an ordinary event with an attempt already in flight behind it.
+// settleApproval() refuses those, which leaves the attempt to report its real
+// outcome to the page.
 if (windowsApi && windowsApi.onRemoved) {
     windowsApi.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
-            if (approval.windowId === windowId) {
+            if (approval.windowId !== windowId) continue;
-                if (approval.type === "tx" || approval.type === "sign") {
+            const rejection =
-                    approval.resolve({
+                approval.type === "tx" || approval.type === "sign"
-                        error: {
+                    ? {
-                            code: 4001,
+                          error: {
-                            message: "User rejected the request.",
+                              code: 4001,
-                        },
+                              message: "User rejected the request.",
-                    });
+                          },
-                } else {
+                      }
-                    approval.resolve({ approved: false, remember: false });
+                    : { approved: false, remember: false };
-                }
+            settleApproval(id, rejection);
-                delete pendingApprovals[id];
-            }
         }
     });
 }
@@ -700,14 +826,10 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
     }
 
     if (msg.type === "AUTISTMASK_APPROVAL_RESPONSE") {
-        const approval = pendingApprovals[msg.id];
+        settleApproval(msg.id, {
-        if (approval) {
+            approved: msg.approved,
-            approval.resolve({
+            remember: msg.remember,
-                approved: msg.approved,
+        });
-                remember: msg.remember,
-            });
-            delete pendingApprovals[msg.id];
-        }
         resetPopupUrl();
         return false;
     }
@@ -715,57 +837,116 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
     if (msg.type === "AUTISTMASK_TX_RESPONSE") {
         const approval = pendingApprovals[msg.id];
         if (!approval) return false;
-        delete pendingApprovals[msg.id];
-        resetPopupUrl();
 
+        // A reject arriving while an attempt holds the approval is refused,
+        // not honoured: the attempt is on its way to broadcasting the
+        // transaction, and resolving 4001 here would tell the page the request
+        // was rejected while it goes out.
         if (!msg.approved) {
-            approval.resolve({
+            if (
-                error: { code: 4001, message: "User rejected the request." },
+                !settleApproval(msg.id, {
-            });
+                    error: {
+                        code: 4001,
+                        message: "User rejected the request.",
+                    },
+                })
+            ) {
+                sendResponse({
+                    error: "This transaction is already being sent.",
+                    retryable: false,
+                    stage: TX_STAGE_BROADCAST,
+                });
+                return false;
+            }
             return true;
         }
 
+        // The popup signs; it reports back here when it could not. Keep the
+        // approval so the user can correct the problem and try again with the
+        // transaction they already saw.
+        if (msg.error) {
+            const outcome = describeTxFailure(TX_STAGE_SIGN, msg.error);
+            sendResponse({
+                error: outcome.error,
+                retryable: outcome.retryable,
+                stage: TX_STAGE_SIGN,
+            });
+            return false;
+        }
+
+        // Exactly one broadcast per approval, whatever the popup sends.
+        if (!claimApproval(approval)) {
+            sendResponse({
+                error: "This transaction is already being sent.",
+                retryable: false,
+                stage: TX_STAGE_BROADCAST,
+            });
+            return false;
+        }
+
         (async () => {
             try {
                 await loadState();
                 const activeAddress = await getActiveAddress();
-                let wallet, addrIndex;
+                // The popup holds the secret, but the background stays the
-                for (const w of state.wallets) {
+                // authority on what is broadcast: the raw transaction must be
-                    for (let i = 0; i < w.addresses.length; i++) {
+                // the approved one, signed by the approved address, on the
-                        if (w.addresses[i].address === activeAddress) {
+                // network that is selected.
-                            wallet = w;
+                verifySignedTx(
-                            addrIndex = i;
+                    msg.rawSignedTx,
-                            break;
+                    approval.txParams,
-                        }
+                    activeAddress,
-                    }
+                    currentNetwork().chainId,
-                    if (wallet) break;
+                );
+            } catch (e) {
+                // A signed transaction that is not the approved one is not
+                // retried against that approval; it is refused outright.
+                // Anything else that failed before the check ran is the
+                // user's to retry.
+                const outcome = describeTxFailure(TX_STAGE_VERIFY, e);
+                if (outcome.spendApproval) {
+                    settleApproval(
+                        msg.id,
+                        { error: { message: outcome.error } },
+                        { holdsClaim: true },
+                    );
+                } else {
+                    releaseApproval(approval);
                 }
-                if (!wallet) throw new Error("Wallet not found");
+                sendResponse({
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
+                    error: outcome.error,
-                let decrypted = await decryptWithPassword(
+                    retryable: outcome.retryable,
-                    wallet.encryptedSecret,
+                    stage: TX_STAGE_VERIFY,
-                    msg.password,
+                });
-                );
+                return;
-                const signer = getSignerForAddress(
+            }
-                    wallet,
+
-                    addrIndex,
+            try {
-                    decrypted,
-                );
-                // Best-effort: clear decrypted secret after use.
-                // Note: JS strings are immutable; this nulls the reference but
-                // the original string may persist in memory until GC.
-                decrypted = null;
                 const provider = getProvider(state.rpcUrl);
-                const connected = signer.connect(provider);
+                const tx = await provider.broadcastTransaction(msg.rawSignedTx);
-                const tx = await connected.sendTransaction(approval.txParams);
+                settleApproval(
-                approval.resolve({ txHash: tx.hash });
+                    msg.id,
+                    { txHash: tx.hash },
+                    { holdsClaim: true },
+                );
                 sendResponse({ txHash: tx.hash });
             } catch (e) {
-                const errMsg = e.shortMessage || e.message;
+                // Terminal, never retried: the node may have accepted the
-                approval.resolve({
+                // transaction and still failed to answer, and the popup's
-                    error: { message: errMsg },
+                // retry re-signs at a freshly fetched nonce rather than
+                // re-broadcasting these bytes. Retrying would send the
+                // approved transfer a second time.
+                const outcome = describeTxFailure(TX_STAGE_BROADCAST, e);
+                settleApproval(
+                    msg.id,
+                    { error: { message: outcome.error } },
+                    { holdsClaim: true },
+                );
+                sendResponse({
+                    error: outcome.error,
+                    retryable: outcome.retryable,
+                    stage: TX_STAGE_BROADCAST,
                 });
-                sendResponse({ error: errMsg });
             }
         })();
         return true;
@@ -774,73 +955,70 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
     if (msg.type === "AUTISTMASK_SIGN_RESPONSE") {
         const approval = pendingApprovals[msg.id];
         if (!approval) return false;
-        delete pendingApprovals[msg.id];
-        resetPopupUrl();
 
+        // Same as the transaction path: a reject cannot retire an approval an
+        // attempt already holds.
         if (!msg.approved) {
-            approval.resolve({
+            if (
-                error: { code: 4001, message: "User rejected the request." },
+                !settleApproval(msg.id, {
-            });
+                    error: {
+                        code: 4001,
+                        message: "User rejected the request.",
+                    },
+                })
+            ) {
+                sendResponse({
+                    error: "This request is already being signed.",
+                    retryable: false,
+                    stage: TX_STAGE_INFLIGHT,
+                });
+                return false;
+            }
             return true;
         }
 
+        // The popup signs; it reports back here when it could not. Keep the
+        // approval so the user can correct the problem and try again with the
+        // message they already saw.
+        if (msg.error) {
+            sendResponse({ error: msg.error, retryable: true });
+            return false;
+        }
+
+        // Exactly one signature handed back per approval.
+        if (!claimApproval(approval)) {
+            sendResponse({
+                error: "This request is already being signed.",
+                retryable: false,
+                stage: TX_STAGE_INFLIGHT,
+            });
+            return false;
+        }
+
         (async () => {
             try {
-                await loadState();
                 const activeAddress = await getActiveAddress();
-                let wallet, addrIndex;
+                // The popup holds the secret, but the background stays the
-                for (const w of state.wallets) {
+                // authority on what is handed back to the page: the signature
-                    for (let i = 0; i < w.addresses.length; i++) {
+                // must cover the approved payload and recover to the approved
-                        if (w.addresses[i].address === activeAddress) {
+                // address.
-                            wallet = w;
+                const signature = msg.signature;
-                            addrIndex = i;
+                verifySignature(approval.signParams, signature, activeAddress);
-                            break;
+                settleApproval(msg.id, { signature }, { holdsClaim: true });
-                        }
-                    }
-                    if (wallet) break;
-                }
-                if (!wallet) throw new Error("Wallet not found");
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
-                let decrypted = await decryptWithPassword(
-                    wallet.encryptedSecret,
-                    msg.password,
-                );
-                const signer = getSignerForAddress(
-                    wallet,
-                    addrIndex,
-                    decrypted,
-                );
-                // Best-effort: clear decrypted secret after use.
-                // Note: JS strings are immutable; this nulls the reference but
-                // the original string may persist in memory until GC.
-                decrypted = null;
-
-                const sp = approval.signParams;
-                let signature;
-
-                if (sp.method === "personal_sign" || sp.method === "eth_sign") {
-                    signature = await signer.signMessage(getBytes(sp.message));
-                } else {
-                    // eth_signTypedData_v4 / eth_signTypedData
-                    const typedData = JSON.parse(sp.typedData);
-                    const { domain, types, message } = typedData;
-                    // ethers handles EIP712Domain internally
-                    delete types.EIP712Domain;
-                    signature = await signer.signTypedData(
-                        domain,
-                        types,
-                        message,
-                    );
-                }
-
-                approval.resolve({ signature });
                 sendResponse({ signature });
             } catch (e) {
                 const errMsg = e.shortMessage || e.message;
-                approval.resolve({
+                const retryable = failureIsRetryable(e);
-                    error: { message: errMsg },
+                if (!retryable) {
-                });
+                    settleApproval(
-                sendResponse({ error: errMsg });
+                        msg.id,
+                        { error: { message: errMsg } },
+                        { holdsClaim: true },
+                    );
+                } else {
+                    releaseApproval(approval);
+                }
+                sendResponse({ error: errMsg, retryable });
             }
         })();
         return true;

src/popup/dustThreshold.js

@@ -0,0 +1,42 @@
+// Parsing for the dust threshold field in Settings.
+//
+// Pure: no DOM, no state, so the accepted set can be unit tested directly
+// instead of through the settings view.
+//
+// Accepted input is plain decimal digits only, meaning a whole number of
+// gwei, zero or greater. Zero is a real setting: it hides nothing.
+//
+// Deliberately rejected, not coerced:
+//   ""          nothing to save
+//   "-1"        a negative threshold has no meaning
+//   "1.5"       fractional gwei is not a threshold the filter can use
+//   "100 gwei"  the unit is already printed beside the field
+//   "0x10"      hex, which Number() would silently read as 16
+//   "1e3"       exponent notation, which Number() would silently read as 1000
+//
+// The last two are the reason this is a digit test and not a Number() test.
+// Number() accepts both, and accepting them would put a number in the field
+// that the user did not type — the same silent substitution the visible
+// rejection message exists to end.
+
+// Must render on ONE line of #flash-msg, whose reserved height
+// (min-h-[1.25rem]) is exactly one line at text-xs. A string long enough to
+// wrap to two lines pushes the settings view down, which the No Layout Shift
+// policy forbids. Do not lengthen this without re-running the layout test in
+// tests/e2e/run.js, which measures the flash line and goes red on a shift.
+const DUST_THRESHOLD_MESSAGE =
+    "Please enter a whole number of gwei, zero or greater.";
+
+// Returns the threshold in gwei, or null if the input is not one.
+function parseDustThresholdGwei(raw) {
+    if (typeof raw !== "string") return null;
+    const trimmed = raw.trim();
+    if (!/^[0-9]+$/.test(trimmed)) return null;
+    const val = Number(trimmed);
+    // A run of digits long enough to exceed Number's exact integer range
+    // would round on the way in, so it is not a threshold we can store.
+    if (!Number.isSafeInteger(val)) return null;
+    return val;
+}
+
+module.exports = { DUST_THRESHOLD_MESSAGE, parseDustThresholdGwei };

src/popup/index.html

@@ -136,7 +136,9 @@
                 <div id="add-wallet-section-xprv" class="hidden">
                     <p class="mb-2">
                         Paste your extended private key (xprv) below. This will
-                        import the HD wallet and scan for used addresses.
+                        import the HD wallet and scan for used addresses. It
+                        must be the master key for the wallet; an account-level
+                        or child key is not supported.
                     </p>
                     <div class="mb-2">
                         <input
@@ -582,10 +584,18 @@
                     <div id="confirm-balance" class="text-xs"></div>
                 </div>
                 <div id="confirm-fee" class="mb-3" style="visibility: hidden">
-                    <div class="text-xs text-muted mb-1">
+                    <div class="text-xs text-muted mb-1">Network fee</div>
-                        Estimated network fee
-                    </div>
                     <div id="confirm-fee-amount" class="text-xs"></div>
+                    <!-- Holds its one line of space from the first paint, so
+                    the reserve appearing when the estimate lands moves
+                    nothing. The placeholder is never seen. -->
+                    <div
+                        id="confirm-fee-reserve"
+                        class="text-xs text-muted"
+                        style="visibility: hidden"
+                    >
+                        reserve pending
+                    </div>
                 </div>
                 <div
                     id="confirm-warnings"
@@ -647,6 +657,31 @@
                     class="mb-2 border border-border border-dashed p-2"
                     style="visibility: hidden; min-height: 1.25rem"
                 ></div>
+                <div
+                    id="confirm-amount-fee-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    Your balance does not cover this amount plus the network
+                    fee. Please go back and send a smaller amount.
+                </div>
+                <div
+                    id="confirm-gas-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    You do not have enough ETH to pay the network fee for this
+                    transfer. Please add ETH to this address and try again.
+                </div>
+                <div
+                    id="confirm-fee-unknown-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    The network fee could not be estimated, so this transaction
+                    cannot be checked against your balance. Please go back and
+                    try again.
+                </div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
                     <input
@@ -869,6 +904,12 @@
                         />
                         Show tracked tokens with zero balance
                     </label>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
+                    >
+                        <input type="checkbox" id="settings-utc-timestamps" />
+                        UTC Timestamps
+                    </label>
                     <div class="text-xs flex items-center gap-1">
                         <label for="settings-theme">Theme:</label>
                         <select
@@ -948,6 +989,15 @@
                         transfers and prevent interaction with suspicious
                         tokens.
                     </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-hide-spoofed-symbols"
+                        />
+                        Hide fake tokens impersonating a known symbol
+                    </label>
                     <label
                         class="text-xs flex items-center gap-1 cursor-pointer mb-2"
                     >
@@ -979,12 +1029,6 @@
                         />
                         <span class="text-xs text-muted">gwei</span>
                     </div>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
-                    >
-                        <input type="checkbox" id="settings-utc-timestamps" />
-                        UTC Timestamps
-                    </label>
                 </div>
 
                 <div class="bg-well p-3 mx-1 mb-3">
@@ -1098,6 +1142,108 @@
                 </button>
             </div>
 
+            <!-- ============ DELETE ADDRESS CONFIRM ============ -->
+            <div id="view-delete-address-confirm" class="view hidden">
+                <button
+                    id="btn-delete-address-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-3">Remove Address</h2>
+                <p class="text-xs mb-2">
+                    You are about to remove
+                    <strong id="delete-address-label"></strong> from
+                    <strong id="delete-address-wallet-name"></strong>.
+                </p>
+                <div
+                    id="delete-address-value"
+                    class="text-xs mb-2 break-all min-h-[1rem]"
+                ></div>
+                <div
+                    class="text-xs mb-2 border border-border border-dashed p-2"
+                >
+                    This only stops this wallet from tracking the address.
+                    Nothing is destroyed and no key is deleted. Any funds at the
+                    address stay exactly where they are, and the address remains
+                    yours. Any site permissions granted to this address are
+                    forgotten.
+                </div>
+                <!-- Filled by src/popup/views/deleteAddress.js: the route
+                     back names the wallet's own kind of key material. -->
+                <div
+                    id="delete-address-recovery"
+                    class="text-xs mb-2 border border-border border-dashed p-2"
+                ></div>
+                <div
+                    id="delete-address-balance"
+                    class="text-xs mb-2 min-h-[1.25rem] pointer-events-none"
+                >
+                    &nbsp;
+                </div>
+                <p class="text-xs text-muted mb-3">
+                    A wallet always keeps at least one address. To remove the
+                    last one, delete the whole wallet from Settings instead.
+                </p>
+                <div
+                    id="delete-address-flash"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
+                ></div>
+                <button
+                    id="btn-delete-address-confirm"
+                    class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                >
+                    Remove Address
+                </button>
+            </div>
+
+            <!-- ============ SHOW RECOVERY PHRASE ============ -->
+            <div id="view-show-phrase" class="view hidden">
+                <button
+                    id="btn-show-phrase-back"
+                    class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
+                >
+                    &lt; Back
+                </button>
+                <h2 class="font-bold mb-1">Recovery Phrase</h2>
+                <p class="text-xs mb-3" id="show-phrase-wallet-name"></p>
+                <div
+                    class="text-xs mb-3 border border-border border-dashed p-2"
+                >
+                    Anyone who has these words can take every coin and token in
+                    this wallet, from any device, without your password. Never
+                    type them into a website and never show them to anyone.
+                </div>
+                <div
+                    id="show-phrase-flash"
+                    class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
+                    style="visibility: hidden"
+                ></div>
+                <div id="show-phrase-password-section" class="mb-2">
+                    <label class="block mb-1">Password</label>
+                    <input
+                        type="password"
+                        id="show-phrase-password"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        placeholder="Enter your password to continue"
+                    />
+                    <button
+                        id="btn-show-phrase-reveal"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mt-2"
+                    >
+                        Reveal
+                    </button>
+                </div>
+                <div id="show-phrase-result" class="hidden">
+                    <div
+                        id="show-phrase-value"
+                        class="bg-danger-well rounded p-2 font-mono text-xs break-all cursor-pointer mb-1"
+                        title="Click to copy"
+                    ></div>
+                </div>
+            </div>
+
             <!-- ============ SETTINGS: ADD TOKEN ============ -->
             <div id="view-settings-addtoken" class="view hidden">
                 <button

src/popup/index.js

@@ -15,6 +15,10 @@ const {
     clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
+// Views that can be fully re-rendered from persisted state. All others fall
+// back to the nearest restorable parent; see the module for why the
+// secret-bearing views are absent.
+const { RESTORABLE_VIEWS } = require("./restorableViews");
 
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -29,6 +33,7 @@ const receive = require("./views/receive");
 const addToken = require("./views/addToken");
 const settings = require("./views/settings");
 const settingsAddToken = require("./views/settingsAddToken");
+const deleteAddress = require("./views/deleteAddress");
 const approval = require("./views/approval");
 
 function renderWalletList() {
@@ -97,23 +102,12 @@ const ctx = {
         pushCurrentView();
         settingsAddToken.show();
     },
+    showDeleteAddress: (walletIdx, addrIdx) => {
+        pushCurrentView();
+        deleteAddress.show(walletIdx, addrIdx);
+    },
 };
 
-// Views that can be fully re-rendered from persisted state.
-// All others fall back to the nearest restorable parent.
-const RESTORABLE_VIEWS = new Set([
-    "main",
-    "address",
-    "address-token",
-    "receive",
-    "settings",
-    "settings-addtoken",
-    "confirm-tx",
-    "transaction",
-    "success-tx",
-    "error-tx",
-]);
-
 function needsAddress(view) {
     return (
         view === "address" ||
@@ -176,6 +170,12 @@ function restoreView() {
                 fallbackView();
             }
             break;
+        case "wait-tx":
+            // Resumes the receipt poll from the persisted broadcast time.
+            if (!txStatus.restoreWait()) {
+                fallbackView();
+            }
+            break;
         case "success-tx":
             if (state.viewData && state.viewData.hash) {
                 txStatus.renderSuccess();
@@ -261,6 +261,7 @@ async function init() {
     addToken.init(ctx);
     settings.init(ctx);
     settingsAddToken.init(ctx);
+    deleteAddress.init(ctx);
 
     if (!state.hasWallet) {
         showView("welcome");

src/popup/restorableViews.js

@@ -0,0 +1,30 @@
+// Views the popup may reopen onto.
+//
+// The popup persists the current view so that reopening the toolbar popup
+// lands the user back where they were. Only views that can be fully
+// re-rendered from persisted state belong here; every other view falls back
+// to the nearest restorable parent (src/popup/index.js restoreView()).
+//
+// A view that displays a secret must NEVER be listed. Restoring onto one
+// would put a private key or a recovery phrase on screen with no password
+// prompt in front of it, on a popup the user may have reopened by accident.
+// That is why "export-privkey" and "show-phrase" are absent.
+//
+// Kept in its own module, with no dependencies, so tests can assert the
+// exclusion directly rather than trusting a reading of the popup entry
+// point, which cannot be required outside a browser.
+const RESTORABLE_VIEWS = new Set([
+    "main",
+    "address",
+    "address-token",
+    "receive",
+    "settings",
+    "settings-addtoken",
+    "confirm-tx",
+    "transaction",
+    "wait-tx",
+    "success-tx",
+    "error-tx",
+]);
+
+module.exports = { RESTORABLE_VIEWS };

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");

src/popup/views/addWallet.js

@@ -1,4 +1,11 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const {
+    $,
+    showView,
+    showFlash,
+    goBack,
+    clearViewStack,
+    onViewLeave,
+} = require("./helpers");
 const {
     generateMnemonic,
     hdWalletFromMnemonic,
@@ -6,6 +13,7 @@ const {
     addressFromPrivateKey,
     hdWalletFromXprv,
     isValidXprv,
+    isMasterExtendedKey,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
@@ -65,13 +73,23 @@ function switchMode(mode) {
     $("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
 }
 
-function show() {
+// Wipe the secret material this screen holds in the DOM: a generated or
+// pasted recovery phrase, an imported private key or extended private key,
+// and the password that would encrypt them. Registered as the view-leave
+// handler as well as run on entry, so none of it survives in the hidden
+// view after the user navigates away by any route, including the Settings
+// gear and the import itself.
+function clear() {
     $("wallet-mnemonic").value = "";
     $("import-private-key").value = "";
     $("import-xprv-key").value = "";
     $("add-wallet-password").value = "";
     $("add-wallet-password-confirm").value = "";
     $("add-wallet-phrase-warning").style.visibility = "hidden";
+}
+
+function show() {
+    clear();
     switchMode("mnemonic");
     showView("add-wallet");
 }
@@ -213,14 +231,25 @@ async function importXprvKey(ctx) {
         return;
     }
     if (!isValidXprv(xprv)) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
+        return;
+    }
+    if (!isMasterExtendedKey(xprv)) {
+        showFlash(
+            "That is an account-level or child key, which cannot be imported. " +
+                "Please paste the master extended private key for the wallet.",
+        );
         return;
     }
     let result;
     try {
         result = hdWalletFromXprv(xprv);
     } catch (e) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
         return;
     }
     const { xpub, firstAddress } = result;
@@ -276,6 +305,8 @@ async function importXprvKey(ctx) {
 }
 
 function init(ctx) {
+    onViewLeave("add-wallet", clear);
+
     // Tab click handlers
     $("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
     $("tab-privkey").addEventListener("click", () => switchMode("privkey"));

src/popup/views/addressDetail.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     addressDotHtml,
     addressTitle,
@@ -27,8 +26,17 @@ const {
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
-const { decryptWithPassword } = require("../../shared/vault");
+const exportPrivkey = require("./exportPrivkey");
-const { getSignerForAddress } = require("../../shared/wallet");
+const { walletDefect } = require("../../shared/walletDefects");
+
+// The defect of the wallet the selected address belongs to, or null. Both the
+// send and the private-key export path check it before asking for a password,
+// so a wallet that cannot derive its keys says so instead of failing after the
+// user has typed one in.
+function selectedWalletDefect() {
+    if (state.selectedWallet === null) return null;
+    return walletDefect(state.wallets[state.selectedWallet]);
+}
 
 let ctx;
 
@@ -148,6 +156,7 @@ async function loadTransactions(address) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
+            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,
@@ -253,6 +262,11 @@ function init(_ctx) {
     });
 
     $("btn-send").addEventListener("click", () => {
+        const defect = selectedWalletDefect();
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress
@@ -297,81 +311,20 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
-        pushCurrentView();
+        // There is no private key to export for an address this wallet
-        const wallet = state.wallets[state.selectedWallet];
+        // cannot derive. Without this the export screen would take a
-        const addr = wallet.addresses[state.selectedAddress];
+        // password and then report it as wrong.
-        const blockieEl = $("export-privkey-jazzicon");
+        const defect = selectedWalletDefect();
-        blockieEl.innerHTML = "";
+        if (defect) {
-        const bImg = document.createElement("img");
+            showFlash(defect.shortMessage);
-        bImg.src = makeBlockie(addr.address);
-        bImg.width = 48;
-        bImg.height = 48;
-        bImg.style.imageRendering = "pixelated";
-        bImg.style.borderRadius = "50%";
-        blockieEl.appendChild(bImg);
-        $("export-privkey-title").textContent =
-            wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
-        const exportAddrContainer = $("export-privkey-dot").parentElement;
-        exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
-        attachCopyHandlers(exportAddrContainer);
-        $("export-privkey-password").value = "";
-        $("export-privkey-flash").textContent = "";
-        $("export-privkey-flash").style.visibility = "hidden";
-        $("export-privkey-password-section").classList.remove("hidden");
-        $("export-privkey-result").classList.add("hidden");
-        $("export-privkey-value").textContent = "";
-        showView("export-privkey");
-    });
-
-    $("btn-export-privkey-confirm").addEventListener("click", async () => {
-        const password = $("export-privkey-password").value;
-        if (!password) {
-            $("export-privkey-flash").textContent = "Password is required.";
-            $("export-privkey-flash").style.visibility = "visible";
             return;
         }
-        const btn = $("btn-export-privkey-confirm");
+        // No pushCurrentView() here: exportPrivkey.show() can return
-        btn.disabled = true;
+        // without navigating, so it does its own push.
-        btn.classList.add("text-muted");
+        exportPrivkey.show(state.selectedWallet, state.selectedAddress);
-        const wallet = state.wallets[state.selectedWallet];
-        try {
-            const secret = await decryptWithPassword(
-                wallet.encryptedSecret,
-                password,
-            );
-            const signer = getSignerForAddress(
-                wallet,
-                state.selectedAddress,
-                secret,
-            );
-            const privateKey = signer.privateKey;
-            $("export-privkey-password-section").classList.add("hidden");
-            $("export-privkey-value").textContent = privateKey;
-            $("export-privkey-result").classList.remove("hidden");
-            $("export-privkey-flash").style.visibility = "hidden";
-        } catch {
-            $("export-privkey-flash").textContent = "Wrong password.";
-            $("export-privkey-flash").style.visibility = "visible";
-        } finally {
-            btn.disabled = false;
-            btn.classList.remove("text-muted");
-        }
     });
 
-    $("export-privkey-value").addEventListener("click", () => {
+    exportPrivkey.init();
-        const key = $("export-privkey-value").textContent;
-        if (key) {
-            navigator.clipboard.writeText(key);
-            showFlash("Copied!");
-            flashCopyFeedback($("export-privkey-value"));
-        }
-    });
-
-    $("btn-export-privkey-back").addEventListener("click", () => {
-        $("export-privkey-value").textContent = "";
-        $("export-privkey-password").value = "";
-        goBack();
-    });
 }
 
 module.exports = { init, show };

src/popup/views/addressToken.js

@@ -35,6 +35,7 @@ const {
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
+const { walletDefect } = require("../../shared/walletDefects");
 
 let ctx;
 
@@ -222,6 +223,7 @@ async function loadTransactions(address, tokenId) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
+            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,
@@ -337,6 +339,11 @@ function init(_ctx) {
     });
 
     $("btn-address-token-send").addEventListener("click", () => {
+        const defect = walletDefect(state.wallets[state.selectedWallet]);
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress

src/popup/views/approval.js

@@ -7,12 +7,24 @@ const {
     hideError,
     renderAddressHtml,
     attachCopyHandlers,
+    onViewLeave,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
+const {
+    formatEther,
+    formatUnits,
+    getBytes,
+    Interface,
+    toUtf8String,
+} = require("ethers");
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
+const { decryptWithPassword } = require("../../shared/vault");
+const { getSignerForAddress } = require("../../shared/wallet");
+const { walletDefect } = require("../../shared/walletDefects");
+const { getProvider } = require("../../shared/balances");
+const { describeSigningFailure } = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
 const runtime =
@@ -153,6 +165,8 @@ function showTxApproval(details) {
         details.isPhishingDomain,
     );
 
+    pendingTxParams = details.txParams;
+
     const toAddr = details.txParams.to;
     const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
     const ethValue = formatEther(details.txParams.value || "0");
@@ -269,6 +283,7 @@ function showTxApproval(details) {
 
     showView("approve-tx");
     attachCopyHandlers("view-approve-tx");
+    gateOnWalletDefect("approve-tx-error", "btn-approve-tx");
 }
 
 function decodeHexMessage(hex) {
@@ -326,6 +341,7 @@ function showSignApproval(details) {
     );
 
     const sp = details.signParams;
+    pendingSignParams = sp;
 
     $("approve-sign-hostname").textContent = details.hostname;
     $("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
@@ -367,6 +383,7 @@ function showSignApproval(details) {
 
     showView("approve-sign");
     attachCopyHandlers("view-approve-sign");
+    gateOnWalletDefect("approve-sign-error", "btn-approve-sign");
 }
 
 function show(id) {
@@ -401,8 +418,69 @@ function show(id) {
 
 let approvalId = null;
 let pendingTxDetails = null;
+// The exact parameters shown to the user, kept so the popup signs what it
+// displayed rather than re-fetching anything at approval time. Both are
+// repopulated by show() when the popup is closed and reopened.
+let pendingTxParams = null;
+let pendingSignParams = null;
+
+// Approve buttons stay disabled and muted while the popup derives the key and
+// signs, which is slow enough (Argon2id) that a double click is likely.
+function setTxButtonBusy(busy) {
+    $("btn-approve-tx").disabled = busy;
+    $("btn-approve-tx").classList.toggle("text-muted", busy);
+}
+
+function setSignButtonBusy(busy) {
+    $("btn-approve-sign").disabled = busy;
+    $("btn-approve-sign").classList.toggle("text-muted", busy);
+}
+
+// Say so on the approval screen itself, and disable the approve button, when
+// the active address belongs to a wallet whose keys cannot be derived. Without
+// this the screen would take a password and fail after deriving it. Reject
+// stays available; the wallet is not touched. Returns true when it gated.
+function gateOnWalletDefect(errorId, buttonId) {
+    const active = findActiveWallet();
+    const defect = active ? walletDefect(active.wallet) : null;
+    if (!defect) return false;
+    showError(errorId, defect.shortMessage);
+    $(buttonId).disabled = true;
+    $(buttonId).classList.add("text-muted");
+    return true;
+}
+
+// Locate the wallet and the address index owning the currently active
+// address. Returns null when no wallet holds it.
+function findActiveWallet() {
+    for (const wallet of state.wallets) {
+        for (let i = 0; i < wallet.addresses.length; i++) {
+            if (wallet.addresses[i].address === state.activeAddress) {
+                return { wallet, addrIndex: i };
+            }
+        }
+    }
+    return null;
+}
+
+// Drop the password from the DOM when either approval screen is left. The
+// approval window navigates on after a signature — approve-tx goes to the
+// wait screen — and the password must not sit in the hidden view for the
+// life of that window.
+function clearTxPassword() {
+    $("approve-tx-password").value = "";
+    hideError("approve-tx-error");
+}
+
+function clearSignPassword() {
+    $("approve-sign-password").value = "";
+    hideError("approve-sign-error");
+}
 
 function init(ctx) {
+    onViewLeave("approve-tx", clearTxPassword);
+    onViewLeave("approve-sign", clearSignPassword);
+
     $("approve-remember").addEventListener("change", async () => {
         state.rememberSiteChoice = $("approve-remember").checked;
         await saveState();
@@ -430,34 +508,104 @@ function init(ctx) {
         window.close();
     });
 
-    $("btn-approve-tx").addEventListener("click", () => {
+    $("btn-approve-tx").addEventListener("click", async () => {
-        const password = $("approve-tx-password").value;
+        let password = $("approve-tx-password").value;
         if (!password) {
             showError("approve-tx-error", "Please enter your password.");
             return;
         }
         hideError("approve-tx-error");
-        $("btn-approve-tx").disabled = true;
+        setTxButtonBusy(true);
-        $("btn-approve-tx").classList.add("text-muted");
 
-        runtime.sendMessage(
+        const active = findActiveWallet();
-            {
+        if (!active) {
-                type: "AUTISTMASK_TX_RESPONSE",
+            password = null;
-                id: approvalId,
+            showError(
-                approved: true,
+                "approve-tx-error",
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
+                "No wallet was found for the active address.",
-                password: password,
+            );
-            },
+            setTxButtonBusy(false);
-            (response) => {
+            return;
-                if (response && response.txHash) {
+        }
-                    txStatus.showWait(pendingTxDetails, response.txHash);
+
-                } else {
+        const defect = walletDefect(active.wallet);
-                    const msg =
+        if (defect) {
-                        (response && response.error) || "Transaction failed.";
+            password = null;
-                    txStatus.showError(pendingTxDetails, null, msg);
+            showError("approve-tx-error", defect.shortMessage);
-                }
+            setTxButtonBusy(false);
-            },
+            return;
-        );
+        }
+
+        // Decrypt here, in the popup. The password must never cross the
+        // extension messaging boundary; only the signed transaction does.
+        let decryptedSecret;
+        try {
+            decryptedSecret = await decryptWithPassword(
+                active.wallet.encryptedSecret,
+                password,
+            );
+        } catch {
+            showError(
+                "approve-tx-error",
+                "That password is incorrect. Please try again.",
+            );
+            setTxButtonBusy(false);
+            return;
+        } finally {
+            // Best-effort: drop the password as soon as the key derivation
+            // is done. Note that JS strings are immutable; this clears the
+            // reference but the original string may persist until GC.
+            password = null;
+        }
+
+        const payload = {
+            type: "AUTISTMASK_TX_RESPONSE",
+            id: approvalId,
+            approved: true,
+        };
+        try {
+            const signer = getSignerForAddress(
+                active.wallet,
+                active.addrIndex,
+                decryptedSecret,
+            );
+            const provider = getProvider(state.rpcUrl);
+            const connected = signer.connect(provider);
+            // This is the sequence ethers' own sendTransaction() runs
+            // internally, so nonce, gas, fee and chain id population are
+            // identical to when the background did the signing.
+            const populated =
+                await connected.populateTransaction(pendingTxParams);
+            delete populated.from;
+            payload.rawSignedTx = await connected.signTransaction(populated);
+        } catch (e) {
+            payload.error =
+                e.shortMessage || e.message || "Transaction signing failed.";
+        } finally {
+            // Best-effort: clear the decrypted secret after use, with the
+            // same immutability caveat as the password above.
+            decryptedSecret = null;
+        }
+
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.txHash) {
+                txStatus.showWait(pendingTxDetails, response.txHash);
+                return;
+            }
+            // A retryable failure leaves the approval pending in the
+            // background, so stay on this screen with a live button rather
+            // than sending the user to a dead end.
+            const outcome = describeSigningFailure(
+                response,
+                "The transaction could not be sent.",
+            );
+            if (outcome.retryable) {
+                showError("approve-tx-error", outcome.message);
+                setTxButtonBusy(false);
+            } else {
+                txStatus.showError(pendingTxDetails, null, outcome.message);
+            }
+        });
     });
 
     $("btn-reject-tx").addEventListener("click", () => {
@@ -469,36 +617,108 @@ function init(ctx) {
         window.close();
     });
 
-    $("btn-approve-sign").addEventListener("click", () => {
+    $("btn-approve-sign").addEventListener("click", async () => {
-        const password = $("approve-sign-password").value;
+        let password = $("approve-sign-password").value;
         if (!password) {
             showError("approve-sign-error", "Please enter your password.");
             return;
         }
         hideError("approve-sign-error");
-        $("btn-approve-sign").disabled = true;
+        setSignButtonBusy(true);
-        $("btn-approve-sign").classList.add("text-muted");
 
-        runtime.sendMessage(
+        const active = findActiveWallet();
-            {
+        if (!active) {
-                type: "AUTISTMASK_SIGN_RESPONSE",
+            password = null;
-                id: approvalId,
+            showError(
-                approved: true,
+                "approve-sign-error",
-                // TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
+                "No wallet was found for the active address.",
-                password: password,
+            );
-            },
+            setSignButtonBusy(false);
-            (response) => {
+            return;
-                if (response && response.signature) {
+        }
-                    window.close();
+
-                } else {
+        const defect = walletDefect(active.wallet);
-                    const msg =
+        if (defect) {
-                        (response && response.error) || "Signing failed.";
+            password = null;
-                    showError("approve-sign-error", msg);
+            showError("approve-sign-error", defect.shortMessage);
-                    $("btn-approve-sign").disabled = false;
+            setSignButtonBusy(false);
-                    $("btn-approve-sign").classList.remove("text-muted");
+            return;
-                }
+        }
-            },
+
-        );
+        // Decrypt here, in the popup. The password must never cross the
+        // extension messaging boundary; only the signature does.
+        let decryptedSecret;
+        try {
+            decryptedSecret = await decryptWithPassword(
+                active.wallet.encryptedSecret,
+                password,
+            );
+        } catch {
+            showError(
+                "approve-sign-error",
+                "That password is incorrect. Please try again.",
+            );
+            setSignButtonBusy(false);
+            return;
+        } finally {
+            // Best-effort: drop the password as soon as the key derivation
+            // is done. Note that JS strings are immutable; this clears the
+            // reference but the original string may persist until GC.
+            password = null;
+        }
+
+        const payload = {
+            type: "AUTISTMASK_SIGN_RESPONSE",
+            id: approvalId,
+            approved: true,
+        };
+        try {
+            const signer = getSignerForAddress(
+                active.wallet,
+                active.addrIndex,
+                decryptedSecret,
+            );
+            const sp = pendingSignParams;
+            if (sp.method === "personal_sign" || sp.method === "eth_sign") {
+                payload.signature = await signer.signMessage(
+                    getBytes(sp.message),
+                );
+            } else {
+                // eth_signTypedData_v4 / eth_signTypedData
+                const typedData = JSON.parse(sp.typedData);
+                const { domain, types, message } = typedData;
+                // ethers handles EIP712Domain internally
+                delete types.EIP712Domain;
+                payload.signature = await signer.signTypedData(
+                    domain,
+                    types,
+                    message,
+                );
+            }
+        } catch (e) {
+            payload.error = e.shortMessage || e.message || "Signing failed.";
+        } finally {
+            // Best-effort: clear the decrypted secret after use, with the
+            // same immutability caveat as the password above.
+            decryptedSecret = null;
+        }
+
+        runtime.sendMessage(payload, (response) => {
+            if (response && response.signature) {
+                window.close();
+                return;
+            }
+            // The button comes back only when the approval is still pending in
+            // the background; otherwise it stays disabled and the message says
+            // why, because a control that cannot succeed must not look like it
+            // can.
+            const outcome = describeSigningFailure(
+                response,
+                "The message could not be signed.",
+            );
+            showError("approve-sign-error", outcome.message);
+            if (outcome.retryable) setSignButtonBusy(false);
+        });
     });
 
     $("btn-reject-sign").addEventListener("click", () => {

src/popup/views/confirmTx.js

@@ -21,6 +21,7 @@ const {
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
+    onViewLeave,
 } = require("./helpers");
 const { state, currentNetwork } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
@@ -32,11 +33,24 @@ const {
     getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
+const {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    feeReserveWei,
+    feeEstimateWei,
+    validateTransfer,
+} = require("../../shared/txValidation");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 
 let pendingTx = null;
+// Network fee for the transaction currently on screen. Reset by show() and
+// filled in by estimateGas() when the estimate resolves or fails.
+let feeStatus = FEE_PENDING;
+let feeWei = null;
 
 function restore() {
     const d = state.viewData;
@@ -67,6 +81,8 @@ function valueWithUsd(text, usdAmount) {
 
 function show(txInfo) {
     pendingTx = txInfo;
+    feeStatus = FEE_PENDING;
+    feeWei = null;
 
     const isErc20 = txInfo.token !== "ETH";
     const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
@@ -153,50 +169,14 @@ function show(txInfo) {
         warningsEl.style.visibility = "hidden";
     }
 
-    // Check for errors
+    // The two fee messages are mutually exclusive per transaction type, and
-    const errors = [];
+    // the type is known here, before the first paint. Drop the one that can
-    if (isErc20) {
+    // never apply and reserve the space of the one that can, so the async
-        const tokenBal = parseFloat(txInfo.tokenBalance || "0");
+    // estimate landing later never moves anything.
-        if (parseFloat(txInfo.amount) > tokenBal) {
+    $("confirm-amount-fee-error").classList.toggle("hidden", isErc20);
-            errors.push(
+    $("confirm-gas-error").classList.toggle("hidden", !isErc20);
-                "Insufficient " +
-                    symbol +
-                    " balance. You have " +
-                    txInfo.tokenBalance +
-                    " " +
-                    symbol +
-                    " but are trying to send " +
-                    txInfo.amount +
-                    " " +
-                    symbol +
-                    ".",
-            );
-        }
-    } else if (parseFloat(txInfo.amount) > parseFloat(txInfo.balance)) {
-        errors.push(
-            "Insufficient balance. You have " +
-                txInfo.balance +
-                " ETH but are trying to send " +
-                txInfo.amount +
-                " ETH.",
-        );
-    }
 
-    const errorsEl = $("confirm-errors");
+    renderValidation(txInfo);
-    const sendBtn = $("btn-confirm-send");
-    if (errors.length > 0) {
-        errorsEl.innerHTML = errors
-            .map((e) => `<div class="text-xs">${e}</div>`)
-            .join("");
-        errorsEl.style.visibility = "visible";
-        sendBtn.disabled = true;
-        sendBtn.classList.add("text-muted");
-    } else {
-        errorsEl.innerHTML = "";
-        errorsEl.style.visibility = "hidden";
-        sendBtn.disabled = false;
-        sendBtn.classList.remove("text-muted");
-    }
 
     // Reset password field and error
     $("confirm-tx-password").value = "";
@@ -205,6 +185,7 @@ function show(txInfo) {
     // Gas estimate — show placeholder then fetch async
     $("confirm-fee").style.visibility = "visible";
     $("confirm-fee-amount").textContent = "Estimating...";
+    setVisible("confirm-fee-reserve", false);
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
     attachCopyHandlers("view-confirm-tx");
@@ -224,11 +205,101 @@ function show(txInfo) {
     checkRecipientHistory(txInfo);
 }
 
+// Render the balance check for the transaction on screen. Called once during
+// show() and again when the fee estimate resolves or fails. Every element it
+// touches already occupies its space, so re-running it never moves anything.
+function renderValidation(txInfo) {
+    const isErc20 = txInfo.token !== "ETH";
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
+
+    const { canSend, codes } = validateTransfer({
+        isErc20,
+        amount: txInfo.amount,
+        ethBalance: txInfo.balance,
+        tokenBalance: txInfo.tokenBalance,
+        feeStatus,
+        feeWei,
+    });
+
+    // Messages carrying the user's own numbers are built here; the fixed
+    // sentences live in the reserved elements in index.html.
+    const messages = [];
+    if (codes.includes(CODES.AMOUNT_INVALID)) {
+        messages.push("Please enter a valid amount to send.");
+    }
+    if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
+        messages.push(
+            "Insufficient " +
+                symbol +
+                " balance. You have " +
+                txInfo.tokenBalance +
+                " " +
+                symbol +
+                " but are trying to send " +
+                txInfo.amount +
+                " " +
+                symbol +
+                ".",
+        );
+    }
+    if (codes.includes(CODES.INSUFFICIENT_ETH)) {
+        messages.push(
+            "Insufficient balance. You have " +
+                txInfo.balance +
+                " ETH but are trying to send " +
+                txInfo.amount +
+                " ETH.",
+        );
+    }
+
+    const errorsEl = $("confirm-errors");
+    if (messages.length > 0) {
+        errorsEl.innerHTML = messages
+            .map((m) => `<div class="text-xs">${escapeHtml(m)}</div>`)
+            .join("");
+        errorsEl.style.visibility = "visible";
+    } else {
+        errorsEl.innerHTML = "";
+        errorsEl.style.visibility = "hidden";
+    }
+
+    setVisible(
+        "confirm-amount-fee-error",
+        codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
+    );
+    setVisible(
+        "confirm-gas-error",
+        codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
+    );
+    setVisible(
+        "confirm-fee-unknown-error",
+        codes.includes(CODES.FEE_UNAVAILABLE),
+    );
+
+    // While the estimate is in flight there is no error to show — the fee
+    // line already reads "Estimating..." — but sending stays blocked so a
+    // transaction the fee would break cannot be signed in the meantime.
+    const sendBtn = $("btn-confirm-send");
+    sendBtn.disabled = !canSend;
+    sendBtn.classList.toggle("text-muted", !canSend);
+}
+
+function setVisible(id, visible) {
+    $(id).style.visibility = visible ? "visible" : "hidden";
+}
+
+// A fee in wei as an ETH string, truncated to 6 decimal places.
+function formatFeeEth(wei) {
+    const parts = formatEther(wei).split(".");
+    const dec =
+        parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
+    return parts[0] + "." + dec + " ETH";
+}
+
 async function estimateGas(txInfo) {
     try {
         const provider = getProvider(state.rpcUrl);
         const feeData = await provider.getFeeData();
-        const gasPrice = feeData.gasPrice;
         let gasLimit;
 
         if (txInfo.token === "ETH") {
@@ -246,21 +317,55 @@ async function estimateGas(txInfo) {
             });
         }
 
-        const gasCostWei = gasLimit * gasPrice;
+        // What the node will require to be reserved, which is what the gate
-        const gasCostEth = formatEther(gasCostWei);
+        // must be: the send pins no fee fields, so it is broadcast as a
-        // Format to 6 significant decimal places
+        // type-2 transaction priced at maxFeePerGas.
-        const parts = gasCostEth.split(".");
+        const gasCostWei = feeReserveWei(gasLimit, feeData);
-        const dec =
+        if (gasCostWei === null) {
-            parts.length > 1
+            throw new Error("no usable gas price from the provider");
-                ? parts[1].slice(0, 6).replace(/0+$/, "") || "0"
+        }
-                : "0";
+        // What the transaction is expected to cost, which is a different and
-        const feeStr = parts[0] + "." + dec + " ETH";
+        // usually much smaller number. Both are shown: quoting only the
+        // reserve overstates the typical cost by roughly double on mainnet,
+        // and quoting only the estimate contradicts the balance check.
+        const estimateWei = feeEstimateWei(gasLimit, feeData);
+        // The user may have left this transaction while the estimate was in
+        // flight; a stale fee must not reach the screen or the balance check.
+        if (pendingTx !== txInfo) return;
+
         const ethPrice = getPrice("ETH");
-        const feeUsd = ethPrice ? parseFloat(gasCostEth) * ethPrice : null;
+        const usd = (wei) =>
-        $("confirm-fee-amount").textContent = valueWithUsd(feeStr, feeUsd);
+            ethPrice ? parseFloat(formatEther(wei)) * ethPrice : null;
+
+        if (estimateWei !== null && estimateWei < gasCostWei) {
+            $("confirm-fee-amount").textContent = valueWithUsd(
+                "~" + formatFeeEth(estimateWei),
+                usd(estimateWei),
+            );
+            $("confirm-fee-reserve").textContent =
+                "up to " + formatFeeEth(gasCostWei) + " reserved";
+            setVisible("confirm-fee-reserve", true);
+        } else {
+            // No spread to report: either there is no estimate, or the node
+            // quotes a gas price at or above maxFeePerGas, so the expected
+            // cost is not below the reserve. Show the reserve alone.
+            $("confirm-fee-amount").textContent = valueWithUsd(
+                formatFeeEth(gasCostWei),
+                usd(gasCostWei),
+            );
+            setVisible("confirm-fee-reserve", false);
+        }
+        feeStatus = FEE_KNOWN;
+        feeWei = gasCostWei;
+        renderValidation(txInfo);
     } catch (e) {
         log.errorf("gas estimation failed:", e.message);
+        if (pendingTx !== txInfo) return;
         $("confirm-fee-amount").textContent = "Unable to estimate";
+        setVisible("confirm-fee-reserve", false);
+        feeStatus = FEE_UNAVAILABLE;
+        feeWei = null;
+        renderValidation(txInfo);
     }
 }
 
@@ -286,7 +391,17 @@ async function checkRecipientHistory(txInfo) {
     }
 }
 
+// Drop the password from the DOM. Registered as the view-leave handler so
+// it does not sit in the hidden view once the screen navigates on — to the
+// wait screen after a send, or anywhere else the user goes.
+function clearPassword() {
+    $("confirm-tx-password").value = "";
+    hideError("confirm-tx-password-error");
+}
+
 function init(ctx) {
+    onViewLeave("confirm-tx", clearPassword);
+
     $("btn-confirm-send").addEventListener("click", async () => {
         const password = $("confirm-tx-password").value;
         if (!password) {
@@ -307,7 +422,10 @@ function init(ctx) {
                 password,
             );
         } catch (e) {
-            showError("confirm-tx-password-error", "Wrong password.");
+            showError(
+                "confirm-tx-password-error",
+                "That password is incorrect. Please try again.",
+            );
             return;
         }
 

src/popup/views/deleteAddress.js

@@ -0,0 +1,176 @@
+// Confirmation screen for removing one address from a wallet that derives
+// its addresses from an extended key.
+//
+// No password is asked for, unlike delete-wallet. A password gates the
+// disclosure or destruction of a secret, and this does neither: the address
+// is derived from key material the wallet still holds, so removing it only
+// stops the wallet tracking it. An explicit confirmation screen is the
+// proportionate treatment.
+
+const {
+    $,
+    showView,
+    showFlash,
+    goBack,
+    renderAddressHtml,
+    attachCopyHandlers,
+    addressHoldsFunds,
+    balanceLinesForAddress,
+} = require("./helpers");
+const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
+const { walletHasRecoveryPhrase } = require("../../shared/wallet");
+const { state, saveState } = require("../../shared/state");
+const {
+    canRemoveAddress,
+    removeAddressFromState,
+    broadcastActiveChanged,
+} = require("../../shared/walletDelete");
+
+// The wallet and address indices this screen is confirming, or null when it
+// is not confirming anything.
+let target = null;
+let ctx = null;
+
+function setFlash(msg) {
+    const el = $("delete-address-flash");
+    el.textContent = msg;
+    el.style.visibility = msg ? "visible" : "hidden";
+}
+
+// What it actually takes to get the address back, which is not what the
+// screen used to claim.
+//
+// Neither obvious route works: "+" derives the next unused index, because
+// wallet.nextIndex is a high-water mark and is deliberately not rewound; and
+// re-importing this wallet's key material is refused as a duplicate by
+// findWalletByXpub() for as long as the wallet is here. What remains is to
+// delete the whole wallet in Settings — which asks for the password and
+// destroys the stored secret — and import again, after which
+// scanForAddresses() rediscovers the address only if it has on-chain
+// activity. An address that was never used is not found by that scan, and
+// the copy must not imply otherwise.
+//
+// The noun follows the wallet: an xprv wallet holds no recovery phrase, and
+// this screen is offered on xprv wallets too.
+function recoveryPathText(wallet) {
+    const secret = walletHasRecoveryPhrase(wallet)
+        ? "recovery phrase"
+        : "extended private key";
+    return (
+        "Getting the address back into this list is not easy, so be sure. " +
+        "Adding an address derives the next unused one, not this one, and " +
+        "importing this " +
+        secret +
+        " again is refused while this wallet is still here. The way back is " +
+        "to delete the whole wallet in Settings, which asks for your " +
+        "password and destroys the stored " +
+        secret +
+        ", and then import that " +
+        secret +
+        " again. The scan that follows only finds addresses that have " +
+        "on-chain activity, so an address that has never been used is not " +
+        "found by it."
+    );
+}
+
+// The balance warning, or a blank line when the address holds nothing.
+//
+// A balance is a reason to be careful, not a reason to refuse: the funds are
+// at the address, not in this list, and stay there either way.
+//
+// "Holds" means ETH or any ERC-20 the wallet knows about — an address with no
+// ETH and a five-figure stablecoin position must not get the blank line on
+// the one screen whose job is to warn. The sentence names no figure of its
+// own: the rendered lines round to four decimals, so a sentence built from a
+// rounded number would report "0.0000 ETH" for an address holding real money.
+// The lines below it carry the amounts, in the same format as Home and
+// AddressDetail, followed by the USD total when prices are known (null on
+// testnet and before the first price fetch, where the line is left off rather
+// than printed as $0.00).
+function balanceWarningHtml(addr) {
+    if (!addressHoldsFunds(addr)) return " ";
+    const usd = getAddressValueUsd(addr);
+    const total =
+        usd === null
+            ? ""
+            : `<div class="text-xs text-muted mt-1">Total: ${formatUsd(usd)}</div>`;
+    return (
+        `<p class="mb-1">This address holds a balance. Removing it does not ` +
+        `move or spend anything; the balance stays at the address.</p>` +
+        balanceLinesForAddress(addr, state.trackedTokens, false) +
+        total
+    );
+}
+
+function show(walletIdx, addrIdx) {
+    const wallet = state.wallets[walletIdx];
+    const addr = wallet && wallet.addresses[addrIdx];
+    if (!addr) return;
+    target = { walletIdx, addrIdx };
+
+    $("delete-address-label").textContent = "Address " + (addrIdx + 1);
+    $("delete-address-wallet-name").textContent =
+        wallet.name || "Wallet " + (walletIdx + 1);
+
+    const value = $("delete-address-value");
+    value.innerHTML = renderAddressHtml(addr.address, {
+        ensName: addr.ensName,
+    });
+    attachCopyHandlers(value);
+
+    $("delete-address-recovery").textContent = recoveryPathText(wallet);
+    $("delete-address-balance").innerHTML = balanceWarningHtml(addr);
+
+    setFlash("");
+    showView("delete-address-confirm");
+}
+
+function init(_ctx) {
+    ctx = _ctx;
+
+    $("btn-delete-address-back").addEventListener("click", () => {
+        target = null;
+        goBack();
+    });
+
+    $("btn-delete-address-confirm").addEventListener("click", async () => {
+        if (target === null) {
+            setFlash("No address is selected for removal.");
+            return;
+        }
+
+        const { walletIdx, addrIdx } = target;
+        if (!canRemoveAddress(state.wallets[walletIdx])) {
+            setFlash(
+                "This address cannot be removed, because a wallet always " +
+                    "keeps at least one address.",
+            );
+            return;
+        }
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            walletIdx,
+            addrIdx,
+        );
+        if (!removed) {
+            setFlash("This address could not be removed.");
+            return;
+        }
+
+        target = null;
+        // Save before broadcasting: the background reads the active address
+        // back out of storage to build accountsChanged.
+        await saveState();
+        if (activeAddressChanged) broadcastActiveChanged();
+
+        ctx.renderWalletList();
+        goBack();
+        showFlash("Address removed.");
+    });
+}
+
+// recoveryPathText and balanceWarningHtml are exported so the two pieces of
+// copy that carry the screen's substance can be tested without a DOM; show()
+// is a one-line assignment for each.
+module.exports = { init, show, recoveryPathText, balanceWarningHtml };

src/popup/views/deleteWallet.js

@@ -1,26 +1,49 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const {
+    $,
+    showView,
+    showFlash,
+    goBack,
+    clearViewStack,
+    onViewLeave,
+} = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
+const {
+    removeWalletFromState,
+    broadcastActiveChanged,
+} = require("../../shared/walletDelete");
 
 let deleteWalletIndex = null;
 let ctx = null;
 
+// Drop the password from the DOM and the wallet selection from the
+// closure. Registered as the view-leave handler as well as run on entry,
+// so the typed password does not sit in the hidden view after the user
+// navigates away by any route, including the Settings gear.
+function clear() {
+    deleteWalletIndex = null;
+    $("delete-wallet-password").value = "";
+    $("delete-wallet-flash").textContent = "";
+    $("delete-wallet-flash").style.visibility = "hidden";
+}
+
 function show(walletIdx) {
+    clear();
     deleteWalletIndex = walletIdx;
     const wallet = state.wallets[walletIdx];
     $("delete-wallet-name").textContent =
         wallet.name || "Wallet " + (walletIdx + 1);
-    $("delete-wallet-password").value = "";
-    $("delete-wallet-flash").textContent = "";
-    $("delete-wallet-flash").style.visibility = "hidden";
     showView("delete-wallet-confirm");
 }
 
 function init(_ctx) {
     ctx = _ctx;
 
+    onViewLeave("delete-wallet-confirm", clear);
+
+    // No wipe here: goBack() routes through showView(), which runs the
+    // leave hook.
     $("btn-delete-wallet-back").addEventListener("click", () => {
-        deleteWalletIndex = null;
         goBack();
     });
 
@@ -51,42 +74,32 @@ function init(_ctx) {
         try {
             await decryptWithPassword(wallet.encryptedSecret, pw);
         } catch (_e) {
-            $("delete-wallet-flash").textContent = "Wrong password.";
+            $("delete-wallet-flash").textContent =
+                "That password is incorrect. Please try again.";
             $("delete-wallet-flash").style.visibility = "visible";
             btn.disabled = false;
             btn.classList.remove("text-muted");
             return;
         }
 
-        // Collect addresses to clean up from allowedSites/deniedSites
+        // Remove the wallet and repair selection, permissions and hasWallet
-        const addresses = (wallet.addresses || []).map((a) => a.address);
+        const { activeAddressChanged } = removeWalletFromState(
-
+            state,
-        // Remove wallet
+            walletIdx,
-        state.wallets.splice(walletIdx, 1);
+        );
-
-        // Clean up site permissions for deleted addresses
-        for (const addr of addresses) {
-            delete state.allowedSites[addr];
-            delete state.deniedSites[addr];
-        }
 
         deleteWalletIndex = null;
 
-        if (state.wallets.length === 0) {
+        if (!state.hasWallet) {
-            // No wallets left — reset selection and show welcome
-            state.selectedWallet = null;
-            state.selectedAddress = null;
-            state.activeAddress = null;
             clearViewStack();
             await saveState();
+            // Save before broadcasting: the background reads the active
+            // address back out of storage to build accountsChanged.
+            if (activeAddressChanged) broadcastActiveChanged();
             showView("welcome");
         } else {
-            // Switch to first wallet if deleted wallet was active
-            state.selectedWallet = 0;
-            state.selectedAddress = 0;
-            state.activeAddress =
-                state.wallets[0].addresses[0]?.address || null;
             await saveState();
+            if (activeAddressChanged) broadcastActiveChanged();
             // Reset stack to [main] so Settings back goes home.
             // Use require() lazily to avoid circular dependency
             // (settings.js requires deleteWallet.js).

src/popup/views/exportPrivkey.js

@@ -0,0 +1,174 @@
+// Private key export for a single address.
+//
+// The key controls the address outright — anyone holding it can move every
+// token in it, from any device, forever — so this screen is handled under
+// the same rules as the recovery phrase screen (./showPhrase.js):
+//
+//   1. Nothing is decrypted, no key is derived, and nothing is written into
+//      the DOM until decryptWithPassword has accepted the password.
+//   2. Leaving the screen by any path wipes it, via the onViewLeave hook,
+//      and a decrypt still in flight when that happens is discarded
+//      instead of written (revealGeneration).
+//   3. The key never reaches the logger. This module deliberately does not
+//      import src/shared/log.js.
+//
+// The key is also never assigned to `state`, so it cannot be persisted to
+// extension storage, and "export-privkey" is excluded from RESTORABLE_VIEWS
+// so the popup can never reopen onto it.
+
+const {
+    $,
+    showView,
+    showFlash,
+    flashCopyFeedback,
+    goBack,
+    onViewLeave,
+    pushCurrentView,
+    renderAddressHtml,
+    attachCopyHandlers,
+} = require("./helpers");
+const { state } = require("../../shared/state");
+const { decryptWithPassword } = require("../../shared/vault");
+const { getSignerForAddress } = require("../../shared/wallet");
+const makeBlockie = require("ethereum-blockies-base64");
+
+const VIEW = "export-privkey";
+
+let walletIndex = null;
+let addressIndex = null;
+
+// Bumped by every clear(), which is what leaving the screen runs. reveal()
+// captures it before awaiting the decrypt and refuses to touch the DOM if
+// it has moved: a decrypt still in flight when the screen is left would
+// otherwise write the key *after* the wipe, with nothing scheduled to wipe
+// it again, leaving it in the hidden view for the life of the popup.
+let revealGeneration = 0;
+
+// True only if the reveal that captured `generation` is still the live one:
+// the screen has not been left, cleared, or re-entered for another address
+// since it started.
+function isCurrentReveal(generation) {
+    return (
+        generation === revealGeneration &&
+        walletIndex !== null &&
+        addressIndex !== null &&
+        state.currentView === VIEW
+    );
+}
+
+function fail(message) {
+    $("export-privkey-flash").textContent = message;
+    $("export-privkey-flash").style.visibility = "visible";
+}
+
+// Wipe every trace of the key and drop the address selection. Safe to call
+// when nothing was ever revealed, and safe to call twice.
+function clear() {
+    walletIndex = null;
+    addressIndex = null;
+    revealGeneration += 1;
+    $("export-privkey-value").textContent = "";
+    $("export-privkey-password").value = "";
+    $("export-privkey-result").classList.add("hidden");
+    $("export-privkey-password-section").classList.remove("hidden");
+    $("export-privkey-flash").textContent = "";
+    $("export-privkey-flash").style.visibility = "hidden";
+}
+
+function show(walletIdx, addrIdx) {
+    const wallet = state.wallets[walletIdx];
+    const addr = wallet && wallet.addresses[addrIdx];
+    if (!addr) {
+        showFlash("That address is no longer available.");
+        return;
+    }
+    clear();
+    walletIndex = walletIdx;
+    addressIndex = addrIdx;
+
+    const blockieEl = $("export-privkey-jazzicon");
+    blockieEl.innerHTML = "";
+    const img = document.createElement("img");
+    img.src = makeBlockie(addr.address);
+    img.width = 48;
+    img.height = 48;
+    img.style.imageRendering = "pixelated";
+    img.style.borderRadius = "50%";
+    blockieEl.appendChild(img);
+
+    $("export-privkey-title").textContent =
+        wallet.name + " — Address " + (addrIdx + 1);
+    const addrContainer = $("export-privkey-dot").parentElement;
+    addrContainer.innerHTML = renderAddressHtml(addr.address);
+    attachCopyHandlers(addrContainer);
+
+    // Pushed here rather than by the caller: this function can return
+    // without navigating, and a push that happened anyway would leave an
+    // entry on the stack that no screen transition matches.
+    pushCurrentView();
+    showView(VIEW);
+}
+
+async function reveal() {
+    const password = $("export-privkey-password").value;
+    if (!password) {
+        fail("Password is required.");
+        return;
+    }
+    if (walletIndex === null) {
+        fail("No address is selected.");
+        return;
+    }
+    const wallet = state.wallets[walletIndex];
+
+    const btn = $("btn-export-privkey-confirm");
+    btn.disabled = true;
+    btn.classList.add("text-muted");
+    const generation = revealGeneration;
+    try {
+        const secret = await decryptWithPassword(
+            wallet.encryptedSecret,
+            password,
+        );
+        // The only suspension point in this view, and the gate on the only
+        // place a secret is written: if the screen was left while the
+        // decrypt ran, the wipe has already happened, so the key is not
+        // even derived, let alone written.
+        if (!isCurrentReveal(generation)) return;
+        const signer = getSignerForAddress(wallet, addressIndex, secret);
+        $("export-privkey-password").value = "";
+        $("export-privkey-password-section").classList.add("hidden");
+        $("export-privkey-value").textContent = signer.privateKey;
+        $("export-privkey-result").classList.remove("hidden");
+        $("export-privkey-flash").textContent = "";
+        $("export-privkey-flash").style.visibility = "hidden";
+    } catch {
+        if (!isCurrentReveal(generation)) return;
+        fail("That password is incorrect. Please try again.");
+    } finally {
+        btn.disabled = false;
+        btn.classList.remove("text-muted");
+    }
+}
+
+function init() {
+    onViewLeave(VIEW, clear);
+
+    // No wipe here: goBack() routes through showView(), which runs the
+    // leave hook. A per-button wipe would only cover this one path.
+    $("btn-export-privkey-back").addEventListener("click", () => {
+        goBack();
+    });
+
+    $("btn-export-privkey-confirm").addEventListener("click", reveal);
+
+    $("export-privkey-value").addEventListener("click", () => {
+        const key = $("export-privkey-value").textContent;
+        if (!key) return;
+        navigator.clipboard.writeText(key);
+        showFlash("Copied!");
+        flashCopyFeedback($("export-privkey-value"));
+    });
+}
+
+module.exports = { init, show };

src/popup/views/helpers.js

@@ -25,14 +25,27 @@ const VIEWS = [
     "add-token",
     "settings",
     "delete-wallet-confirm",
+    "delete-address-confirm",
     "settings-addtoken",
     "transaction",
     "approve-site",
     "approve-tx",
     "approve-sign",
     "export-privkey",
+    "show-phrase",
 ];
 
+// Cleanup callbacks for views that hold a secret in the DOM. The view
+// registers one for itself and showView() runs it whenever that view is
+// navigated away from, so the secret is wiped no matter which control
+// caused the navigation — "Back", the settings gear, or a jump from
+// anywhere else. A per-button clear would only cover the one path.
+const viewLeaveHandlers = new Map();
+
+function onViewLeave(name, fn) {
+    viewLeaveHandlers.set(name, fn);
+}
+
 function $(id) {
     return document.getElementById(id);
 }
@@ -50,6 +63,11 @@ function hideError(id) {
 }
 
 function showView(name) {
+    const leaving = state.currentView;
+    if (leaving && leaving !== name) {
+        const onLeave = viewLeaveHandlers.get(leaving);
+        if (onLeave) onLeave();
+    }
     for (const v of VIEWS) {
         const el = document.getElementById(`view-${v}`);
         if (el) {
@@ -200,6 +218,20 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     return html;
 }
 
+// Whether an address holds anything at all: ETH or any ERC-20 the wallet
+// knows about. Deliberately unrounded — the rendered lines round to four
+// decimals, so a dust balance displays as 0.0000 while still being real
+// money at a real address. Callers that warn about holdings must ask this,
+// not the rendered figure.
+function addressHoldsFunds(addr) {
+    if (!addr) return false;
+    if (parseFloat(addr.balance || "0") > 0) return true;
+    for (const t of addr.tokenBalances || []) {
+        if (parseFloat(t.balance || "0") > 0) return true;
+    }
+    return false;
+}
+
 // Truncate the middle of a string, replacing removed characters with "…".
 // Safety: refuses to truncate more than 10 characters, which is the maximum
 // that still prevents address spoofing attacks (see Display Consistency in
@@ -431,10 +463,12 @@ function flashCopyFeedback(el) {
 }
 
 module.exports = {
+    VIEWS,
     $,
     showError,
     hideError,
     showView,
+    onViewLeave,
     updateDebugBanner,
     setRenderMain,
     pushCurrentView,
@@ -444,6 +478,7 @@ module.exports = {
     flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
+    addressHoldsFunds,
     addressColor,
     addressDotHtml,
     escapeHtml,

src/popup/views/home.js

@@ -21,6 +21,11 @@ const {
     resetSendValidation,
 } = require("./send");
 const { deriveAddressFromXpub } = require("../../shared/wallet");
+const { canRemoveAddress } = require("../../shared/walletDelete");
+const {
+    walletDefect,
+    walletDefectHtml,
+} = require("../../shared/walletDefects");
 const {
     formatUsd,
     getPrice,
@@ -163,6 +168,7 @@ async function loadHomeTxs(ctx) {
     if (allAddresses.length === 0) return;
 
     const filters = {
+        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,
@@ -213,30 +219,34 @@ async function loadHomeTxs(ctx) {
     }
 }
 
-function render(ctx) {
+// The wallet list markup. Pure: it reads state and returns a string, so the
-    const container = $("wallet-list");
+// list can be asserted on without a DOM.
-    if (state.wallets.length === 0) {
+function walletListHtml() {
-        container.innerHTML =
-            '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
-        renderTotalValue();
-        renderActiveAddress();
-        return;
-    }
-
     let html = "";
     state.wallets.forEach((wallet, wi) => {
+        const defect = walletDefect(wallet);
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
-        if (wallet.type === "hd" || wallet.type === "xprv") {
+        // No "+" on a defective wallet: deriving another address from that
+        // xpub would only add one more address the key does not produce
+        // under the standard path.
+        if (!defect && (wallet.type === "hd" || wallet.type === "xprv")) {
             html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
         }
         html += `</div>`;
+        html += walletDefectHtml(wallet);
 
         wallet.addresses.forEach((addr, ai) => {
             html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
             const isActive = state.activeAddress === addr.address;
             const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
+            // Only where a wallet can spare the address: a wallet holding a
+            // single address has no remove control, because its last address
+            // is never removable.
+            const removeBtn = canRemoveAddress(wallet)
+                ? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1" style="padding:0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
+                : "";
             const dot = addressDotHtml(addr.address);
             const titleBold = isActive ? "font-bold" : "";
             html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
@@ -245,7 +255,7 @@ function render(ctx) {
             }
             html += `<div class="flex text-xs items-center justify-between">`;
             html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
-            html += `<span class="flex-shrink-0 ml-1">${infoBtn}</span>`;
+            html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
             html += `</div>`;
             const addrUsd = formatUsd(getAddressValueUsd(addr));
             html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || "&nbsp;"}</div>`;
@@ -259,7 +269,20 @@ function render(ctx) {
 
         html += `</div>`;
     });
-    container.innerHTML = html;
+    return html;
+}
+
+function render(ctx) {
+    const container = $("wallet-list");
+    if (state.wallets.length === 0) {
+        container.innerHTML =
+            '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
+        renderTotalValue();
+        renderActiveAddress();
+        return;
+    }
+
+    container.innerHTML = walletListHtml();
 
     container.querySelectorAll(".address-row").forEach((row) => {
         row.addEventListener("click", async () => {
@@ -288,6 +311,16 @@ function render(ctx) {
         });
     });
 
+    container.querySelectorAll(".btn-remove-address").forEach((btn) => {
+        btn.addEventListener("click", (e) => {
+            e.stopPropagation();
+            ctx.showDeleteAddress(
+                parseInt(btn.dataset.wallet, 10),
+                parseInt(btn.dataset.address, 10),
+            );
+        });
+    });
+
     container.querySelectorAll(".btn-add-address").forEach((btn) => {
         btn.addEventListener("click", async (e) => {
             e.stopPropagation();
@@ -347,6 +380,13 @@ function render(ctx) {
     loadHomeTxs(ctx);
 }
 
+// The defect of the wallet the selected address belongs to, or null. Call
+// after selectActiveAddress().
+function selectedWalletDefect() {
+    if (state.selectedWallet === null) return null;
+    return walletDefect(state.wallets[state.selectedWallet]);
+}
+
 function selectActiveAddress() {
     for (let wi = 0; wi < state.wallets.length; wi++) {
         for (let ai = 0; ai < state.wallets[wi].addresses.length; ai++) {
@@ -370,6 +410,13 @@ function init(ctx) {
             showFlash("No active address selected.");
             return;
         }
+        // Before the balance check and before any password is asked for: this
+        // wallet cannot sign at all, so the send screen is a dead end.
+        const defect = selectedWalletDefect();
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr = currentAddress();
         if (!addr.balance || parseFloat(addr.balance) === 0) {
             showFlash("Cannot send \u2014 zero balance.");
@@ -395,4 +442,4 @@ function init(ctx) {
     });
 }
 
-module.exports = { init, render };
+module.exports = { init, render, walletListHtml };

src/popup/views/send.js

@@ -12,7 +12,9 @@ const {
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
-const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
+const { resolveSymbol } = require("../../shared/tokenList");
+const { isLowHolderCount } = require("../../shared/holders");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { getAddress } = require("ethers");
 
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
@@ -115,14 +117,6 @@ function updateToValidation() {
     }
 }
 
-function isSpoofedToken(t) {
-    const upper = (t.symbol || "").toUpperCase();
-    if (!KNOWN_SYMBOLS.has(upper)) return false;
-    const legit = KNOWN_SYMBOLS.get(upper);
-    if (legit === null) return true;
-    return t.address.toLowerCase() !== legit;
-}
-
 function renderSendTokenSelect(addr) {
     const sel = $("send-token");
     sel.innerHTML = '<option value="ETH">ETH</option>';
@@ -130,9 +124,12 @@ function renderSendTokenSelect(addr) {
         (state.fraudContracts || []).map((a) => a.toLowerCase()),
     );
     for (const t of addr.tokenBalances || []) {
-        if (isSpoofedToken(t)) continue;
+        if (isSpoofedSymbol(t.symbol, t.address)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
-        if (state.hideLowHolderTokens && (t.holders || 0) < 1000) continue;
+        // An unknown holder count does not withhold a token the user holds:
+        // only a count the explorer actually reported as below the threshold
+        // does.  Otherwise a missing field makes a real asset unspendable.
+        if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
         const opt = document.createElement("option");
         opt.value = t.address;
         opt.textContent = t.symbol;

src/popup/views/settings.js

@@ -9,11 +9,17 @@ const {
     pushCurrentView,
 } = require("./helpers");
 const { applyTheme } = require("../theme");
+const {
+    DUST_THRESHOLD_MESSAGE,
+    parseDustThresholdGwei,
+} = require("../dustThreshold");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
+const showPhrase = require("./showPhrase");
+const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const {
     BUILD_VERSION,
     BUILD_LICENSE,
@@ -99,7 +105,14 @@ function renderWalletListSettings() {
         const name = escapeHtml(wallet.name || "Wallet " + (idx + 1));
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span class="settings-wallet-name cursor-pointer underline decoration-dashed" data-idx="${idx}">${name}</span>`;
+        html += `<span class="flex items-center gap-1 flex-shrink-0">`;
+        // Key and xprv wallets have no recovery phrase, so they are never
+        // offered the action at all.
+        if (walletHasRecoveryPhrase(wallet)) {
+            html += `<button class="btn-show-phrase border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}" title="Show recovery phrase">[recovery phrase]</button>`;
+        }
         html += `<button class="btn-delete-wallet border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
+        html += `</span>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -111,6 +124,15 @@ function renderWalletListSettings() {
         });
     });
 
+    container.querySelectorAll(".btn-show-phrase").forEach((btn) => {
+        btn.addEventListener("click", () => {
+            const idx = parseInt(btn.dataset.idx, 10);
+            // No pushCurrentView() here: showPhrase.show() refuses
+            // non-HD wallets and pushes only when it navigates.
+            showPhrase.show(idx);
+        });
+    });
+
     // Inline rename on click
     container.querySelectorAll(".settings-wallet-name").forEach((span) => {
         span.addEventListener("click", () => {
@@ -191,6 +213,7 @@ function renderSiteLists() {
 
 function init(ctx) {
     deleteWallet.init(ctx);
+    showPhrase.init();
 
     $("btn-save-rpc").addEventListener("click", async () => {
         const url = $("settings-rpc").value.trim();
@@ -284,6 +307,12 @@ function init(ctx) {
         applyTheme(state.theme);
     });
 
+    $("settings-hide-spoofed-symbols").checked = state.hideSpoofedSymbols;
+    $("settings-hide-spoofed-symbols").addEventListener("change", async () => {
+        state.hideSpoofedSymbols = $("settings-hide-spoofed-symbols").checked;
+        await saveState();
+    });
+
     $("settings-hide-low-holders").checked = state.hideLowHolderTokens;
     $("settings-hide-low-holders").addEventListener("change", async () => {
         state.hideLowHolderTokens = $("settings-hide-low-holders").checked;
@@ -304,11 +333,18 @@ function init(ctx) {
 
     $("settings-dust-threshold").value = state.dustThresholdGwei;
     $("settings-dust-threshold").addEventListener("change", async () => {
-        const val = parseInt($("settings-dust-threshold").value, 10);
+        const val = parseDustThresholdGwei($("settings-dust-threshold").value);
-        if (!isNaN(val) && val >= 0) {
+        // Rejected input is never coerced. The field is put back to the
+        // stored threshold so it never shows a value the wallet is not
+        // using, and the message says what the field wants so the snap-back
+        // is explained rather than silent.
+        if (val === null) {
+            showFlash(DUST_THRESHOLD_MESSAGE);
+        } else {
             state.dustThresholdGwei = val;
             await saveState();
         }
+        $("settings-dust-threshold").value = state.dustThresholdGwei;
     });
 
     $("settings-utc-timestamps").checked = state.utcTimestamps;

src/popup/views/showPhrase.js

@@ -0,0 +1,154 @@
+// Recovery phrase display for HD wallets.
+//
+// The phrase is the secret that owns every address in the wallet, so it is
+// handled under four rules:
+//
+//   1. Only an HD wallet reaches this screen (walletHasRecoveryPhrase).
+//   2. Nothing is decrypted, and nothing is written into the DOM, until
+//      decryptWithPassword has accepted the password.
+//   3. Leaving the screen by any path wipes it, via the onViewLeave hook,
+//      and a decrypt still in flight when that happens is discarded
+//      instead of written (revealGeneration).
+//   4. The phrase never reaches the logger. This module deliberately does
+//      not import src/shared/log.js, and the failed-decrypt path reports a
+//      fixed sentence rather than the caught error.
+//
+// The phrase is also never assigned to `state`, so it cannot be persisted
+// to extension storage, and "show-phrase" is excluded from RESTORABLE_VIEWS
+// so the popup can never reopen onto it.
+
+const {
+    $,
+    showView,
+    showFlash,
+    flashCopyFeedback,
+    goBack,
+    onViewLeave,
+    pushCurrentView,
+} = require("./helpers");
+const { state } = require("../../shared/state");
+const { decryptWithPassword } = require("../../shared/vault");
+const { walletHasRecoveryPhrase } = require("../../shared/wallet");
+
+const VIEW = "show-phrase";
+
+let walletIndex = null;
+
+// Bumped by every clear(), which is what leaving the screen runs. reveal()
+// captures it before awaiting the decrypt and refuses to touch the DOM if
+// it has moved: a decrypt still in flight when the screen is left would
+// otherwise write the phrase *after* the wipe, with nothing scheduled to
+// wipe it again, leaving it in the hidden view for the life of the popup.
+let revealGeneration = 0;
+
+// True only if the reveal that captured `generation` is still the live one:
+// the screen has not been left, cleared, or re-entered for another wallet
+// since it started.
+function isCurrentReveal(generation) {
+    return (
+        generation === revealGeneration &&
+        walletIndex !== null &&
+        state.currentView === VIEW
+    );
+}
+
+function fail(message) {
+    $("show-phrase-flash").textContent = message;
+    $("show-phrase-flash").style.visibility = "visible";
+}
+
+// Wipe every trace of the phrase and drop the wallet selection. Safe to
+// call when nothing was ever revealed, and safe to call twice.
+function clear() {
+    walletIndex = null;
+    revealGeneration += 1;
+    $("show-phrase-value").textContent = "";
+    $("show-phrase-password").value = "";
+    $("show-phrase-result").classList.add("hidden");
+    $("show-phrase-password-section").classList.remove("hidden");
+    $("show-phrase-flash").textContent = "";
+    $("show-phrase-flash").style.visibility = "hidden";
+}
+
+function show(walletIdx) {
+    const wallet = state.wallets[walletIdx];
+    if (!walletHasRecoveryPhrase(wallet)) {
+        showFlash("This wallet does not have a recovery phrase.");
+        return;
+    }
+    clear();
+    walletIndex = walletIdx;
+    $("show-phrase-wallet-name").textContent =
+        wallet.name || "Wallet " + (walletIdx + 1);
+    // Pushed here rather than by the caller: this function can return
+    // without navigating, and a push that happened anyway would leave an
+    // entry on the stack that no screen transition matches.
+    pushCurrentView();
+    showView(VIEW);
+}
+
+async function reveal() {
+    const password = $("show-phrase-password").value;
+    if (!password) {
+        fail("Please enter your password.");
+        return;
+    }
+    if (walletIndex === null) {
+        fail("No wallet is selected.");
+        return;
+    }
+    const wallet = state.wallets[walletIndex];
+    if (!walletHasRecoveryPhrase(wallet)) {
+        fail("This wallet does not have a recovery phrase.");
+        return;
+    }
+
+    const btn = $("btn-show-phrase-reveal");
+    btn.disabled = true;
+    btn.classList.add("text-muted");
+    const generation = revealGeneration;
+    try {
+        const phrase = await decryptWithPassword(
+            wallet.encryptedSecret,
+            password,
+        );
+        // The only suspension point in this view, and the only place a
+        // secret is written: if the screen was left while the decrypt ran,
+        // the wipe has already happened and this write must not land.
+        if (!isCurrentReveal(generation)) return;
+        $("show-phrase-password").value = "";
+        $("show-phrase-password-section").classList.add("hidden");
+        $("show-phrase-value").textContent = phrase;
+        $("show-phrase-result").classList.remove("hidden");
+        $("show-phrase-flash").textContent = "";
+        $("show-phrase-flash").style.visibility = "hidden";
+    } catch {
+        if (!isCurrentReveal(generation)) return;
+        // Deliberately not the caught error: the message is fixed so that
+        // nothing derived from the ciphertext or the attempt can surface.
+        fail("That password is incorrect. Please try again.");
+    } finally {
+        btn.disabled = false;
+        btn.classList.remove("text-muted");
+    }
+}
+
+function init() {
+    onViewLeave(VIEW, clear);
+
+    $("btn-show-phrase-back").addEventListener("click", () => {
+        goBack();
+    });
+
+    $("btn-show-phrase-reveal").addEventListener("click", reveal);
+
+    $("show-phrase-value").addEventListener("click", () => {
+        const phrase = $("show-phrase-value").textContent;
+        if (!phrase) return;
+        navigator.clipboard.writeText(phrase);
+        showFlash("Copied!");
+        flashCopyFeedback($("show-phrase-value"));
+    });
+}
+
+module.exports = { init, show };

src/popup/views/transactionDetail.js

@@ -7,6 +7,7 @@ const {
     showFlash,
     flashCopyFeedback,
     addressTitle,
+    addressDotHtml,
     escapeHtml,
     isoDate,
     timeAgo,

src/popup/views/txStatus.js

@@ -16,11 +16,36 @@ const { state, saveState, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
+// Receipt poll cadence and the deadline after which the wait is reported as
+// a timeout. Both are documented in the WaitTx section of README.md.
+const POLL_INTERVAL_MS = 10000;
+const TIMEOUT_MS = 60000;
+
+// How many receipt lookups may fail in a row before the wait is ended and
+// the failure reported. A lookup that throws says nothing about the
+// transaction, so one must not end the wait — but an RPC that never answers
+// (a mistyped URL in settings is the ordinary case) must not leave the wait
+// running forever either, least of all a persisted one that every popup
+// open would resume. Six is 60 seconds at the poll cadence: the same
+// patience the confirmation deadline gets. Any lookup that answers, with a
+// receipt or with null, resets the count.
+const MAX_CONSECUTIVE_LOOKUP_FAILURES = 6;
+
 let ctx;
 let elapsedTimer = null;
 let pollTimer = null;
 
-function clearTimers() {
+// Identifies the wait currently on screen. Bumped by endWait(), so a timer
+// callback or an in-flight receipt lookup that outlives its wait can tell
+// that it is stale and leave the current view alone. Without it, a receipt
+// resolving after the wait has ended renders over whatever view replaced it.
+let waitId = 0;
+
+// End the wait on screen: stop its timers and invalidate its pending async
+// work. Called on receipt, on timeout, when a new wait starts, and when the
+// user navigates away.
+function endWait() {
+    waitId++;
     if (elapsedTimer) {
         clearInterval(elapsedTimer);
         elapsedTimer = null;
@@ -47,8 +72,13 @@ function blockNumberHtml(blockNumber) {
     return copyableHtml(num) + etherscanLinkHtml(link);
 }
 
-function showWait(txInfo, txHash) {
+// Render the wait view and start polling for the receipt. broadcastTime is
-    clearTimers();
+// when the transaction was broadcast, which is what the elapsed counter and
+// the timeout deadline are both measured from; pollNow runs one lookup
+// immediately instead of waiting a full poll interval.
+function startWait(txInfo, txHash, broadcastTime, pollNow) {
+    endWait();
+    const id = waitId;
 
     const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     $("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
@@ -56,41 +86,130 @@ function showWait(txInfo, txHash) {
     $("wait-tx-hash").innerHTML = txHashHtml(txHash);
     attachCopyHandlers("view-wait-tx");
 
-    const broadcastTime = Date.now();
+    // Persisted so closing and reopening the popup resumes this wait
-    $("wait-tx-status").textContent = "Waiting for confirmation... 0s";
+    // instead of silently abandoning it.
+    state.viewData = {
+        pendingWait: {
+            txInfo: txInfo,
+            hash: txHash,
+            broadcastTime: broadcastTime,
+        },
+    };
 
-    elapsedTimer = setInterval(() => {
+    function renderElapsed() {
         const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
         $("wait-tx-status").textContent =
             "Waiting for confirmation... " + elapsed + "s";
+    }
+    renderElapsed();
+
+    elapsedTimer = setInterval(() => {
+        if (id !== waitId) return;
+        renderElapsed();
     }, 1000);
 
     const provider = getProvider(state.rpcUrl);
-    pollTimer = setInterval(async () => {
+    let consecutiveFailures = 0;
+
+    async function poll() {
+        if (id !== waitId) return;
+        let receipt = null;
+        let answered = true;
         try {
-            const receipt = await provider.getTransactionReceipt(txHash);
+            receipt = await provider.getTransactionReceipt(txHash);
-            if (receipt) {
-                showSuccess(txInfo, txHash, receipt.blockNumber);
-            }
         } catch (e) {
+            // A thrown lookup means "no answer this tick", not "no
+            // receipt": the RPC failed, the chain said nothing. Declaring
+            // the timeout off it would report a confirmed transaction as
+            // failed — which matters most on a resumed wait, where the
+            // first poll is already past the deadline.
+            answered = false;
             log.errorf("poll receipt failed:", e.message);
         }
-
+        // The lookup is async: the wait may have ended while it was in
-        const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
+        // flight, in which case this result must not touch the view.
-        if (elapsed >= 60) {
+        if (id !== waitId) return;
+        // Exactly one outcome per wait. A receipt wins even on the tick
+        // that crosses the deadline, because the transaction did confirm.
+        if (receipt) {
+            showSuccess(txInfo, txHash, receipt.blockNumber);
+            return;
+        }
+        if (!answered) {
+            consecutiveFailures++;
+            // The failure is the user's news, and it is a different fact
+            // from "the transaction did not confirm" — the chain was never
+            // asked. Ending the wait here is what keeps it bounded and
+            // gives the user a Done button to leave by.
+            if (consecutiveFailures >= MAX_CONSECUTIVE_LOOKUP_FAILURES) {
+                showError(
+                    txInfo,
+                    txHash,
+                    "The network could not be reached to check this transaction — " +
+                        MAX_CONSECUTIVE_LOOKUP_FAILURES +
+                        " lookups failed in a row. Check the RPC URL in Settings. The transaction may still have confirmed — check Etherscan.",
+                );
+            }
+            // Otherwise keep polling: the next tick may answer.
+            return;
+        }
+        consecutiveFailures = 0;
+        if (Date.now() - broadcastTime >= TIMEOUT_MS) {
             showError(
                 txInfo,
                 txHash,
                 "Transaction was not confirmed within 60 seconds. It may still confirm later \u2014 check Etherscan.",
             );
         }
-    }, 10000);
+    }
+
+    pollTimer = setInterval(poll, POLL_INTERVAL_MS);
 
     showView("wait-tx");
+
+    if (pollNow) poll();
+}
+
+function showWait(txInfo, txHash) {
+    startWait(txInfo, txHash, Date.now(), false);
+}
+
+// Resume a wait persisted by a previous popup session. The deadline still
+// runs from the original broadcast, so a wait that has already outlived it
+// resolves on the immediate first poll rather than restarting the clock.
+// Returns false when there is nothing resumable to resume. Every field
+// startWait() goes on to use is validated, not just the presence of the
+// containers: txInfo.to reaches addressTitle(), which calls
+// address.toLowerCase(), and txInfo.amount is rendered into the summary, so
+// an object merely missing one of them throws a TypeError out of
+// restoreView() — which init() does not guard, skipping the rest of popup
+// init and leaving wait-tx on screen with no back control. A non-numeric
+// broadcastTime leaves an unexitable wait counting "NaNs". txInfo.token and
+// txInfo.tokenSymbol are deliberately unchecked: they are compared and
+// coalesced rather than dereferenced, and tokenSymbol is null for ETH.
+function restoreWait() {
+    const d = state.viewData;
+    if (!d || !d.pendingWait) return false;
+    const w = d.pendingWait;
+    if (!w.hash) return false;
+    // typeof [] is "object", so an array passes an object check.
+    const info = w.txInfo;
+    if (!info || typeof info !== "object" || Array.isArray(info)) return false;
+    // A string is the whole requirement: the empty string is what a
+    // contract-deployment approval persists (approval.js writes `to: toAddr
+    // || ""`), and both fields render harmlessly when empty, so refusing it
+    // would abandon a wait the live path itself created.
+    if (typeof info.to !== "string") return false;
+    if (typeof info.amount !== "string") return false;
+    if (typeof w.broadcastTime !== "number" || !isFinite(w.broadcastTime)) {
+        return false;
+    }
+    startWait(w.txInfo, w.hash, w.broadcastTime, true);
+    return true;
 }
 
 function showSuccess(txInfo, txHash, blockNumber) {
-    clearTimers();
+    endWait();
 
     const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
@@ -182,7 +301,7 @@ function renderSuccess() {
 }
 
 function showError(txInfo, txHash, message) {
-    clearTimers();
+    endWait();
 
     const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
     state.viewData = {
@@ -218,6 +337,9 @@ function isApprovalPopup() {
 }
 
 function navigateBack() {
+    // Nothing should still be polling by now, but leaving a view is the
+    // point at which its timers must be gone.
+    endWait();
     if (isApprovalPopup()) {
         window.close();
         return;
@@ -242,4 +364,12 @@ function init(_ctx) {
     $("btn-error-tx-done").addEventListener("click", navigateBack);
 }
 
-module.exports = { init, showWait, showError, renderSuccess, renderError };
+module.exports = {
+    init,
+    showWait,
+    restoreWait,
+    endWait,
+    showError,
+    renderSuccess,
+    renderError,
+};

src/shared/alarms.js

@@ -0,0 +1,114 @@
+// Periodic scheduling for the background context.
+//
+// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
+// which takes every setInterval/setTimeout with it. The extension alarms API
+// is the mechanism that survives: the browser holds the schedule and wakes
+// the worker to deliver onAlarm. Firefox MV2 runs a persistent background
+// page where timers would survive, but alarms behave identically there, so
+// both targets share this path and both manifests declare the "alarms"
+// permission.
+//
+// Periods are whole minutes at or above the browser-enforced one-minute
+// minimum, so nothing here is silently clamped to a slower cadence.
+//
+// Trap for anyone changing a period: each job also carries a freshness guard
+// that can veto its own scheduled tick. A guard timed to the alarm period
+// halves the real cadence, because the guard is measured from when the last
+// run finished and the alarm fires one run-duration earlier than that. Every
+// guard must therefore either be strictly shorter than the period it gates or
+// be bypassed on the scheduled tick — see backgroundRefresh() in
+// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
+
+const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
+const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
+
+const MIN_ALARM_PERIOD_MINUTES = 1;
+const BALANCE_REFRESH_PERIOD_MINUTES = 1;
+const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
+
+// Resolved on use rather than captured at module load: the worker is torn
+// down and re-evaluated repeatedly, and tests install a stub after requiring
+// the module.
+function alarmsApi() {
+    if (typeof browser !== "undefined" && browser.alarms) return browser.alarms;
+    if (typeof chrome !== "undefined" && chrome.alarms) return chrome.alarms;
+    return null;
+}
+
+/**
+ * Create an alarm unless one with the requested period already exists.
+ *
+ * The existence check is load-bearing: creating an alarm resets its schedule,
+ * and this runs on every worker wake. Creating unconditionally would push the
+ * next fire time out on every incoming message, so a busy extension would
+ * never see the alarm fire at all.
+ *
+ * The period comparison is equally load-bearing in the other direction: an
+ * alarm created by an older version keeps its old period forever unless a
+ * changed constant re-creates it, so a period edit would never reach an
+ * existing install. Re-creating on a period change happens once and then
+ * settles into the existence check above.
+ *
+ * @param {string} name
+ * @param {number} periodInMinutes
+ * @returns {Promise<boolean>} true if the alarm was created by this call.
+ */
+async function ensureAlarm(name, periodInMinutes) {
+    const api = alarmsApi();
+    if (!api) return false;
+    const period = Math.max(periodInMinutes, MIN_ALARM_PERIOD_MINUTES);
+    const existing = await api.get(name);
+    if (existing && existing.periodInMinutes === period) return false;
+    api.create(name, {
+        periodInMinutes: period,
+        delayInMinutes: period,
+    });
+    return true;
+}
+
+/**
+ * Ensure both recurring background jobs are scheduled. Safe to call on every
+ * worker start, on onInstalled and on onStartup.
+ *
+ * @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
+ * call had to create.
+ */
+async function ensureRecurringAlarms() {
+    const balance = await ensureAlarm(
+        BALANCE_REFRESH_ALARM,
+        BALANCE_REFRESH_PERIOD_MINUTES,
+    );
+    const phishing = await ensureAlarm(
+        PHISHING_REFRESH_ALARM,
+        PHISHING_REFRESH_PERIOD_MINUTES,
+    );
+    return { balance, phishing };
+}
+
+/**
+ * Register per-alarm handlers. One listener dispatches by alarm name so the
+ * worker only ever installs a single onAlarm listener.
+ *
+ * @param {Object<string, function>} handlers
+ * @returns {boolean} true if the listener was installed.
+ */
+function registerAlarmHandlers(handlers) {
+    const api = alarmsApi();
+    if (!api || !api.onAlarm) return false;
+    api.onAlarm.addListener((alarm) => {
+        const handler = handlers[alarm && alarm.name];
+        if (handler) handler();
+    });
+    return true;
+}
+
+module.exports = {
+    BALANCE_REFRESH_ALARM,
+    PHISHING_REFRESH_ALARM,
+    MIN_ALARM_PERIOD_MINUTES,
+    BALANCE_REFRESH_PERIOD_MINUTES,
+    PHISHING_REFRESH_PERIOD_MINUTES,
+    ensureAlarm,
+    ensureRecurringAlarms,
+    registerAlarmHandlers,
+};

src/shared/approvalVerify.js

@@ -0,0 +1,570 @@
+// Verification of the signed artifacts produced by the approval popup.
+//
+// Signing happens in the popup, where the password is entered; the background
+// only broadcasts the raw transaction and resolves the pending approval back
+// to the requesting page. So that moving the signing out of the background
+// does not turn the background into a blind relay, the background re-derives
+// the signer from the artifact and checks it against the approval it is
+// holding before acting on it. All recovery is delegated to ethers.
+//
+// The check is an allowlist, in both directions, because a denylist cannot be
+// correct against a transaction format that keeps gaining fields:
+//
+//  - only transaction types 0, 1 and 2 are accepted. Every later EIP-2718 type
+//    adds a field with consequences of its own — EIP-7702's authorizationList
+//    rewrites the code at the signer's own account, EIP-4844's blob
+//    commitments carry a separate fee — and a check that enumerates the fields
+//    it refuses admits every one of them by default.
+//  - after the per-field comparisons, the artifact is rebuilt from those
+//    checked fields and nothing else, and the two are compared byte for byte.
+//    Anything the artifact carries that this module does not name is absent
+//    from the rebuild and changes the bytes, so the final assertion is that
+//    the artifact *is* the approved transaction, not merely that it is not one
+//    of the tampered shapes that were thought of.
+//  - every comparison runs against the decode, but the string handed to
+//    broadcastTransaction() is the artifact. So the artifact is also required
+//    to be the canonical re-encoding of its own decode, which is what makes
+//    the checked transaction and the broadcast bytes the same object rather
+//    than two things that merely decode alike.
+//
+// Every consequential field is compared, and a mismatch is a refusal to act,
+// never a warning: what the user approved is what gets broadcast, or nothing
+// does.
+//
+// Fields the approval does not carry are not treated as zero. The popup
+// populates nonce, gas limit, fee and chain id through populateTransaction()
+// when the requesting page did not fix them, so there is no approved value to
+// compare against; treating absent as zero would refuse every legitimate
+// transaction. Those fields are instead held to the absolute ceilings below,
+// and the chain id is always checked against the selected network rather than
+// against the approval alone, which is what makes a cross-chain replay
+// impossible.
+//
+// Every failure message is a full sentence, because these strings are shown to
+// the user and returned to the dApp.
+
+const {
+    Transaction,
+    accessListify,
+    getAddress,
+    getBytes,
+    verifyMessage,
+    verifyTypedData,
+} = require("ethers");
+
+// The only transaction types this wallet signs: legacy, EIP-2930 and
+// EIP-1559. populateTransaction() produces nothing else, so nothing else can
+// be an artifact of an approval this wallet raised.
+const ALLOWED_TX_TYPES = [0, 1, 2];
+
+// The serialized fields of each allowed type, which is also the complete set
+// of fields the checks below compare or bound. The artifact is rebuilt from
+// exactly these at the end of verification and compared byte for byte, so a
+// field outside this table cannot ride along unexamined.
+const SERIALIZED_FIELDS = {
+    0: ["chainId", "nonce", "gasPrice", "gasLimit", "to", "value", "data"],
+    1: [
+        "chainId",
+        "nonce",
+        "gasPrice",
+        "gasLimit",
+        "to",
+        "value",
+        "data",
+        "accessList",
+    ],
+    2: [
+        "chainId",
+        "nonce",
+        "maxPriorityFeePerGas",
+        "maxFeePerGas",
+        "gasLimit",
+        "to",
+        "value",
+        "data",
+        "accessList",
+    ],
+};
+
+// Fields no allowed type may carry. The type allowlist already excludes every
+// type that defines them, and the structural check at the end of verification
+// would catch them anyway; they are named here so that an artifact carrying
+// one is refused with a message that says what it was.
+const FORBIDDEN_FIELDS = [
+    {
+        key: "authorizationList",
+        message:
+            "The signed transaction would hand the signing account over to another contract, which was not approved.",
+    },
+    {
+        key: "blobVersionedHashes",
+        message:
+            "The signed transaction carries blob commitments, which were not approved.",
+    },
+    {
+        key: "blobs",
+        message:
+            "The signed transaction carries blobs, which were not approved.",
+    },
+    {
+        key: "maxFeePerBlobGas",
+        message:
+            "The signed transaction carries a blob gas fee, which was not approved.",
+    },
+];
+
+// Above the block gas limit of every supported network (see networks.js), so
+// no transaction that could ever be included is refused by it.
+const MAX_GAS_LIMIT = 100000000n;
+
+// 100,000 gwei per gas: orders of magnitude above the highest fee either
+// supported network has produced, and low enough to catch a fee that would
+// hand the validator the balance.
+const MAX_FEE_PER_GAS = 100000000000000n;
+
+// A refusal to act on an artifact: it is not the thing that was approved, so
+// the approval it was offered against is spent and must not be retried. Every
+// throw in this module is one of these; the background distinguishes them from
+// transient failures (a busy node, a failed broadcast), which leave the
+// approval standing so the user can try again.
+class ApprovalMismatchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ApprovalMismatchError";
+        this.approvalMismatch = true;
+    }
+}
+
+function refuse(message) {
+    return new ApprovalMismatchError(message);
+}
+
+// Whether a signing failure leaves the approval usable. Anything that is not a
+// mismatch is the user's to correct and retry.
+function failureIsRetryable(err) {
+    return !(err && err.approvalMismatch === true);
+}
+
+// Case-insensitive address comparison that tolerates absent values on either
+// side. Two absent addresses compare equal (contract creation has no `to`).
+function sameAddress(a, b) {
+    const aMissing = a === null || a === undefined || a === "";
+    const bMissing = b === null || b === undefined || b === "";
+    if (aMissing || bMissing) return aMissing && bMissing;
+    try {
+        return getAddress(a) === getAddress(b);
+    } catch {
+        return String(a).toLowerCase() === String(b).toLowerCase();
+    }
+}
+
+// Whether the approval fixed a value for a field at all.
+function present(v) {
+    return v !== null && v !== undefined && v !== "";
+}
+
+// Whether a field carries anything at all. An empty array is nothing: ethers
+// reports an absent access list on a type 2 transaction as `[]`.
+function carriesValue(v) {
+    if (!present(v)) return false;
+    if (Array.isArray(v)) return v.length > 0;
+    return true;
+}
+
+// Normalize a quantity that must be present, refusing anything that is not a
+// number: an approval carrying junk in a fee field cannot be compared, and an
+// uncomparable field is a refusal rather than a pass.
+function normalizeQuantity(v, label) {
+    try {
+        return BigInt(v);
+    } catch {
+        throw refuse(
+            "The approved " +
+                label +
+                " is not a number, so it cannot be" +
+                " compared with the signed transaction.",
+        );
+    }
+}
+
+// Normalize a transaction value (hex string, decimal string, number or
+// bigint) to a bigint. An absent value is zero, matching ethers. The value is
+// page-controlled, so it goes through the same refusal as every other
+// quantity rather than throwing a raw BigInt conversion error.
+function normalizeValue(v) {
+    if (!present(v)) return 0n;
+    return normalizeQuantity(v, "value");
+}
+
+// Normalize an access list to a comparable string. An absent or empty list is
+// the empty string, so absent and `[]` are the same thing.
+function normalizeAccessList(v) {
+    if (!carriesValue(v)) return "";
+    let list;
+    try {
+        list = accessListify(v);
+    } catch {
+        throw refuse(
+            "The approved access list is not a valid access list, so it cannot be compared with the signed transaction.",
+        );
+    }
+    return list
+        .map(
+            (entry) =>
+                String(entry.address).toLowerCase() +
+                ":" +
+                entry.storageKeys.map((k) => String(k).toLowerCase()).join(","),
+        )
+        .join(";");
+}
+
+// Normalize call data to a lowercase hex string. Absent data is "0x".
+function normalizeData(v) {
+    if (v === null || v === undefined || v === "" || v === "0x") return "0x";
+    return String(v).toLowerCase();
+}
+
+// Quantity fields the requesting page may fix in the approval. Each is
+// compared exactly when the approval carries it, and left to the ceilings
+// above when it does not.
+const APPROVED_QUANTITIES = [
+    {
+        key: "nonce",
+        label: "nonce",
+        message: "The signed transaction does not carry the approved nonce.",
+    },
+    {
+        key: "gasLimit",
+        label: "gas limit",
+        message:
+            "The signed transaction does not carry the approved gas limit.",
+    },
+    {
+        key: "gasPrice",
+        label: "gas price",
+        message:
+            "The signed transaction does not carry the approved gas price.",
+    },
+    {
+        key: "maxFeePerGas",
+        label: "maximum fee per gas",
+        message:
+            "The signed transaction does not carry the approved maximum fee per gas.",
+    },
+    {
+        key: "maxPriorityFeePerGas",
+        label: "maximum priority fee per gas",
+        message:
+            "The signed transaction does not carry the approved maximum priority fee per gas.",
+    },
+];
+
+// Refuse a field only a transaction type this wallet does not sign can carry.
+// The type allowlist keeps these unreachable in production, which is exactly
+// what they are for; it also means nothing else exercises them, so this is
+// exported and tested on its own rather than left to be believed.
+function assertNoForbiddenFields(parsed) {
+    for (const field of FORBIDDEN_FIELDS) {
+        if (carriesValue(parsed[field.key])) throw refuse(field.message);
+    }
+}
+
+// Closing structural check. Rebuild the transaction from the fields the
+// comparisons cover, and nothing else, then compare the unsigned bytes. Every
+// field carried by the artifact but absent from the rebuild changes the
+// serialization, so this refuses anything this module does not account for —
+// including a field a future ethers learns to parse onto an allowed type —
+// instead of waving it through by not naming it. Also exported for its own
+// test: nothing reachable today can make the bytes differ.
+function assertNothingUnchecked(parsed) {
+    let rebuilt;
+    try {
+        const fields = { type: parsed.type };
+        for (const key of SERIALIZED_FIELDS[parsed.type]) {
+            fields[key] = parsed[key];
+        }
+        rebuilt = Transaction.from(fields);
+    } catch {
+        throw refuse(
+            "The signed transaction could not be rebuilt from the fields that were checked, so it cannot be shown to be the approved transaction.",
+        );
+    }
+    if (rebuilt.unsignedSerialized !== parsed.unsignedSerialized) {
+        throw refuse(
+            "The signed transaction carries data beyond the fields that were checked against the approval.",
+        );
+    }
+}
+
+// The other half of the closing check, and the one that makes it bind on the
+// bytes that actually leave: every comparison above runs against the decode,
+// so on its own the rebuild proves only that the transaction ethers understood
+// is the approved one. What the background hands to broadcastTransaction() is
+// the artifact string itself. Requiring the artifact to be exactly the
+// canonical re-encoding of its own decode closes the gap between the two —
+// no encoding the decoder normalizes away (a leading zero byte on an RLP
+// quantity, say) can differ from what was checked. Hex case is not part of the
+// encoding, so only that is normalized before comparing.
+function assertCanonicalBytes(parsed, rawSignedTx) {
+    if (parsed.serialized !== String(rawSignedTx).toLowerCase()) {
+        throw refuse(
+            "The signed transaction is not encoded canonically, so the bytes that would be broadcast are not the bytes that were checked.",
+        );
+    }
+}
+
+// Assert that a raw signed transaction is the transaction the user approved,
+// signed by the address the approval was raised for, on the network that is
+// selected. Returns the parsed ethers Transaction on success, throws
+// otherwise.
+function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
+    if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
+        throw refuse("The signed transaction is missing or malformed.");
+    }
+
+    let parsed;
+    try {
+        parsed = Transaction.from(rawSignedTx);
+    } catch {
+        throw refuse("The signed transaction could not be decoded.");
+    }
+
+    if (!parsed.from) {
+        throw refuse("The signed transaction carries no valid signature.");
+    }
+    if (!sameAddress(parsed.from, expectedFrom)) {
+        throw refuse(
+            "The signed transaction was signed by a different address than the one that was approved.",
+        );
+    }
+
+    // Before any field is looked at: the type decides which fields exist at
+    // all, so an unrecognised type is refused outright rather than compared
+    // field by field against an approval that cannot describe it.
+    if (!ALLOWED_TX_TYPES.includes(parsed.type)) {
+        throw refuse(
+            "The signed transaction is of a type this wallet does not sign, so what it would do beyond the approved transfer cannot be checked.",
+        );
+    }
+    assertNoForbiddenFields(parsed);
+
+    // The selected network, not the artifact, is the authority on which chain
+    // this may be broadcast to; without it nothing can be verified.
+    if (!present(selectedChainId)) {
+        throw refuse(
+            "The selected network is unknown, so the signed transaction cannot be checked against it.",
+        );
+    }
+    if (parsed.chainId !== normalizeQuantity(selectedChainId, "network")) {
+        throw refuse(
+            "The signed transaction is for a different network than the one that is selected.",
+        );
+    }
+    if (
+        present(txParams.chainId) &&
+        parsed.chainId !== normalizeQuantity(txParams.chainId, "network")
+    ) {
+        throw refuse(
+            "The signed transaction is for a different network than the one that was approved.",
+        );
+    }
+
+    if (!sameAddress(parsed.to, txParams.to)) {
+        throw refuse(
+            "The signed transaction does not go to the approved recipient.",
+        );
+    }
+    if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
+        throw refuse(
+            "The signed transaction does not carry the approved value.",
+        );
+    }
+    if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
+        throw refuse(
+            "The signed transaction does not carry the approved call data.",
+        );
+    }
+    if (
+        normalizeAccessList(parsed.accessList) !==
+        normalizeAccessList(txParams.accessList)
+    ) {
+        throw refuse(
+            "The signed transaction does not carry the approved access list.",
+        );
+    }
+
+    // An approval that fixed EIP-1559 fees must not be signed as a legacy
+    // transaction, and vice versa: the fee the user agreed to is only
+    // meaningful under the mechanism it was quoted in.
+    const approvedEip1559 =
+        present(txParams.maxFeePerGas) ||
+        present(txParams.maxPriorityFeePerGas);
+    const approvedLegacy = present(txParams.gasPrice);
+    const signedEip1559 = parsed.type === 2;
+    if (
+        (approvedEip1559 && !signedEip1559) ||
+        (approvedLegacy && signedEip1559)
+    ) {
+        throw refuse(
+            "The signed transaction does not use the approved fee mechanism.",
+        );
+    }
+
+    for (const field of APPROVED_QUANTITIES) {
+        if (!present(txParams[field.key])) continue;
+        const approved = normalizeQuantity(txParams[field.key], field.label);
+        if (normalizeQuantity(parsed[field.key], field.label) !== approved) {
+            throw refuse(field.message);
+        }
+    }
+
+    if (parsed.gasLimit > MAX_GAS_LIMIT) {
+        throw refuse(
+            "The signed transaction sets a gas limit no network this wallet supports can accept.",
+        );
+    }
+    for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
+        const fee = parsed[key];
+        if (fee !== null && fee !== undefined && fee > MAX_FEE_PER_GAS) {
+            throw refuse(
+                "The signed transaction sets a fee per gas far above any plausible value.",
+            );
+        }
+    }
+
+    assertNothingUnchecked(parsed);
+    assertCanonicalBytes(parsed, rawSignedTx);
+
+    return parsed;
+}
+
+// Assert that a signature over the approved message or typed data was
+// produced by the address the approval was raised for. Returns the recovered
+// address on success, throws otherwise.
+function verifySignature(signParams, signature, expectedFrom) {
+    if (typeof signature !== "string" || !signature.startsWith("0x")) {
+        throw refuse("The signature is missing or malformed.");
+    }
+
+    let recovered;
+    try {
+        if (
+            signParams.method === "personal_sign" ||
+            signParams.method === "eth_sign"
+        ) {
+            recovered = verifyMessage(getBytes(signParams.message), signature);
+        } else {
+            const typedData = JSON.parse(signParams.typedData);
+            const { domain, types, message } = typedData;
+            // ethers derives EIP712Domain itself and rejects it as an input.
+            delete types.EIP712Domain;
+            recovered = verifyTypedData(domain, types, message, signature);
+        }
+    } catch {
+        throw refuse("The signature could not be verified.");
+    }
+
+    if (!sameAddress(recovered, expectedFrom)) {
+        throw refuse(
+            "The signature was produced by a different address than the one that was approved.",
+        );
+    }
+
+    return recovered;
+}
+
+// The stage a transaction approval failed at. Which stage it is decides
+// whether the approval survives the failure.
+const TX_STAGE_SIGN = "sign";
+const TX_STAGE_VERIFY = "verify";
+const TX_STAGE_BROADCAST = "broadcast";
+// Not a failure of this request at all: a second response arrived for an
+// approval an attempt already holds. The first attempt is still running and
+// may yet succeed, so the one thing the popup must not say is "start again
+// from the site".
+const TX_STAGE_INFLIGHT = "inflight";
+
+function errorText(err) {
+    if (typeof err === "string" && err !== "") return err;
+    if (err && (err.shortMessage || err.message)) {
+        return err.shortMessage || err.message;
+    }
+    return "The transaction could not be sent.";
+}
+
+// What the background does with a pending transaction approval after a failed
+// attempt: what it tells the popup, and whether the approval is spent
+// (resolved to the requesting page as an error and deleted) or left standing
+// so the user can try the transaction they already saw again.
+//
+//  - sign: the popup could not produce an artifact, almost always a wrong
+//    password. Nothing left the extension, so the approval stands.
+//  - verify: a mismatch is a refusal and spends the approval — an artifact
+//    that is not the approved transaction must never be retried against that
+//    approval. Anything else failed before the check ran and is retryable.
+//  - broadcast: always terminal. A broadcast that throws after the node
+//    accepted the transaction is routine (a timeout, a dropped response, a
+//    node answering "already known"), and the popup's retry does not
+//    re-broadcast these bytes — it re-runs populateTransaction() and signs
+//    again at a freshly fetched pending-tag nonce. Retrying would therefore
+//    put a second transaction on the chain for one approval.
+function describeTxFailure(stage, err) {
+    const error = errorText(err);
+    const retryable =
+        stage === TX_STAGE_SIGN ||
+        (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
+    return { error, retryable, spendApproval: !retryable };
+}
+
+// What the popup shows and does after the background reports a failed signing
+// attempt. A retryable failure leaves the approval pending in the background,
+// so the button goes back to being usable; a refusal spent the approval, and
+// the popup says so rather than offering a button that cannot succeed.
+//
+// A failed broadcast gets its own wording: the transaction may already be on
+// the network, so telling the user to start again from the site is exactly the
+// wrong instruction.
+function describeSigningFailure(response, fallbackMessage) {
+    let message = (response && response.error) || fallbackMessage;
+    if (!/[.!?]$/.test(message)) message += ".";
+    const retryable = !!(response && response.retryable);
+    const stage = response && response.stage;
+    if (!retryable) {
+        if (stage === TX_STAGE_BROADCAST) {
+            message +=
+                " The transaction may still have reached the network." +
+                " Check the account before sending it again.";
+        } else if (stage === TX_STAGE_INFLIGHT) {
+            message +=
+                " The first attempt is still running and may still succeed." +
+                " Wait for it rather than starting again.";
+        } else {
+            message +=
+                " This request can no longer be signed. Please start it" +
+                " again from the site.";
+        }
+    }
+    return { message, retryable };
+}
+
+module.exports = {
+    verifySignedTx,
+    verifySignature,
+    assertNoForbiddenFields,
+    assertNothingUnchecked,
+    assertCanonicalBytes,
+    sameAddress,
+    failureIsRetryable,
+    describeTxFailure,
+    describeSigningFailure,
+    ApprovalMismatchError,
+    ALLOWED_TX_TYPES,
+    SERIALIZED_FIELDS,
+    FORBIDDEN_FIELDS,
+    TX_STAGE_SIGN,
+    TX_STAGE_VERIFY,
+    TX_STAGE_BROADCAST,
+    TX_STAGE_INFLIGHT,
+    MAX_GAS_LIMIT,
+    MAX_FEE_PER_GAS,
+};

src/shared/balances.js

@@ -11,7 +11,9 @@ const {
 const { ERC20_ABI } = require("./constants");
 const { log, debugFetch } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
-const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
+const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
+const { isSpoofedSymbol } = require("./symbolSpoof");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -70,23 +72,29 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
             if (bal === "0.0") continue;
 
             const tokenAddr = (item.token.address_hash || "").toLowerCase();
-            const holders = parseInt(item.token.holders_count || "0", 10);
+            // null means the explorer reported no count, which is not the
+            // same as a count of zero.  This gate is not the low-holder
+            // display filter: it has no user-facing off switch and governs
+            // the whole balance list, so it stays strict and admits a token
+            // only on a reported count — an unreported one is no evidence.
+            // A legitimate token still reaches the list through the known
+            // token list or by the user tracking it, and the null is carried
+            // through to the views, where the two low-holder filters treat
+            // an unknown count as "do not judge" rather than as zero.
+            const holders = parseHoldersCount(item.token.holders_count);
             const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
-            const hasEnoughHolders = holders >= 1000;
+            const hasEnoughHolders =
+                holders !== null && holders >= LOW_HOLDER_THRESHOLD;
 
             // Skip spam tokens the user never asked to see
             if (!isKnown && !isTracked && !hasEnoughHolders) continue;
 
-            // Skip tokens spoofing a known symbol from a different address
+            // Skip tokens spoofing a known symbol from a different address.
-            const sym = (item.token.symbol || "").toUpperCase();
+            // Every row here is an ERC-20 the explorer reported, so it has a
-            const legitAddr = KNOWN_SYMBOLS.get(sym);
+            // contract address; the native ETH balance is fetched over RPC in
-            if (
+            // refreshBalances and never passes through this loop.
-                legitAddr !== undefined &&
+            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
-                legitAddr !== null &&
-                tokenAddr !== legitAddr
-            )
-                continue;
 
             balances.push({
                 address: item.token.address_hash,
@@ -278,6 +286,7 @@ async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
 }
 
 module.exports = {
+    fetchTokenBalances,
     refreshBalances,
     lookupTokenInfo,
     getProvider,

src/shared/constants.js

@@ -7,6 +7,21 @@
 /* global __BUILD_DEBUG__ */
 const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
 
+// Machine-readable record of the compiled DEBUG state, read out of the emitted
+// bundles by script/verify-build. It is derived from DEBUG itself so the two
+// cannot disagree, and it is a plain string literal rather than a minifier
+// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
+// staying byte-stable across versions.
+//
+// The ambiguity is the point. When DEBUG is known at build time the bundler
+// folds this to exactly one of the two literals. When it is not — which is
+// exactly what happens if the __BUILD_DEBUG__ define goes missing from
+// build.js — the ternary survives, both literals appear in the bundle, and
+// verify-build fails rather than guessing.
+const BUILD_DEBUG_MARKER = DEBUG
+    ? "autistmask-build-debug=on"
+    : "autistmask-build-debug=off";
+
 const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 
@@ -44,6 +59,7 @@ function isBurnAddress(address) {
 
 module.exports = {
     DEBUG,
+    BUILD_DEBUG_MARKER,
     DEBUG_MNEMONIC,
     ETHEREUM_MAINNET_CHAIN_ID,
     ETHEREUM_SEPOLIA_CHAIN_ID,

src/shared/ens.js

@@ -1,6 +1,11 @@
 // Cached ENS reverse resolution.
 // Resolves addresses to ENS names via ethers provider.lookupAddress(),
 // caching results in localStorage with a 12-hour TTL.
+//
+// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
+// so this module must not be pulled into src/background/. Anything the
+// background context needs to cache goes in extension storage instead (see
+// shared/phishingDomains.js).
 
 const { getProvider } = require("./balances");
 const { log } = require("./log");

src/shared/holders.js

@@ -0,0 +1,32 @@
+// Holder counts, and the one rule that decides whether a count is "low".
+//
+// The block explorer's holders_count is optional: it is absent on a token it
+// has only just indexed, and it goes missing on a degraded or changed API.
+// Absent means the count is unknown.  It does not mean the token has no
+// holders, and collapsing the two hides a token the user really holds as if
+// it were spam.  Every call site reads the count through here so the
+// distinction cannot be lost again in one place while holding in the others.
+
+const LOW_HOLDER_THRESHOLD = 1000;
+
+// Parse an explorer-supplied holders_count into a number, or null when the
+// explorer did not report one.  Anything unparseable is unknown too: a count
+// we cannot read is not a count of zero.
+function parseHoldersCount(raw) {
+    if (raw === null || raw === undefined || raw === "") return null;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) ? n : null;
+}
+
+// True only for a token the explorer reported as having fewer holders than
+// the threshold.  An unknown count is never low: showing a spam token the
+// user can see is unusual costs less than hiding an asset they own.
+function isLowHolderCount(holders) {
+    return holders != null && holders < LOW_HOLDER_THRESHOLD;
+}
+
+module.exports = {
+    LOW_HOLDER_THRESHOLD,
+    parseHoldersCount,
+    isLowHolderCount,
+};

src/shared/phishingDomains.js

@@ -8,8 +8,14 @@
 // The domain-checker checks the in-memory delta first (fresh/recent scam
 // sites), then falls back to the vendored list.
 //
-// If the delta is under 256 KiB it is persisted to localStorage so it
+// If the delta and its fetch timestamp fit in 256 KiB they are persisted to
-// survives extension/service-worker restarts.
+// extension storage, so they survive termination of the MV3 service worker.
+// Extension storage, not localStorage: localStorage does not exist in a
+// service worker, so the previous persistence never ran on Chrome at all.
+// The stored timestamps are what keep a restarted worker from re-fetching on
+// every wake while still noticing an overdue update. Those guards apply to the
+// startup path only; the 24-hour alarm tick bypasses them, or it would veto
+// its own refresh — see updatePhishingList().
 
 const vendoredConfig = require("./phishingBlocklist.json");
 
@@ -17,7 +23,14 @@ const BLOCKLIST_URL =
     "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+// Floor on how often an unscheduled path may hit the network. The worker is
+// revived every ~30 seconds while the browser is busy, and every revival runs
+// the startup path; without a persisted record of the last attempt, any state
+// that leaves lastFetchTime unset — a fetch that failed, or a delta too large
+// to store — would download the full list on every single wake.
+const MIN_FETCH_ATTEMPT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+
 const DELTA_STORAGE_KEY = "phishing-delta";
 const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 
@@ -29,45 +42,104 @@ const vendoredBlacklist = new Set(
 // Delta set — only entries from live list that are NOT in vendored.
 let deltaBlacklist = new Set();
 let lastFetchTime = 0;
+let lastAttemptTime = 0;
 let fetchPromise = null;
-let refreshTimer = null;
+let loadPromise = null;
+
+// Resolved on use rather than captured at module load, so a test can install
+// a stub after requiring the module and so the popup — which has no reason to
+// touch the delta — does not fail to load where the API is absent.
+function storageApi() {
+    if (typeof browser !== "undefined" && browser.storage) {
+        return browser.storage.local;
+    }
+    if (typeof chrome !== "undefined" && chrome.storage) {
+        return chrome.storage.local;
+    }
+    return null;
+}
 
 /**
- * Load delta entries from localStorage on startup.
+ * Sanitise a timestamp read back from storage.
- * Called once during module initialization in the background script.
+ *
+ * A value in the future is permanent poison: every guard here measures elapsed
+ * time as `Date.now() - stamp` and tests only the lower bound, so a stamp a
+ * year ahead suppresses updates for a year with no path that ever clears it.
+ * Clock skew and a restored profile backup both produce one. Since these
+ * timestamps only ever gate work, discarding an impossible one is safe: it
+ * costs at most a single extra fetch and restores a sane value immediately.
+ *
+ * @param {unknown} value
+ * @returns {number} the timestamp, or 0 if it is unusable.
  */
-function loadDeltaFromStorage() {
+function sanitizeTimestamp(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+    if (value <= 0 || value > Date.now()) return 0;
+    return value;
+}
+
+/**
+ * Load the persisted delta and its timestamps from extension storage.
+ * Runs once per worker lifetime; every entry point funnels through
+ * ensureDeltaLoaded() so a wake from termination restores state exactly once.
+ *
+ * @returns {Promise<void>}
+ */
+async function loadDeltaFromStorage() {
+    const storage = storageApi();
+    if (!storage) return;
     try {
-        const raw = localStorage.getItem(DELTA_STORAGE_KEY);
+        const result = await storage.get(DELTA_STORAGE_KEY);
-        if (!raw) return;
+        const data = result && result[DELTA_STORAGE_KEY];
-        const data = JSON.parse(raw);
+        if (!data) return;
-        if (data.blacklist && Array.isArray(data.blacklist)) {
+        if (Array.isArray(data.blacklist)) {
             deltaBlacklist = new Set(
                 data.blacklist.map((d) => d.toLowerCase()),
             );
         }
+        lastFetchTime = sanitizeTimestamp(data.lastFetchTime);
+        lastAttemptTime = sanitizeTimestamp(data.lastAttemptTime);
     } catch {
-        // localStorage unavailable or corrupt — start empty
+        // Storage unavailable or corrupt — start empty and re-fetch.
     }
 }
 
+function ensureDeltaLoaded() {
+    if (!loadPromise) loadPromise = loadDeltaFromStorage();
+    return loadPromise;
+}
+
 /**
- * Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
+ * Persist the delta and its timestamps if they fit within MAX_DELTA_BYTES.
+ *
+ * The 256 KiB cap covers the delta and its freshness claim: when the delta is
+ * too large to keep, lastFetchTime goes with it, so the next start re-fetches
+ * rather than trusting a freshness claim for a delta it no longer holds.
+ * lastAttemptTime is written either way — it records that the network was
+ * contacted, which stays true whatever became of the response, and it is what
+ * stops a permanently oversized list from downloading on every worker wake.
+ *
+ * @returns {Promise<void>}
  */
-function saveDeltaToStorage() {
+async function saveDeltaToStorage() {
+    const storage = storageApi();
+    if (!storage) return;
     try {
         const data = {
             blacklist: Array.from(deltaBlacklist),
+            lastFetchTime,
+            lastAttemptTime,
         };
         const json = JSON.stringify(data);
         if (json.length < MAX_DELTA_BYTES) {
-            localStorage.setItem(DELTA_STORAGE_KEY, json);
+            await storage.set({ [DELTA_STORAGE_KEY]: data });
+        } else if (lastAttemptTime > 0) {
+            await storage.set({ [DELTA_STORAGE_KEY]: { lastAttemptTime } });
         } else {
-            // Too large — remove stale key if present
+            await storage.remove(DELTA_STORAGE_KEY);
-            localStorage.removeItem(DELTA_STORAGE_KEY);
         }
     } catch {
-        // localStorage unavailable — skip silently
+        // Storage unavailable — skip silently
     }
 }
 
@@ -76,6 +148,7 @@ function saveDeltaToStorage() {
  * Used for both live fetches and testing.
  *
  * @param {{ blacklist?: string[] }} config
+ * @returns {Promise<void>} resolves once the delta has been persisted.
  */
 function loadConfig(config) {
     const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
@@ -86,7 +159,7 @@ function loadConfig(config) {
     );
 
     lastFetchTime = Date.now();
-    saveDeltaToStorage();
+    return saveDeltaToStorage();
 }
 
 /**
@@ -111,6 +184,11 @@ function hostnameVariants(hostname) {
  * Check if a hostname is on the phishing blocklist.
  * Checks delta first (fresh/recent scam sites), then vendored list.
  *
+ * Synchronous by design — callers answer an approval prompt with it. On a
+ * worker that has just woken, the persisted delta may still be loading; the
+ * vendored list, which is bundled and always present, carries the check until
+ * it lands.
+ *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
  */
@@ -127,28 +205,59 @@ function isPhishingDomain(hostname) {
 
 /**
  * Fetch the latest blocklist and compute delta against vendored data.
- * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
+ * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS,
+ * counted from the persisted timestamp so the cache outlives the worker.
  *
+ * `force` is what makes the 24-hour alarm actually refresh every 24 hours.
+ * The alarm fires one period after the previous alarm, but lastFetchTime is
+ * stamped when that fetch *completed*, so an unforced tick lands one fetch
+ * latency inside its own TTL, skips, and turns the real cadence into 48 hours.
+ * Shortening the TTL instead would not fix it: the worker wakes every ~30
+ * seconds and the startup path re-checks the TTL each time, so a shortened TTL
+ * simply becomes the real cadence. The TTL is there to stop redundant fetches
+ * on wake, and the scheduled tick is not redundant, so it bypasses it.
+ *
+ * @param {{force?: boolean}} [opts] force: fetch unless one is already in
+ * flight, ignoring both the freshness and the retry guard. For the scheduled
+ * alarm tick only.
  * @returns {Promise<void>}
  */
-async function updatePhishingList() {
+async function updatePhishingList({ force = false } = {}) {
-    // Skip if recently fetched
+    // A worker that has just been revived knows nothing until the persisted
-    if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
+    // record is back in memory; without this the freshness check below would
-        return;
+    // always see 0 and re-fetch on every wake.
+    await ensureDeltaLoaded();
+
+    if (!force) {
+        const now = Date.now();
+        // Skip if recently fetched.
+        if (lastFetchTime > 0 && now - lastFetchTime < CACHE_TTL_MS) return;
+        // Skip if the network was contacted recently and the result was not
+        // usable — a failed fetch or an oversized delta leaves lastFetchTime
+        // unset, and without this every wake would retry.
+        if (
+            lastAttemptTime > 0 &&
+            now - lastAttemptTime < MIN_FETCH_ATTEMPT_INTERVAL_MS
+        ) {
+            return;
+        }
     }
 
     // De-duplicate concurrent calls
     if (fetchPromise) return fetchPromise;
 
     fetchPromise = (async () => {
+        lastAttemptTime = Date.now();
         try {
             const resp = await fetch(BLOCKLIST_URL);
             if (!resp.ok) throw new Error("HTTP " + resp.status);
             const config = await resp.json();
-            loadConfig(config);
+            await loadConfig(config);
         } catch {
-            // Silently fail — vendored list still provides coverage.
+            // Silently fail — vendored list still provides coverage. Persist
-            // We'll retry next time.
+            // the attempt so a persistently failing fetch is retried on the
+            // schedule rather than on every wake.
+            await saveDeltaToStorage();
         } finally {
             fetchPromise = null;
         }
@@ -158,12 +267,29 @@ async function updatePhishingList() {
 }
 
 /**
- * Start periodic refresh of the phishing list.
+ * Restore persisted state and fetch if the list is overdue.
- * Should be called once from the background script on startup.
+ *
+ * Called from the background script every time it starts — a fresh install,
+ * a browser start, and every revival of a terminated service worker all land
+ * here. The recurring 24-hour schedule itself is an alarm (see
+ * shared/alarms.js), not a timer, because timers die with the worker.
+ *
+ * @returns {Promise<void>}
  */
-function startPeriodicRefresh() {
+async function initPhishingList() {
-    if (refreshTimer) return;
+    await ensureDeltaLoaded();
-    refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
+    return updatePhishingList();
+}
+
+/**
+ * The 24-hour alarm tick. Separate from initPhishingList() because this is the
+ * scheduled refresh and must not be vetoed by the guards that exist to keep
+ * the unscheduled startup path off the network.
+ *
+ * @returns {Promise<void>}
+ */
+async function refreshPhishingListOnSchedule() {
+    return updatePhishingList({ force: true });
 }
 
 /**
@@ -190,21 +316,22 @@ function getDeltaSize() {
 function _reset() {
     deltaBlacklist = new Set();
     lastFetchTime = 0;
+    lastAttemptTime = 0;
     fetchPromise = null;
-    if (refreshTimer) {
+    loadPromise = null;
-        clearInterval(refreshTimer);
-        refreshTimer = null;
-    }
 }
 
-// Load persisted delta on module initialization
-loadDeltaFromStorage();
-
 module.exports = {
     isPhishingDomain,
     updatePhishingList,
-    startPeriodicRefresh,
+    refreshPhishingListOnSchedule,
+    initPhishingList,
+    loadDeltaFromStorage,
     loadConfig,
+    CACHE_TTL_MS,
+    MIN_FETCH_ATTEMPT_INTERVAL_MS,
+    DELTA_STORAGE_KEY,
+    MAX_DELTA_BYTES,
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,

src/shared/state.js

@@ -2,6 +2,8 @@
 
 const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
 const { networkById } = require("./networks");
+// Dependency-free constant module; safe to pull into a background bundle.
+const { RESTORABLE_VIEWS } = require("../popup/restorableViews");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -21,6 +23,7 @@ const DEFAULT_STATE = {
     deniedSites: {},
     rememberSiteChoice: true,
     showZeroBalanceTokens: true,
+    hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
     hideFraudContracts: true,
     hideDustTransactions: true,
@@ -42,6 +45,39 @@ const state = {
     viewStack: [],
 };
 
+// Keep only the leading run of stored views the popup is willing to render.
+//
+// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
+// behind it used to be restored verbatim, so Back could walk onto a screen
+// whose content is deliberately never re-rendered — and "show-phrase" has no
+// Back control to leave by. Truncating at the first such entry instead of
+// splicing it out keeps the result a prefix of the stored stack, so every
+// surviving entry's Back target is exactly the one it had; splicing would
+// silently re-point the entry above the hole at a different screen.
+//
+// Filtering happens here on load rather than in saveState(): the live
+// in-session stack is legitimate (the screen really is rendered while the
+// popup is open), and only a load-side filter also repairs the stacks
+// already in storage, including ones written before a view left the set.
+function restorableStack(stored, currentView) {
+    // A stored stack that is missing or not an array keeps nothing, but it
+    // still goes through the never-empty rule below rather than returning
+    // early: otherwise a corrupt stack would depend on exactly the goBack()
+    // fallback that the explicit ["main"] exists in order not to depend on.
+    const source = Array.isArray(stored) ? stored : [];
+    const cut = source.findIndex((view) => !RESTORABLE_VIEWS.has(view));
+    const kept = cut === -1 ? source.slice() : source.slice(0, cut);
+    // A view restored below the root still needs somewhere for Back to go.
+    if (
+        kept.length === 0 &&
+        currentView !== "main" &&
+        RESTORABLE_VIEWS.has(currentView)
+    ) {
+        return ["main"];
+    }
+    return kept;
+}
+
 // Return the network configuration for the currently selected network.
 function currentNetwork() {
     return networkById(state.networkId);
@@ -61,6 +97,7 @@ async function saveState() {
         deniedSites: state.deniedSites,
         rememberSiteChoice: state.rememberSiteChoice,
         showZeroBalanceTokens: state.showZeroBalanceTokens,
+        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,
@@ -84,8 +121,11 @@ async function loadState() {
     const result = await storageApi.get("autistmask");
     if (result.autistmask) {
         const saved = result.autistmask;
-        state.hasWallet = saved.hasWallet;
         state.wallets = saved.wallets || [];
+        // Derived, never read from storage: a profile persisted with the flag
+        // out of step with the wallet list would otherwise stay broken on
+        // every load. Nothing depends on the two disagreeing.
+        state.hasWallet = state.wallets.length > 0;
         state.trackedTokens = saved.trackedTokens || [];
         state.networkId = saved.networkId || DEFAULT_STATE.networkId;
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
@@ -109,6 +149,12 @@ async function loadState() {
             saved.showZeroBalanceTokens !== undefined
                 ? saved.showZeroBalanceTokens
                 : true;
+        // A profile written before this setting existed has no key for it.
+        // It is a safety filter, so absent must load as on, not as undefined.
+        state.hideSpoofedSymbols =
+            saved.hideSpoofedSymbols !== undefined
+                ? saved.hideSpoofedSymbols
+                : true;
         state.hideLowHolderTokens =
             saved.hideLowHolderTokens !== undefined
                 ? saved.hideLowHolderTokens
@@ -139,7 +185,7 @@ async function loadState() {
             saved.selectedAddress !== undefined ? saved.selectedAddress : null;
         state.selectedToken = saved.selectedToken || null;
         state.viewData = saved.viewData || {};
-        state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
+        state.viewStack = restorableStack(saved.viewStack, state.currentView);
     }
 }
 

src/shared/symbolSpoof.js

@@ -0,0 +1,43 @@
+// The known-symbol spoof rule, in one place.
+//
+// A token that borrows a known symbol from a contract that is not the one
+// that symbol belongs to is a spoof, and the wallet hides it.  Three surfaces
+// ask that question — the transaction history, the Send token selector and
+// the balance list — and they must answer it identically: a token the history
+// calls fake while the balance list lists it as a holding is worse than
+// either verdict alone, because the balance list is where the user forms
+// their belief about what they own (issue #235).
+//
+// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
+// bear it, or to null.  Null means the symbol belongs to the native asset,
+// which has no contract at all, so no contract may bear it and every one
+// that does is a spoof.  "ETH" is the only such entry today; the rule is
+// written so that a second one needs no change here or at any call site.
+
+const { KNOWN_SYMBOLS } = require("./tokenList");
+
+// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
+// over the address, not part of its identity.
+function normalizeAddress(addr) {
+    return (addr || "").toLowerCase();
+}
+
+// True when a token bearing `symbol` from contract `contractAddress` is
+// impersonating a known symbol.
+//
+// An empty contract address is the native asset, which is never a spoof:
+// this is what keeps the user's real ETH out of the rule, and it holds for
+// any symbol that becomes null-mapped later, not just for ETH.
+function isSpoofedSymbol(symbol, contractAddress) {
+    const contract = normalizeAddress(contractAddress);
+    if (!contract) return false;
+    const sym = (symbol || "").toUpperCase();
+    if (!KNOWN_SYMBOLS.has(sym)) return false;
+    const legit = KNOWN_SYMBOLS.get(sym);
+    if (legit === null) return true;
+    return contract !== normalizeAddress(legit);
+}
+
+module.exports = {
+    isSpoofedSymbol,
+};

src/shared/transactions.js

@@ -8,7 +8,17 @@
 
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
-const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
+const { parseHoldersCount, isLowHolderCount } = require("./holders");
+const { isSpoofedSymbol } = require("./symbolSpoof");
+
+// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
+// over the address, not part of its identity.  Every address comparison in
+// this file goes through this helper, so an address arriving in checksummed
+// or upper-case form can never be read as a different address.
+function normalizeAddress(addr) {
+    return (addr || "").toLowerCase();
+}
 
 function formatTxValue(val) {
     const parts = val.split(".");
@@ -30,10 +40,10 @@ function parseTx(tx, addrLower) {
     let exactValue = formatEther(rawWei);
     let rawAmount = rawWei;
     let rawUnit = "wei";
-    let direction = from.toLowerCase() === addrLower ? "sent" : "received";
+    let direction = normalizeAddress(from) === addrLower ? "sent" : "received";
     let directionLabel = direction === "sent" ? "Sent" : "Received";
     if (toIsContract && method && method !== "transfer") {
-        const token = TOKEN_BY_ADDRESS.get(to.toLowerCase());
+        const token = TOKEN_BY_ADDRESS.get(normalizeAddress(to));
         if (token) {
             symbol = token.symbol;
         }
@@ -87,7 +97,8 @@ function parseTokenTransfer(tt, addrLower) {
     const to = tt.to?.hash || "";
     const decimals = parseInt(tt.total?.decimals || "18", 10);
     const rawVal = tt.total?.value || "0";
-    const direction = from.toLowerCase() === addrLower ? "sent" : "received";
+    const direction =
+        normalizeAddress(from) === addrLower ? "sent" : "received";
     const sym = tt.token?.symbol || "?";
     return {
         hash: tt.transaction_hash,
@@ -104,18 +115,98 @@ function parseTokenTransfer(tt, addrLower) {
         direction: direction,
         directionLabel: direction === "sent" ? "Sent" : "Received",
         isError: false,
-        contractAddress: (
+        contractAddress: normalizeAddress(
-            tt.token?.address_hash ||
+            tt.token?.address_hash || tt.token?.address || "",
-            tt.token?.address ||
+        ),
-            ""
+        // null when the explorer reported no count: unknown, not zero.  The
-        ).toLowerCase(),
+        // low-holder filter declines to judge a null, so a legitimate token
-        holders: parseInt(tt.token?.holders_count || "0", 10),
+        // is not hidden because a field went missing upstream.
+        holders: parseHoldersCount(tt.token?.holders_count),
     };
 }
 
+// True when a parsed native entry moved no ETH.  Contract-call entries have
+// their amount fields blanked by parseTx, so they are never judged here.
+function movedNoEther(tx) {
+    if (tx.direction === "contract") return false;
+    return BigInt(tx.rawAmount || "0") === BigInt(0);
+}
+
+// Merge parsed normal transactions with parsed ERC-20 token transfers into
+// one row per distinct value movement.  Pure: it reads only its arguments
+// and returns a new list sorted newest block first.
+//
+// The merge key is the transaction hash for the native entry and
+// hash + token contract for each token transfer, so:
+//
+//   - A display-level contract call (a swap and friends, direction
+//     "contract") absorbs every token leg of its hash into the single
+//     native entry, because the legs are hops of one operation rather
+//     than separate movements the user made.
+//   - Otherwise each distinct token contract in the transaction keeps its
+//     own row, so a hash carrying several genuine transfers stays several
+//     rows.
+//   - The native entry of such a transaction is dropped when it moved no
+//     ETH and at least one token transfer shares its hash: that entry is
+//     the ERC-20 call itself, already represented by the token row.  A
+//     native entry that moved ETH survives alongside the token rows, since
+//     the ETH and the tokens are two real movements, and a zero-value
+//     native transaction with no token transfer on its hash survives too.
+function mergeTransactions(txs, tokenTransfers) {
+    const byKey = new Map();
+
+    // Entries are copied so consolidation never writes through to the
+    // caller's objects.
+    for (const tx of txs) {
+        byKey.set(tx.hash, { ...tx });
+    }
+
+    const absorbedHashes = new Set();
+
+    for (const parsed of tokenTransfers) {
+        const existing = byKey.get(parsed.hash);
+        if (existing && existing.direction === "contract") {
+            // For contract calls (swaps), consolidate into the original
+            // tx entry.  Prefer the "received" transfer (swap output)
+            // for the display amount.  If no received transfer exists,
+            // fall back to the first "sent" transfer (swap input).
+            const isReceived = parsed.direction === "received";
+            const needsAmount = !existing.exactValue;
+            if (isReceived || needsAmount) {
+                existing.value = parsed.value;
+                existing.exactValue = parsed.exactValue;
+                existing.rawAmount = parsed.rawAmount;
+                existing.rawUnit = parsed.rawUnit;
+                existing.symbol = parsed.symbol;
+                existing.contractAddress = parsed.contractAddress;
+                existing.holders = parsed.holders;
+            }
+            // Keep the original tx's from/to (the user's address and the
+            // contract they called), not the token transfer's from/to
+            // which may be a router or Permit2 contract.
+            continue;
+        }
+        if (existing && movedNoEther(existing)) {
+            absorbedHashes.add(parsed.hash);
+        }
+        // Every other token transfer gets its own entry.
+        byKey.set(parsed.hash + ":" + (parsed.contractAddress || ""), {
+            ...parsed,
+        });
+    }
+
+    for (const hash of absorbedHashes) {
+        byKey.delete(hash);
+    }
+
+    const merged = [...byKey.values()];
+    merged.sort((a, b) => b.blockNumber - a.blockNumber);
+    return merged;
+}
+
 async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     log.debugf("fetchRecentTransactions", address);
-    const addrLower = address.toLowerCase();
+    const addrLower = normalizeAddress(address);
 
     const [txResp, ttResp] = await Promise.all([
         debugFetch(blockscoutUrl + "/addresses/" + address + "/transactions"),
@@ -145,104 +236,62 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     const txJson = txResp.ok ? await txResp.json() : {};
     const ttJson = ttResp.ok ? await ttResp.json() : {};
 
-    const txsByHash = new Map();
+    const txs = mergeTransactions(
+        (txJson.items || []).map((tx) => parseTx(tx, addrLower)),
+        (ttJson.items || []).map((tt) => parseTokenTransfer(tt, addrLower)),
+    );
 
-    for (const tx of txJson.items || []) {
-        txsByHash.set(tx.hash, parseTx(tx, addrLower));
-    }
-
-    // When a token transfer shares a hash with a normal tx, the normal tx
-    // is the contract call (0 ETH) and the token transfer has the real
-    // amount and symbol.  For contract calls (swaps), a single transaction
-    // can produce multiple token transfers (input, intermediates, output).
-    // We consolidate these into the original tx entry using the token
-    // transfer where the user *receives* tokens (the swap output), so
-    // the transaction list shows the final result rather than confusing
-    // intermediate hops.  We preserve the original tx's from/to so the
-    // user sees their own address, not a router or Permit2 contract.
-    for (const tt of ttJson.items || []) {
-        const parsed = parseTokenTransfer(tt, addrLower);
-        const existing = txsByHash.get(parsed.hash);
-        if (existing && existing.direction === "contract") {
-            // For contract calls (swaps), consolidate into the original
-            // tx entry.  Prefer the "received" transfer (swap output)
-            // for the display amount.  If no received transfer exists,
-            // fall back to the first "sent" transfer (swap input).
-            const isReceived = parsed.direction === "received";
-            const needsAmount = !existing.exactValue;
-            if (isReceived || needsAmount) {
-                existing.value = parsed.value;
-                existing.exactValue = parsed.exactValue;
-                existing.rawAmount = parsed.rawAmount;
-                existing.rawUnit = parsed.rawUnit;
-                existing.symbol = parsed.symbol;
-                existing.contractAddress = parsed.contractAddress;
-                existing.holders = parsed.holders;
-            }
-            // Keep the original tx's from/to (the user's address and the
-            // contract they called), not the token transfer's from/to
-            // which may be a router or Permit2 contract.
-            continue;
-        }
-        // Non-contract token transfers get their own entries.
-        const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
-        txsByHash.set(ttKey, parsed);
-    }
-
-    const txs = [...txsByHash.values()];
-
-    txs.sort((a, b) => b.blockNumber - a.blockNumber);
     const result = txs.slice(0, count);
     log.debugf("fetchRecentTransactions done, count:", result.length);
     return result;
 }
 
-// Check if a token transfer is spoofing a known symbol.
-// Returns true if the symbol matches a known token but the contract
-// address doesn't match the legitimate one.
-function isSpoofedSymbol(tx) {
-    if (!tx.contractAddress) return false;
-    const symbol = (tx.symbol || "").toUpperCase();
-    if (!KNOWN_SYMBOLS.has(symbol)) return false;
-    const legit = KNOWN_SYMBOLS.get(symbol);
-    if (legit === null) return true; // "ETH" as ERC-20 is always fake
-    return tx.contractAddress !== legit;
-}
-
 // Pure filter function. Takes raw transactions and filter settings,
 // returns { transactions, newFraudContracts }.
 function filterTransactions(txs, filters = {}) {
     const fraudSet = new Set(
-        (filters.fraudContracts || []).map((a) => a.toLowerCase()),
+        (filters.fraudContracts || []).map(normalizeAddress),
     );
+    // The dust threshold defaults only when it is unset (nullish): a
+    // threshold of 0 is a real value meaning "hide nothing", since no
+    // transaction has a value below 0 gwei.  It is therefore equivalent to
+    // clearing the hide-dust checkbox, and the two controls cannot override
+    // each other in either direction.
+    const dustThresholdGwei = filters.dustThresholdGwei ?? 100000;
     const newFraud = [];
     const filtered = [];
+    // Fail-safe, unlike the three flags below: this one is off only when the
+    // caller says so explicitly, so a caller that omits the key keeps the
+    // check rather than silently losing it.  The setting also governs the
+    // blocklist learning below, which exists only to serve this check —
+    // leaving learning on while the check is off would re-hide the very rows
+    // the user asked to see, through the fraud-contract rule.
+    const hideSpoofed = filters.hideSpoofedSymbols !== false;
 
     for (const tx of txs) {
-        // Always filter spoofed known symbols and record the fraud contract
+        const contract = normalizeAddress(tx.contractAddress);
-        if (isSpoofedSymbol(tx)) {
+
-            if (tx.contractAddress && !fraudSet.has(tx.contractAddress)) {
+        // Filter spoofed known symbols and record the fraud contract
-                fraudSet.add(tx.contractAddress);
+        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
-                newFraud.push(tx.contractAddress);
+            if (contract && !fraudSet.has(contract)) {
+                fraudSet.add(contract);
+                newFraud.push(contract);
             }
             continue;
         }
 
         // Filter fraud contracts if setting is on
-        if (
+        if (filters.hideFraudContracts && contract && fraudSet.has(contract)) {
-            filters.hideFraudContracts &&
-            tx.contractAddress &&
-            fraudSet.has(tx.contractAddress)
-        ) {
             continue;
         }
 
-        // Filter low-holder tokens (<1000) if setting is on
+        // Filter low-holder tokens (<1000) if setting is on.  A token whose
+        // holder count the explorer did not report is kept: only a reported
+        // count below the threshold is "low".
         if (
             filters.hideLowHolderTokens &&
             tx.contractAddress &&
-            tx.holders !== null &&
+            isLowHolderCount(tx.holders)
-            tx.holders < 1000
         ) {
             continue;
         }
@@ -254,7 +303,7 @@ function filterTransactions(txs, filters = {}) {
             filters.hideDustTransactions &&
             !tx.isContractCall &&
             tx.valueGwei !== null &&
-            tx.valueGwei < (filters.dustThresholdGwei || 100000)
+            tx.valueGwei < dustThresholdGwei
         ) {
             continue;
         }
@@ -265,4 +314,8 @@ function filterTransactions(txs, filters = {}) {
     return { transactions: filtered, newFraudContracts: newFraud };
 }
 
-module.exports = { fetchRecentTransactions, filterTransactions };
+module.exports = {
+    fetchRecentTransactions,
+    filterTransactions,
+    mergeTransactions,
+};

src/shared/txValidation.js

@@ -0,0 +1,171 @@
+// Balance arithmetic for the transaction confirmation screen.
+//
+// Pure: no DOM, no network, no state. Everything is exact integer math on
+// 18-decimal fixed point (wei for ETH), so it can be unit tested directly
+// instead of through the confirmation view. The caller maps the returned
+// codes to the reserved message elements on the screen.
+//
+// Human decimal strings ("1.25") are scaled to 18 decimals for comparison.
+// That scale is independent of a token's own decimals: both the amount and
+// the token balance arrive as human decimal strings, so comparing them at a
+// common scale is exact.
+
+const { parseUnits } = require("ethers");
+
+const SCALE_DECIMALS = 18;
+
+// Whether the asynchronous fee estimate has arrived yet.
+const FEE_PENDING = "pending";
+const FEE_KNOWN = "known";
+const FEE_UNAVAILABLE = "unavailable";
+
+const CODES = {
+    // The amount is not a non-negative number we can do exact arithmetic on.
+    AMOUNT_INVALID: "amount-invalid",
+    // ERC-20: the token amount exceeds the token balance.
+    INSUFFICIENT_TOKEN: "insufficient-token",
+    // ETH: the amount alone already exceeds the ETH balance.
+    INSUFFICIENT_ETH: "insufficient-eth",
+    // ETH: the amount fits, the amount plus the network fee does not.
+    INSUFFICIENT_ETH_WITH_FEE: "insufficient-eth-with-fee",
+    // ERC-20: the token balance covers the transfer, the ETH balance does
+    // not cover the network fee it costs.
+    INSUFFICIENT_ETH_FOR_FEE: "insufficient-eth-for-fee",
+    // The fee estimate has not arrived yet.
+    FEE_PENDING: "fee-pending",
+    // The fee estimate failed. Unknown is never treated as zero.
+    FEE_UNAVAILABLE: "fee-unavailable",
+};
+
+// The fee that must be reserved for a transaction, in wei: the amount the
+// node will require, not the amount the transaction is expected to cost.
+//
+// A send that pins no fee fields is populated by ethers as a type-2
+// (EIP-1559) transaction, and a node validates that against
+// `value + gasLimit * maxFeePerGas`. ethers derives maxFeePerGas as
+// `baseFeePerGas * 2 + maxPriorityFeePerGas`, so reserving `gasPrice`
+// (roughly `baseFee + tip`) under-reserves by about `gasLimit * baseFee` and
+// lets through a transaction the node then rejects with "insufficient funds
+// for gas * price + value". gasPrice is the fallback only for a network that
+// offers no type-2 pricing at all.
+//
+// Returns null when no usable price is available, which the caller must treat
+// as a failed estimate rather than as a free transaction.
+function feeReserveWei(gasLimit, feeData) {
+    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
+    const price = feeData?.maxFeePerGas ?? feeData?.gasPrice;
+    if (typeof price !== "bigint" || price < 0n) return null;
+    return gasLimit * price;
+}
+
+// What the transaction is expected to actually cost, in wei — not what must
+// be reserved for it. A type-2 transaction is charged `baseFee + tip` per gas
+// and refunded the rest of the cap, and `eth_gasPrice` reports roughly that,
+// so gasPrice is the estimate and maxFeePerGas is the reserve. On a network
+// with no type-2 pricing the two are the same number.
+//
+// Display only: nothing gates on this. Returns null on the same unusable
+// inputs as feeReserveWei().
+function feeEstimateWei(gasLimit, feeData) {
+    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
+    const price = feeData?.gasPrice ?? feeData?.maxFeePerGas;
+    if (typeof price !== "bigint" || price < 0n) return null;
+    return gasLimit * price;
+}
+
+// Scale a human decimal string to 18-decimal fixed point. Returns null when
+// the value is not a decimal number or carries more precision than the scale
+// can hold, which the caller must treat as unusable rather than as zero.
+function toFixedPoint(value) {
+    if (typeof value !== "string" && typeof value !== "number") return null;
+    const text = String(value).trim();
+    if (text === "") return null;
+    try {
+        return parseUnits(text, SCALE_DECIMALS);
+    } catch (e) {
+        return null;
+    }
+}
+
+// Validate a pending transfer against the balances that must cover it.
+//
+//   isErc20      — token transfer rather than a native ETH transfer
+//   amount       — human decimal string being sent, non-negative. Anything
+//                  else, a negative value included, is an unusable amount
+//                  rather than an amount that passes every comparison.
+//   ethBalance   — human decimal string, the sender's ETH balance
+//   tokenBalance — human decimal string, the sender's token balance
+//   feeStatus    — FEE_PENDING, FEE_KNOWN or FEE_UNAVAILABLE. Anything else
+//                  is treated as FEE_UNAVAILABLE.
+//   feeWei       — the fee reserve in wei from feeReserveWei(), as a
+//                  non-negative bigint, when FEE_KNOWN. Any other value makes
+//                  the fee unavailable rather than zero.
+//
+// Returns { canSend, codes }. Every code blocks sending: canSend is true
+// only when nothing was found.
+function validateTransfer({
+    isErc20 = false,
+    amount,
+    ethBalance,
+    tokenBalance,
+    feeStatus = FEE_PENDING,
+    feeWei = null,
+} = {}) {
+    const codes = [];
+
+    const amountFp = toFixedPoint(amount);
+    const ethFp = toFixedPoint(ethBalance) ?? 0n;
+
+    // A negative amount parses to a valid bigint, so every comparison below
+    // is trivially false and the send clears the screen — then dies at encode
+    // time in parseEther(). Unusable, on the same footing as a malformed fee.
+    if (amountFp === null || amountFp < 0n) {
+        codes.push(CODES.AMOUNT_INVALID);
+        return { canSend: false, codes };
+    }
+
+    // Fail closed. Anything that is not a usable fee under a recognised
+    // status — a malformed feeWei, or a status this module does not know —
+    // is an unavailable estimate, never a fee of zero. Every such input errs
+    // in the direction that lets money out, so none of them is trusted.
+    const known =
+        feeStatus === FEE_KNOWN && typeof feeWei === "bigint" && feeWei >= 0n;
+    let status = feeStatus;
+    if (feeStatus === FEE_KNOWN && !known) status = FEE_UNAVAILABLE;
+    if (status !== FEE_KNOWN && status !== FEE_PENDING) {
+        status = FEE_UNAVAILABLE;
+    }
+
+    const feeFp = known ? feeWei : null;
+
+    if (isErc20) {
+        const tokenFp = toFixedPoint(tokenBalance) ?? 0n;
+        if (amountFp > tokenFp) codes.push(CODES.INSUFFICIENT_TOKEN);
+        if (feeFp !== null && feeFp > ethFp) {
+            codes.push(CODES.INSUFFICIENT_ETH_FOR_FEE);
+        }
+    } else if (amountFp > ethFp) {
+        codes.push(CODES.INSUFFICIENT_ETH);
+    } else if (feeFp !== null && amountFp + feeFp > ethFp) {
+        codes.push(CODES.INSUFFICIENT_ETH_WITH_FEE);
+    }
+
+    // An unknown fee is never assumed to be zero: sending stays blocked
+    // until the estimate arrives, and stays blocked if it never does.
+    if (status === FEE_PENDING) codes.push(CODES.FEE_PENDING);
+    if (status === FEE_UNAVAILABLE) codes.push(CODES.FEE_UNAVAILABLE);
+
+    return { canSend: codes.length === 0, codes };
+}
+
+module.exports = {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    SCALE_DECIMALS,
+    feeReserveWei,
+    feeEstimateWei,
+    toFixedPoint,
+    validateTransfer,
+};

src/shared/vault.js

@@ -1,14 +1,80 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
+//
+// Backend: WebAssembly, deliberately (#182).
+//
+// libsodium ships one file containing both a WebAssembly build and a
+// wasm2js ("asm.js") translation of it. It tries WASM first and, if
+// instantiation throws, silently swaps in the translation. An extension
+// CSP of plain script-src 'self' refuses WASM, so every popup load used
+// to take that fallback — announced by nothing but an uncaught
+// CompileError in the console.
+//
+// Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
+// MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
+// WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
+// identical either way — it is set by the ops/mem parameters, not by wall
+// time — so the fallback bought no security, it only made every password
+// operation take three and a half seconds, and the wallet asks for the
+// password on every signature.
+//
+// So both manifests declare 'wasm-unsafe-eval' for extension pages. That
+// keyword permits compiling WebAssembly and nothing else: not eval() of
+// strings, not inline script, not remote script. Reaching it requires
+// already executing script in the extension page, which is total
+// compromise on its own. 'unsafe-eval' would be a different matter and is
+// not granted. tests/manifest.test.js pins both policies to exactly
+// "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
+// strictness can drift unnoticed.
+//
+// The fallback still exists, and a wallet that refuses to decrypt is
+// worse than a slow one, so it is not disabled — it is made loud:
+// cryptoBackend() reports which backend this realm can run, ensureReady()
+// logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
+// unit tests exercise the WASM backend, and the end-to-end suite asserts
+// it in the real popup under the real manifest.
 
 const sodium = require("libsodium-wrappers-sumo");
+const { log } = require("./log");
+
+// An empty WebAssembly module: the 8-byte magic number and version header,
+// no sections. Compiling it asks the cheapest possible form of the only
+// question that matters here — may this realm compile WebAssembly at all —
+// which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
+// exactly what decides which backend libsodium ends up on.
+const EMPTY_WASM_MODULE = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+]);
+
+// "wasm" or "asmjs": whether this realm may compile WebAssembly, which is
+// what decides libsodium's backend when the CSP is the reason it cannot —
+// the case this codebase guards. It probes the realm, not libsodium, so a
+// fallback taken for some other reason (allocation failure, corrupt module)
+// would not be caught here; tests/vaultBackend.test.js checks libsodium's
+// own marker directly.
+async function cryptoBackend() {
+    try {
+        await WebAssembly.compile(EMPTY_WASM_MODULE);
+        return "wasm";
+    } catch (_) {
+        return "asmjs";
+    }
+}
 
 let ready = false;
 
 async function ensureReady() {
     if (!ready) {
         await sodium.ready;
+        if ((await cryptoBackend()) !== "wasm") {
+            log.errorf(
+                "libsodium is running on the wasm2js fallback: this realm " +
+                    "refuses to compile WebAssembly, so every password " +
+                    "derivation costs roughly 20x what it should. See the " +
+                    "backend note in src/shared/vault.js.",
+            );
+        }
         ready = true;
     }
 }
@@ -59,4 +125,4 @@ async function decryptWithPassword(encrypted, password) {
     return sodium.to_string(plaintext);
 }
 
-module.exports = { encryptWithPassword, decryptWithPassword };
+module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };

src/shared/wallet.js

@@ -16,8 +16,60 @@ function generateMnemonic() {
     return m.phrase;
 }
 
+// Every extended key (xprv or xpub) entering the app goes through this.
+//
+// ethers' HDNodeWallet.fromExtendedKey does NOT verify the base58 checksum
+// when the decoded payload is the usual 82 bytes, which is exactly the case
+// the checksum exists to catch: a key with a one-character typo parses into a
+// *different* wallet instead of being rejected. Re-encoding the parsed node
+// reproduces a well-formed key byte for byte, checksum included, so comparing
+// the round trip against the input rejects any altered character. Measured by
+// the sweep in tests/wallet.test.js over every single-character substitution
+// of the BIP-32 vector 1 master key: 199 parse without the round-trip
+// comparison, 0 with it.
+//
+// Returns the parsed node, or null if the key is not a well-formed extended
+// key. Callers turn null into a user-facing error; none of them may fall back
+// to fromExtendedKey directly.
+function parseExtendedKey(key) {
+    if (typeof key !== "string") return null;
+    try {
+        const node = HDNodeWallet.fromExtendedKey(key);
+        return node.extendedKey === key ? node : null;
+    } catch {
+        return null;
+    }
+}
+
+// A master key is at depth 0. Only from there is BIP44_ETH_PATH the absolute
+// path it names; deriving it under an account-level or child key yields
+// addresses that correspond to nothing the user holds.
+const MASTER_DEPTH = 0;
+
+// Parse an extended private key that the BIP-44 Ethereum account path can be
+// derived from, or throw. Both callers derive BIP44_ETH_PATH from the result.
+function masterXprvOrThrow(key) {
+    const node = parseExtendedKey(key);
+    if (!node) {
+        throw new Error("Not a valid extended private key (xprv).");
+    }
+    if (!node.privateKey) {
+        throw new Error("Not an extended private key (xprv).");
+    }
+    if (node.depth !== MASTER_DEPTH) {
+        throw new Error(
+            "Not a master extended private key (xprv): an account-level or " +
+                "child key cannot be imported.",
+        );
+    }
+    return node;
+}
+
 function deriveAddressFromXpub(xpub, index) {
-    const node = HDNodeWallet.fromExtendedKey(xpub);
+    const node = parseExtendedKey(xpub);
+    if (!node) {
+        throw new Error("Not a valid extended key.");
+    }
     return node.deriveChild(index).address;
 }
 
@@ -29,23 +81,28 @@ function hdWalletFromMnemonic(mnemonic) {
 }
 
 function hdWalletFromXprv(xprv) {
-    const root = HDNodeWallet.fromExtendedKey(xprv);
+    // BIP44_ETH_PATH is absolute ("m/..."), which ethers will only derive from
-    if (!root.privateKey) {
+    // a depth-0 node. The relative form this used to derive would have been
-        throw new Error("Not an extended private key (xprv).");
+    // applied *beneath* an account-level key instead of being refused.
-    }
+    const node = masterXprvOrThrow(xprv).derivePath(BIP44_ETH_PATH);
-    const node = root.derivePath("44'/60'/0'/0");
     const xpub = node.neuter().extendedKey;
     const firstAddress = node.deriveChild(0).address;
     return { xpub, firstAddress };
 }
 
+// Well-formed extended private key. Says nothing about depth: the import view
+// reports a non-master key separately, since "check it for a typo" is the
+// wrong advice for a key the user copied correctly.
 function isValidXprv(key) {
-    try {
+    const node = parseExtendedKey(key);
-        const node = HDNodeWallet.fromExtendedKey(key);
+    return !!(node && node.privateKey);
-        return !!node.privateKey;
+}
-    } catch {
+
-        return false;
+// Whether an extended key is a master key, i.e. the one BIP44_ETH_PATH can be
-    }
+// derived from. False for anything parseExtendedKey rejects.
+function isMasterExtendedKey(key) {
+    const node = parseExtendedKey(key);
+    return !!node && node.depth === MASTER_DEPTH;
 }
 
 function addressFromPrivateKey(key) {
@@ -63,9 +120,24 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         return node.deriveChild(addrIndex);
     }
     if (walletData.type === "xprv") {
-        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
+        // Checked here rather than through masterXprvOrThrow so the message
-        const node = root.derivePath("44'/60'/0'/0");
+        // fits the situation: nobody is importing anything at signing time,
-        return node.deriveChild(addrIndex);
+        // and this wallet is already in storage. src/shared/walletDefects.js
+        // catches it at list-render time; this is the backstop behind that.
+        const node = parseExtendedKey(decryptedSecret);
+        if (!node || !node.privateKey) {
+            throw new Error(
+                "This wallet's stored key is not a valid extended private " +
+                    "key, so it cannot sign.",
+            );
+        }
+        if (node.depth !== MASTER_DEPTH) {
+            throw new Error(
+                "This wallet was imported from an extended private key that " +
+                    "is not a master key, so it cannot sign.",
+            );
+        }
+        return node.derivePath(BIP44_ETH_PATH).deriveChild(addrIndex);
     }
     return new Wallet(decryptedSecret);
 }
@@ -74,13 +146,25 @@ function isValidMnemonic(mnemonic) {
     return Mnemonic.isValidMnemonic(mnemonic);
 }
 
+// Only an HD wallet has a recovery phrase. A "key" wallet holds a bare
+// private key and an "xprv" wallet an extended private key; neither can be
+// turned back into words, so neither may ever be offered the phrase display.
+// Written as an allowlist on purpose: a wallet type added later is excluded
+// until someone decides otherwise.
+function walletHasRecoveryPhrase(walletData) {
+    return !!walletData && walletData.type === "hd";
+}
+
 module.exports = {
     generateMnemonic,
+    parseExtendedKey,
     deriveAddressFromXpub,
     hdWalletFromMnemonic,
     hdWalletFromXprv,
     isValidXprv,
+    isMasterExtendedKey,
     addressFromPrivateKey,
     getSignerForAddress,
     isValidMnemonic,
+    walletHasRecoveryPhrase,
 };

src/shared/walletDefects.js

@@ -0,0 +1,86 @@
+// Wallets already in stored state whose key cannot be used, and the copy that
+// explains them.
+//
+// Refusing a non-master extended private key at import time does nothing for a
+// wallet imported before that refusal existed. Such a wallet is detected here,
+// at wallet-list render time, so the user meets the explanation on the list
+// screen rather than an exception on the send screen. Nothing here modifies or
+// removes a wallet: the record is the user's data.
+
+const { parseExtendedKey } = require("./wallet");
+
+const NON_MASTER_XPRV = "non-master-xprv";
+
+// An "xprv" wallet stores the neutered BIP-44 Ethereum node, four levels below
+// the key that was imported: the current import path derives the absolute
+// m/44'/60'/0'/0 from a depth-0 key, and the pre-#210 path derived the same
+// four levels as a relative path beneath whatever depth it was given. A master
+// import therefore stores a depth-4 xpub and a depth-d import stores depth
+// d + 4, which makes the stored xpub an exact read on the imported key's
+// depth — and it is readable without the password, unlike the key itself.
+const BIP44_ETH_XPUB_DEPTH = 4;
+
+const DEFECTS = {
+    [NON_MASTER_XPRV]: {
+        id: NON_MASTER_XPRV,
+        heading: "This wallet's addresses were derived incorrectly.",
+        paragraphs: [
+            "This wallet was imported from an extended private key that is " +
+                "not a master key. An earlier version applied the Ethereum " +
+                "derivation path beneath that key instead of from a master " +
+                "key, so the addresses listed here are not the ones that key " +
+                "produces under the standard path.",
+            "Signing and sending are disabled for this wallet. The addresses " +
+                "do descend from the extended private key you imported, so " +
+                "anything they hold is still reachable by software that " +
+                "repeats the same non-standard derivation. Check them in a " +
+                "block explorer before deciding what to do.",
+            "To see the addresses this key produces under the standard path, " +
+                "import the master extended private key, or the recovery " +
+                "phrase it came from, as a new wallet. Nothing here has been " +
+                "changed or removed, and this wallet stays until you delete " +
+                "it yourself.",
+        ],
+        // One sentence for the places that have room for one: the flash on a
+        // blocked Send, the inline error on the approval screens.
+        shortMessage:
+            "This wallet cannot sign, because it was imported from an " +
+            "extended private key that is not a master key. The wallet list " +
+            "explains what happened.",
+    },
+};
+
+// The defect record for a wallet, or null if there is nothing wrong with it
+// that this module can see. Read-only.
+//
+// A wallet whose xpub will not parse gets null rather than a defect: there is
+// no basis in that case to tell the user their key was not a master key, and a
+// wrong explanation is worse than none.
+function walletDefect(walletData) {
+    if (!walletData || walletData.type !== "xprv") return null;
+    const node = parseExtendedKey(walletData.xpub);
+    if (!node) return null;
+    if (node.depth === BIP44_ETH_XPUB_DEPTH) return null;
+    return DEFECTS[NON_MASTER_XPRV];
+}
+
+// The notice block for the wallet list, or "" for a wallet with no defect.
+// The copy is fixed text from this module, so it needs no escaping.
+function walletDefectHtml(walletData) {
+    const defect = walletDefect(walletData);
+    if (!defect) return "";
+    let html =
+        '<div class="border border-red-500 border-dashed p-2 my-1 text-xs text-red-500">';
+    html += `<div class="font-bold mb-1">${defect.heading}</div>`;
+    for (const p of defect.paragraphs) {
+        html += `<p class="mb-1">${p}</p>`;
+    }
+    html += "</div>";
+    return html;
+}
+
+module.exports = {
+    NON_MASTER_XPRV,
+    walletDefect,
+    walletDefectHtml,
+};

src/shared/walletDelete.js

@@ -0,0 +1,157 @@
+// Wallet and address deletion state transitions, kept out of the views so the
+// selection and broadcast rules are testable without a DOM.
+
+// Two records of the same address can be stored in different cases, so
+// address equality is never a literal string comparison.
+function sameAddress(a, b) {
+    if (a === null || a === undefined || b === null || b === undefined) {
+        return false;
+    }
+    return String(a).toLowerCase() === String(b).toLowerCase();
+}
+
+// Forget every site permission held against the given addresses.
+function dropSitePermissions(state, addresses) {
+    for (const addr of addresses) {
+        delete state.allowedSites[addr];
+        delete state.deniedSites[addr];
+    }
+}
+
+// Remove wallet `walletIdx` from `state` and repair the derived state.
+//
+// Rules:
+//   - `hasWallet` tracks whether any wallet remains.
+//   - Site permissions are dropped for every address of the deleted wallet.
+//   - `selectedWallet` follows the splice: it is decremented when a wallet
+//     before it was removed, and falls back to the first remaining wallet's
+//     first address only when the selection itself was deleted.
+//   - `activeAddress` is only moved when it belonged to the deleted wallet;
+//     the fallback is the first remaining wallet's first address, or null
+//     when no wallet remains.
+//
+// Returns whether `activeAddress` changed, so the caller can broadcast it.
+function removeWalletFromState(state, walletIdx) {
+    const wallet = state.wallets[walletIdx];
+    const addresses = (wallet.addresses || []).map((a) => a.address);
+    const previousActive = state.activeAddress;
+    const activeWasDeleted = addresses.some((a) =>
+        sameAddress(a, previousActive),
+    );
+
+    state.wallets.splice(walletIdx, 1);
+
+    dropSitePermissions(state, addresses);
+
+    state.hasWallet = state.wallets.length > 0;
+
+    const fallbackAddress = state.hasWallet
+        ? state.wallets[0].addresses[0]?.address || null
+        : null;
+
+    if (!state.hasWallet) {
+        state.selectedWallet = null;
+        state.selectedAddress = null;
+    } else if (state.selectedWallet === walletIdx) {
+        state.selectedWallet = 0;
+        state.selectedAddress = 0;
+    } else if (
+        typeof state.selectedWallet === "number" &&
+        state.selectedWallet > walletIdx
+    ) {
+        state.selectedWallet -= 1;
+    }
+
+    if (activeWasDeleted || !state.hasWallet) {
+        state.activeAddress = fallbackAddress;
+    }
+
+    return { activeAddressChanged: state.activeAddress !== previousActive };
+}
+
+// Whether a wallet may be offered a per-address remove control, and the same
+// gate the removal itself is held behind.
+//
+// Only a wallet that derives its addresses from an extended key can hold more
+// than one, so only those get the control — a key wallet has exactly one
+// address and no "+" button either. The last address of any wallet is never
+// removable: a wallet with no addresses is what delete-wallet is for.
+function canRemoveAddress(wallet) {
+    if (!wallet) return false;
+    if (wallet.type !== "hd" && wallet.type !== "xprv") return false;
+    return (wallet.addresses || []).length > 1;
+}
+
+// Remove address `addrIdx` of wallet `walletIdx` and repair the derived state.
+//
+// Nothing is destroyed here. The address stays derivable from the wallet's own
+// key material and any funds at it are untouched; this only stops the wallet
+// tracking it. `nextIndex` is deliberately left alone — it is a derivation
+// high-water mark, so "+" derives a fresh index rather than handing back the
+// address just removed, and the gap it leaves is within what
+// `scanForAddresses()` re-discovers on a later import.
+//
+// The rules mirror removeWalletFromState() one level down:
+//   - The call is refused unless canRemoveAddress() allows it, so the last
+//     address of a wallet always survives.
+//   - Site permissions are dropped for the removed address.
+//   - `selectedAddress` follows the splice, but only within the wallet that
+//     lost the address: it is decremented when an earlier address was
+//     removed, and falls back to that wallet's first address when the
+//     selection itself was removed. `selectedWallet` never moves, because the
+//     wallet list does not.
+//   - `activeAddress` moves only when it was the removed address, and then to
+//     the wallet's first remaining address.
+//
+// Returns whether the address was removed and whether `activeAddress`
+// changed, so the caller can broadcast it.
+function removeAddressFromState(state, walletIdx, addrIdx) {
+    const wallet = state.wallets[walletIdx];
+    const refused = { removed: false, activeAddressChanged: false };
+    if (!canRemoveAddress(wallet)) return refused;
+    if (!wallet.addresses[addrIdx]) return refused;
+
+    const address = wallet.addresses[addrIdx].address;
+    const previousActive = state.activeAddress;
+    const activeWasRemoved = sameAddress(address, previousActive);
+
+    wallet.addresses.splice(addrIdx, 1);
+
+    dropSitePermissions(state, [address]);
+
+    if (state.selectedWallet === walletIdx) {
+        if (state.selectedAddress === addrIdx) {
+            state.selectedAddress = 0;
+        } else if (
+            typeof state.selectedAddress === "number" &&
+            state.selectedAddress > addrIdx
+        ) {
+            state.selectedAddress -= 1;
+        }
+    }
+
+    if (activeWasRemoved) {
+        state.activeAddress = wallet.addresses[0].address;
+    }
+
+    return {
+        removed: true,
+        activeAddressChanged: state.activeAddress !== previousActive,
+    };
+}
+
+// Tell the background the active address changed, so it re-emits
+// accountsChanged to connected sites. Same call shape as the address
+// switch in the home view.
+function broadcastActiveChanged() {
+    const runtime =
+        typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
+    runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
+}
+
+module.exports = {
+    canRemoveAddress,
+    removeAddressFromState,
+    removeWalletFromState,
+    broadcastActiveChanged,
+};

tests/alarms.test.js

@@ -0,0 +1,468 @@
+// Scheduling for the background context.
+//
+// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
+// so anything scheduled with setInterval/setTimeout dies with it. These tests
+// pin the recurring jobs to the alarms API and to the re-registration path a
+// revived worker runs.
+
+// A controllable clock plus a stubbed balance refresh, so a cadence test can
+// measure the interval between refreshes that actually happened rather than
+// asserting the interval someone intended.
+let mockNow = 0;
+const mockBalanceRefreshAt = [];
+
+// jest.resetModules() clears the call record of every jest.fn, and loading the
+// worker is exactly that call — so anything that must be counted across a load
+// is counted here rather than read off a mock.
+let mockSetIntervalCalls = 0;
+
+// Extension storage reads do not take a constant amount of time, and that is
+// what makes a guard timed to the alarm period bite: backgroundRefresh()
+// stamps its freshness marker after awaiting loadState(), so any read that is
+// quicker than the previous one puts the next tick inside a guard of exactly
+// one period and the tick is skipped. A simulation with a constant latency
+// would sit exactly on the boundary and hide the bug.
+const MOCK_STORAGE_LATENCIES_MS = [7, 3, 11, 2, 9, 4, 13, 1, 6, 5];
+const MOCK_MAX_STORAGE_LATENCY_MS = Math.max(...MOCK_STORAGE_LATENCIES_MS);
+let mockStorageJitter = false;
+let mockStorageOpCount = 0;
+
+function mockStorageTick() {
+    if (!mockStorageJitter) return;
+    mockNow +=
+        MOCK_STORAGE_LATENCIES_MS[
+            mockStorageOpCount++ % MOCK_STORAGE_LATENCIES_MS.length
+        ];
+}
+
+jest.mock("../src/shared/balances", () => ({
+    refreshBalances: jest.fn(async () => {
+        mockBalanceRefreshAt.push(Date.now());
+    }),
+    getProvider: jest.fn(() => ({})),
+}));
+
+function makeAlarmsStub() {
+    const alarms = new Map();
+    const listeners = [];
+    const stub = {
+        created: [],
+        alarms,
+        create: jest.fn((name, info) => {
+            stub.created.push({ name, info });
+            alarms.set(name, { name, ...info });
+        }),
+        get: jest.fn(async (name) => alarms.get(name)),
+        clear: jest.fn(async (name) => alarms.delete(name)),
+        onAlarm: {
+            addListener: jest.fn((fn) => listeners.push(fn)),
+        },
+        fire: (name) => {
+            for (const fn of listeners) fn({ name });
+        },
+        listenerCount: () => listeners.length,
+    };
+    return stub;
+}
+
+describe("alarms module", () => {
+    let alarmsStub;
+    let alarmsMod;
+
+    beforeEach(() => {
+        jest.resetModules();
+        alarmsStub = makeAlarmsStub();
+        global.chrome = { alarms: alarmsStub };
+        alarmsMod = require("../src/shared/alarms");
+    });
+
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("ensureRecurringAlarms schedules both recurring jobs", async () => {
+        const created = await alarmsMod.ensureRecurringAlarms();
+        expect(created).toEqual({ balance: true, phishing: true });
+
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        expect(names).toEqual(
+            [
+                alarmsMod.BALANCE_REFRESH_ALARM,
+                alarmsMod.PHISHING_REFRESH_ALARM,
+            ].sort(),
+        );
+    });
+
+    test("the balance refresh keeps its 60-second cadence", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        const balance = alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM);
+        expect(balance.periodInMinutes).toBe(1);
+    });
+
+    test("the phishing refresh keeps its 24-hour cadence", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        const phishing = alarmsStub.alarms.get(
+            alarmsMod.PHISHING_REFRESH_ALARM,
+        );
+        expect(phishing.periodInMinutes).toBe(24 * 60);
+    });
+
+    test("no period is below the browser-enforced minimum", async () => {
+        // A period under one minute is silently clamped by the browser, so a
+        // request for one would mean the documented cadence is not the real
+        // one. Every period must be a whole minute at or above the minimum.
+        await alarmsMod.ensureRecurringAlarms();
+        for (const { info } of alarmsStub.created) {
+            expect(info.periodInMinutes).toBeGreaterThanOrEqual(
+                alarmsMod.MIN_ALARM_PERIOD_MINUTES,
+            );
+            expect(Number.isInteger(info.periodInMinutes)).toBe(true);
+        }
+    });
+
+    test("a revived worker does not reset an existing alarm's schedule", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
+
+        // Every wake re-runs the startup path. Re-creating an alarm restarts
+        // its period, so a busy extension would push the next fire out
+        // forever and the job would never run.
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: false, phishing: false });
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
+    });
+
+    test("a missing alarm is re-created on the next start", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
+
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: true, phishing: false });
+        expect(
+            alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
+        ).toBeDefined();
+    });
+
+    test("an alarm left over with a stale period is re-created", async () => {
+        // An install carries its alarms across an extension update, so a
+        // period changed in a new release only ever reaches users if the
+        // stale one is reconciled.
+        alarmsStub.create(alarmsMod.PHISHING_REFRESH_ALARM, {
+            periodInMinutes: 7 * 24 * 60,
+        });
+        alarmsStub.create.mockClear();
+
+        const created = await alarmsMod.ensureRecurringAlarms();
+        expect(created.phishing).toBe(true);
+        expect(
+            alarmsStub.alarms.get(alarmsMod.PHISHING_REFRESH_ALARM)
+                .periodInMinutes,
+        ).toBe(alarmsMod.PHISHING_REFRESH_PERIOD_MINUTES);
+    });
+
+    test("reconciling a period settles instead of re-creating forever", async () => {
+        alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
+            periodInMinutes: 30,
+        });
+        await alarmsMod.ensureRecurringAlarms();
+        alarmsStub.create.mockClear();
+
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: false, phishing: false });
+        expect(alarmsStub.create).not.toHaveBeenCalled();
+    });
+
+    test("handlers are dispatched by alarm name from one listener", () => {
+        const balance = jest.fn();
+        const phishing = jest.fn();
+        expect(
+            alarmsMod.registerAlarmHandlers({
+                [alarmsMod.BALANCE_REFRESH_ALARM]: balance,
+                [alarmsMod.PHISHING_REFRESH_ALARM]: phishing,
+            }),
+        ).toBe(true);
+        expect(alarmsStub.listenerCount()).toBe(1);
+
+        alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
+        expect(balance).toHaveBeenCalledTimes(1);
+        expect(phishing).not.toHaveBeenCalled();
+
+        alarmsStub.fire(alarmsMod.PHISHING_REFRESH_ALARM);
+        expect(phishing).toHaveBeenCalledTimes(1);
+
+        alarmsStub.fire("some-other-extension-alarm");
+        expect(balance).toHaveBeenCalledTimes(1);
+        expect(phishing).toHaveBeenCalledTimes(1);
+    });
+
+    test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
+        // Both targets are built from one bundle. MV2 has a persistent
+        // background page, but it takes the alarm path too, so the schedule
+        // is the same code on both browsers.
+        jest.resetModules();
+        const firefoxAlarms = makeAlarmsStub();
+        global.browser = { alarms: firefoxAlarms };
+        try {
+            const mod = require("../src/shared/alarms");
+            const created = await mod.ensureRecurringAlarms();
+            expect(created).toEqual({ balance: true, phishing: true });
+            expect(firefoxAlarms.created).toHaveLength(2);
+            // The Chrome stub must not have been touched.
+            expect(alarmsStub.create).not.toHaveBeenCalled();
+        } finally {
+            delete global.browser;
+        }
+    });
+
+    test("a context without the alarms API degrades instead of throwing", async () => {
+        jest.resetModules();
+        delete global.chrome;
+        const mod = require("../src/shared/alarms");
+        await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
+            balance: false,
+            phishing: false,
+        });
+        expect(mod.registerAlarmHandlers({})).toBe(false);
+    });
+});
+
+// Loads the background worker against stubbed browser APIs. The returned
+// store is the extension storage the worker sees, so a test can seed wallet
+// state and read back what the worker persisted.
+function loadBackground(initialStore = {}) {
+    const storageStore = initialStore;
+    const alarmsStub = makeAlarmsStub();
+    const listeners = { onInstalled: [], onStartup: [] };
+    global.chrome = {
+        alarms: alarmsStub,
+        storage: {
+            local: {
+                get: async (key) => {
+                    mockStorageTick();
+                    return Object.prototype.hasOwnProperty.call(
+                        storageStore,
+                        key,
+                    )
+                        ? { [key]: storageStore[key] }
+                        : {};
+                },
+                set: async (items) => {
+                    mockStorageTick();
+                    Object.assign(storageStore, items);
+                },
+                remove: async (key) => {
+                    delete storageStore[key];
+                },
+            },
+        },
+        runtime: {
+            onMessage: { addListener: jest.fn() },
+            onConnect: { addListener: jest.fn() },
+            onInstalled: {
+                addListener: jest.fn((fn) => listeners.onInstalled.push(fn)),
+            },
+            onStartup: {
+                addListener: jest.fn((fn) => listeners.onStartup.push(fn)),
+            },
+            getURL: (p) => "chrome-extension://test/" + p,
+            lastError: null,
+        },
+        windows: {
+            onRemoved: { addListener: jest.fn() },
+            create: jest.fn(),
+        },
+        tabs: { query: jest.fn(), sendMessage: jest.fn() },
+        action: { setPopup: jest.fn() },
+    };
+    global.fetch = jest.fn(async () => ({
+        ok: true,
+        json: async () => ({ blacklist: [] }),
+    }));
+    jest.resetModules();
+    require("../src/background/index");
+    return { alarmsStub, listeners, store: storageStore };
+}
+
+// Flush the promise chains the startup path and the alarm handlers run on.
+async function settle() {
+    for (let i = 0; i < 3; i++) {
+        await new Promise((resolve) => setImmediate(resolve));
+    }
+}
+
+describe("background worker scheduling", () => {
+    let alarmsStub;
+    let timers;
+
+    beforeEach(() => {
+        mockSetIntervalCalls = 0;
+        timers = {
+            setInterval: jest
+                .spyOn(global, "setInterval")
+                .mockImplementation(() => {
+                    mockSetIntervalCalls++;
+                    return 0;
+                }),
+        };
+    });
+
+    afterEach(() => {
+        timers.setInterval.mockRestore();
+        delete global.chrome;
+        delete global.fetch;
+        jest.resetModules();
+    });
+
+    test("startup schedules the recurring jobs as alarms, not timers", async () => {
+        alarmsStub = loadBackground().alarmsStub;
+        // Let the startup path's promises settle.
+        await settle();
+
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        const {
+            BALANCE_REFRESH_ALARM,
+            PHISHING_REFRESH_ALARM,
+        } = require("../src/shared/alarms");
+        expect(names).toEqual(
+            [BALANCE_REFRESH_ALARM, PHISHING_REFRESH_ALARM].sort(),
+        );
+        expect(mockSetIntervalCalls).toBe(0);
+    });
+
+    test("an onAlarm listener is installed on startup", async () => {
+        alarmsStub = loadBackground().alarmsStub;
+        await settle();
+        expect(alarmsStub.listenerCount()).toBe(1);
+    });
+
+    test("onInstalled and onStartup both re-establish the schedule", async () => {
+        const loaded = loadBackground();
+        alarmsStub = loaded.alarmsStub;
+        await settle();
+
+        expect(loaded.listeners.onInstalled).toHaveLength(1);
+        expect(loaded.listeners.onStartup).toHaveLength(1);
+
+        // A browser start after the alarms were dropped must put them back.
+        alarmsStub.alarms.clear();
+        alarmsStub.created.length = 0;
+        loaded.listeners.onStartup[0]();
+        await settle();
+        expect(alarmsStub.created).toHaveLength(2);
+    });
+
+    test("the install-time listener and the top-level call share one run", async () => {
+        // On a fresh install both fire, close enough that both could observe
+        // an alarm missing and create it — and a second create restarts the
+        // period the first one just set.
+        const loaded = loadBackground();
+        alarmsStub = loaded.alarmsStub;
+        loaded.listeners.onInstalled[0]();
+        await settle();
+
+        expect(alarmsStub.created).toHaveLength(2);
+        expect(alarmsStub.created.map((c) => c.name).sort()).toEqual(
+            [
+                "autistmask-balance-refresh",
+                "autistmask-phishing-refresh",
+            ].sort(),
+        );
+    });
+});
+
+// The alarm period alone must set the cadence. A freshness guard timed to the
+// period vetoes the very tick it gates, because the guard is measured from
+// when the last run finished and the alarm fires one run-duration before that.
+// These tests measure the interval between refreshes that actually ran.
+describe("balance refresh steady-state cadence", () => {
+    const {
+        BALANCE_REFRESH_PERIOD_MINUTES,
+        BALANCE_REFRESH_ALARM,
+    } = require("../src/shared/alarms");
+    const PERIOD_MS = BALANCE_REFRESH_PERIOD_MINUTES * 60 * 1000;
+
+    let clockSpy;
+    let timerSpy;
+
+    function seededStore() {
+        return {
+            autistmask: {
+                hasWallet: true,
+                wallets: [
+                    { address: "0x0000000000000000000000000000000000000001" },
+                ],
+                lastBalanceRefresh: 0,
+            },
+        };
+    }
+
+    beforeEach(() => {
+        mockNow = Date.UTC(2026, 0, 1, 0, 0, 0);
+        mockBalanceRefreshAt.length = 0;
+        mockSetIntervalCalls = 0;
+        mockStorageOpCount = 0;
+        mockStorageJitter = false;
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => mockNow);
+        timerSpy = jest.spyOn(global, "setInterval").mockImplementation(() => {
+            mockSetIntervalCalls++;
+            return 0;
+        });
+    });
+
+    afterEach(() => {
+        mockStorageJitter = false;
+        clockSpy.mockRestore();
+        timerSpy.mockRestore();
+        delete global.chrome;
+        delete global.fetch;
+        jest.resetModules();
+    });
+
+    test("ten alarm ticks produce ten refreshes, one per period", async () => {
+        const { alarmsStub } = loadBackground(seededStore());
+        await settle();
+        mockStorageJitter = true;
+
+        const TICKS = 10;
+        let tickAt = mockNow + PERIOD_MS;
+        for (let i = 0; i < TICKS; i++) {
+            mockNow = tickAt;
+            tickAt += PERIOD_MS;
+            alarmsStub.fire(BALANCE_REFRESH_ALARM);
+            await settle();
+        }
+
+        // No tick was a no-op. This is the assertion that fails when the guard
+        // is timed to the alarm period.
+        expect(mockBalanceRefreshAt).toHaveLength(TICKS);
+
+        // And the observed cadence is one period, not two.
+        const intervals = mockBalanceRefreshAt
+            .slice(1)
+            .map((t, i) => t - mockBalanceRefreshAt[i]);
+        for (const interval of intervals) {
+            expect(interval).toBeGreaterThanOrEqual(
+                PERIOD_MS - MOCK_MAX_STORAGE_LATENCY_MS,
+            );
+            expect(interval).toBeLessThanOrEqual(
+                PERIOD_MS + MOCK_MAX_STORAGE_LATENCY_MS,
+            );
+        }
+    });
+
+    test("a refresh an open popup just did still suppresses the tick", async () => {
+        // The guard's actual job, and the reason it is shortened rather than
+        // removed: while the popup is open it refreshes every 10 seconds and
+        // stamps the same field, and the background job has nothing to add.
+        const store = seededStore();
+        const { alarmsStub } = loadBackground(store);
+        await settle();
+
+        mockNow += PERIOD_MS;
+        store.autistmask.lastBalanceRefresh = mockNow - 10 * 1000;
+        alarmsStub.fire(BALANCE_REFRESH_ALARM);
+        await settle();
+
+        expect(mockBalanceRefreshAt).toHaveLength(0);
+    });
+});

tests/backgroundApproval.test.js

@@ -0,0 +1,679 @@
+// The background's approval message wiring, driven end to end: a dApp
+// eth_sendTransaction raises a pending approval, and the popup answers it with
+// AUTISTMASK_TX_RESPONSE / AUTISTMASK_SIGN_RESPONSE.
+//
+// What this exists for is the duplicate response. The handler verifies and
+// broadcasts asynchronously, and the approval deliberately survives a
+// retryable failure so the user can try again with the transaction they
+// already saw — which means the entry being present is not by itself proof
+// that no attempt is running. A second response carrying the same id (a
+// reloaded approval window re-rendering a live Approve button, a popup that
+// emits the message twice) must not start a second verify and broadcast: with
+// the ordinary dApp approval shape the page fixes no nonce, so two artifacts
+// signed at different nonces both verify, and the approved transfer would go
+// out twice.
+
+const { Wallet } = require("ethers");
+
+const SIGNER_KEY =
+    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
+const signer = new Wallet(SIGNER_KEY);
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+const ORIGIN = "https://dapp.example";
+const HOSTNAME = "dapp.example";
+const EXT_URL = "chrome-extension://autistmask/";
+
+// What the dApp asks for: no nonce, no gas, no fees. This is the shape that
+// makes a duplicate broadcast possible at all.
+const TX_PARAMS = {
+    from: signer.address,
+    to: RECIPIENT,
+    value: "0x2386f26fc10000",
+    data: "0x",
+};
+
+// The fields the popup's populateTransaction() would fill in. The nonce is a
+// parameter because the duplicate case turns on the two artifacts differing
+// in exactly the field nothing constrains.
+function populated(nonce) {
+    return {
+        type: 2,
+        chainId: 1,
+        nonce,
+        gasLimit: 100000n,
+        maxFeePerGas: 2000000000n,
+        maxPriorityFeePerGas: 1000000000n,
+        to: TX_PARAMS.to,
+        value: BigInt(TX_PARAMS.value),
+        data: TX_PARAMS.data,
+    };
+}
+
+function signedAtNonce(nonce) {
+    return signer.signTransaction(populated(nonce));
+}
+
+// A promise whose settlement the test controls, so a broadcast can be held in
+// flight while the second response arrives.
+function deferred() {
+    let resolve;
+    let reject;
+    const promise = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    return { promise, resolve, reject };
+}
+
+// Load the background worker against stubbed browser and network APIs and
+// return the handles the tests drive it through. Everything that would touch
+// the network or the browser's own schedulers is mocked; the approval
+// verification is the real module, because that is what the handler under
+// test is wired to.
+function loadBackground(options) {
+    const opts = options || {};
+    jest.resetModules();
+
+    const broadcastTransaction = jest.fn();
+    const loadState = jest.fn(opts.loadState || (async () => {}));
+
+    jest.doMock("../src/shared/state", () => ({
+        state: { rpcUrl: "https://rpc.invalid", wallets: [] },
+        loadState,
+        saveState: jest.fn(async () => {}),
+        currentNetwork: () => ({ chainId: "0x1" }),
+    }));
+    jest.doMock("../src/shared/balances", () => ({
+        getProvider: () => ({ broadcastTransaction }),
+        refreshBalances: jest.fn(async () => {}),
+    }));
+    jest.doMock("../src/shared/phishingDomains", () => ({
+        isPhishingDomain: () => false,
+        refreshPhishingListOnSchedule: jest.fn(async () => {}),
+        initPhishingList: jest.fn(async () => {}),
+    }));
+    jest.doMock("../src/shared/alarms", () => ({
+        BALANCE_REFRESH_ALARM: "balance",
+        PHISHING_REFRESH_ALARM: "phishing",
+        BALANCE_REFRESH_PERIOD_MINUTES: 1,
+        ensureRecurringAlarms: jest.fn(async () => {}),
+        registerAlarmHandlers: jest.fn(),
+    }));
+
+    const persisted = {
+        wallets: [
+            { name: "Wallet 1", type: "hd", addresses: [signer.address] },
+        ],
+        rpcUrl: "https://rpc.invalid",
+        activeAddress: signer.address,
+        allowedSites: { [signer.address]: [HOSTNAME] },
+        deniedSites: {},
+    };
+
+    let messageListener = null;
+    let windowRemovedListener = null;
+    const created = [];
+    const removed = [];
+
+    global.chrome = {
+        storage: {
+            local: {
+                get: jest.fn(async () => ({ autistmask: persisted })),
+                set: jest.fn(async () => {}),
+            },
+        },
+        runtime: {
+            getURL: (path) => EXT_URL + path,
+            onMessage: {
+                addListener: (fn) => {
+                    messageListener = fn;
+                },
+            },
+            onConnect: { addListener: () => {} },
+            lastError: null,
+        },
+        windows: {
+            getLastFocused: (cb) => cb(null),
+            create: (options2, cb) => {
+                created.push(options2);
+                cb({ id: created.length });
+            },
+            remove: (id, cb) => {
+                removed.push(id);
+                if (cb) cb();
+            },
+            // Captured, not swallowed: closing the approval window is the
+            // event that used to retire an approval out from under a live
+            // broadcast, and a no-op stub here hides exactly that.
+            onRemoved: {
+                addListener: (fn) => {
+                    windowRemovedListener = fn;
+                },
+            },
+        },
+        tabs: {
+            query: (q, cb) => cb([]),
+            sendMessage: () => {},
+        },
+        action: { setPopup: () => {} },
+    };
+
+    require("../src/background/index");
+
+    // Send a message the way the browser would, and hand back whatever the
+    // handler passed to sendResponse.
+    function send(msg, sender) {
+        const sendResponse = jest.fn();
+        const kept = messageListener(msg, sender || {}, sendResponse);
+        return { sendResponse, kept };
+    }
+
+    // Raise a pending transaction approval the way a dApp does, and dig the
+    // approval id back out of the popup URL the background opened.
+    function requestTx() {
+        let rpcResult = null;
+        const sendResponse = jest.fn((r) => {
+            rpcResult = r;
+        });
+        messageListener(
+            {
+                type: "AUTISTMASK_RPC",
+                method: "eth_sendTransaction",
+                params: [TX_PARAMS],
+            },
+            { origin: ORIGIN },
+            sendResponse,
+        );
+        return {
+            id: () => new URL(created[0].url).searchParams.get("approval"),
+            result: () => rpcResult,
+        };
+    }
+
+    // The user closes the approval popup. `created` is index-aligned with the
+    // ids the window stub hands back, so window 1 is the first popup opened.
+    function closeWindow(windowId) {
+        windowRemovedListener(windowId);
+    }
+
+    return {
+        send,
+        requestTx,
+        closeWindow,
+        broadcastTransaction,
+        loadState,
+        created,
+        removed,
+        fromPopup: { url: EXT_URL + "src/popup/index.html" },
+    };
+}
+
+// Let the handler's promise chain run to the next suspension point.
+async function settle() {
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+}
+
+afterEach(() => {
+    delete global.chrome;
+    jest.resetModules();
+});
+
+describe("one approval, one broadcast", () => {
+    test("a second AUTISTMASK_TX_RESPONSE for the same id does not broadcast again", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+        expect(id).toBeTruthy();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+
+        // The popup answers. Verification passes and the broadcast is held
+        // open, which is the whole window the second message arrives in.
+        const first = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+
+        // A reloaded approval window signs the same approval again. Nothing
+        // in the approval fixes a nonce, so this artifact verifies just as
+        // well as the first one.
+        const second = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(8),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+        expect(second.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({
+                error: expect.stringMatching(/already being sent/),
+                retryable: false,
+            }),
+        );
+
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+        expect(first.sendResponse).toHaveBeenCalledWith({ txHash: "0xfeed" });
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+
+    test("the same artifact sent twice broadcasts once", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        const raw = await signedAtNonce(7);
+        const msg = {
+            type: "AUTISTMASK_TX_RESPONSE",
+            id,
+            approved: true,
+            rawSignedTx: raw,
+        };
+
+        bg.send(msg, { url: bg.fromPopup.url });
+        bg.send(msg, { url: bg.fromPopup.url });
+        await settle();
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+
+    test("a response arriving after the broadcast finished finds nothing to send", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        const late = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(8),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+        expect(late.sendResponse).not.toHaveBeenCalled();
+    });
+
+    test("a second AUTISTMASK_SIGN_RESPONSE for the same id is refused", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        // Hold the transaction approval in flight, then answer it a second
+        // time as if it were a sign approval: the sign handler must apply the
+        // same interlock rather than running its own verification.
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        const second = bg.send(
+            {
+                type: "AUTISTMASK_SIGN_RESPONSE",
+                id,
+                approved: true,
+                signature: "0x00",
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(second.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({
+                error: expect.stringMatching(/already being signed/),
+                retryable: false,
+            }),
+        );
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+});
+
+// The interlock must not cost the retry the approval exists to allow.
+describe("the interlock releases a failed attempt", () => {
+    test("a retryable failure before the broadcast leaves the approval usable", async () => {
+        let failNext = true;
+        const bg = loadBackground({
+            loadState: async () => {
+                if (failNext) {
+                    failNext = false;
+                    throw new Error("storage unavailable");
+                }
+            },
+        });
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const first = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+        expect(first.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({ retryable: true }),
+        );
+
+        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
+        const retry = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+        expect(retry.sendResponse).toHaveBeenCalledWith({ txHash: "0xfeed" });
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+    });
+
+    test("a mismatched artifact spends the approval outright", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        // Signed for a different recipient than the one that was approved.
+        const wrong = await signer.signTransaction({
+            ...populated(7),
+            to: "0xdAC17F958D2ee523a2206206994597C13D831ec7",
+        });
+        const first = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: wrong,
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(first.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({ retryable: false, stage: "verify" }),
+        );
+
+        const retry = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+        expect(retry.sendResponse).not.toHaveBeenCalled();
+    });
+});
+
+// The claim is what makes one approval one broadcast, so it has to hold
+// against everything else that retires an approval, not just against a second
+// AUTISTMASK_TX_RESPONSE. Each of these paths used to resolve the waiting
+// promise 4001 while the attempt behind it ran to completion: the transaction
+// reached the chain and the page was told the user rejected it, which invites
+// the user to send it a second time at a fresh nonce.
+describe("a claimed approval outlives every other retirement path", () => {
+    // The approval popup stays open across the broadcast it is waiting on, so
+    // a user closing an apparently-hung window needs no adversary at all.
+    test("closing the approval window mid-broadcast still reports the result", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        const first = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+
+        // The user closes the window while the broadcast is still open.
+        bg.closeWindow(1);
+        await settle();
+        expect(pending.result()).toBeNull();
+
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+        expect(first.sendResponse).toHaveBeenCalledWith({ txHash: "0xfeed" });
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+
+    test("switching the active address mid-broadcast still reports the result", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+
+        // The user switches account in the toolbar popup, which rejects and
+        // force-closes every pending approval.
+        bg.send(
+            { type: "AUTISTMASK_ACTIVE_CHANGED" },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(pending.result()).toBeNull();
+        // The window an in-flight attempt reports into is left standing too.
+        expect(bg.removed).toEqual([]);
+
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+
+    test("a reject arriving mid-broadcast is refused, not honoured", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        const reject = bg.send(
+            { type: "AUTISTMASK_TX_RESPONSE", id, approved: false },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(pending.result()).toBeNull();
+        expect(reject.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({
+                retryable: false,
+                stage: "broadcast",
+            }),
+        );
+
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+        expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
+    });
+
+    // The refusals above must not cost the rejection its ordinary meaning.
+    test("with no attempt running, closing the window still rejects", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.closeWindow(1);
+        await settle();
+
+        expect(pending.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+    });
+
+    test("with no attempt running, an active-address switch still rejects and closes", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.send(
+            { type: "AUTISTMASK_ACTIVE_CHANGED" },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(pending.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        expect(bg.removed).toEqual([1]);
+    });
+
+    // A sign approval held by a running verification is the same shape, and
+    // the refusal must not tell the user to start again from the site while
+    // the first attempt may still hand back a signature.
+    test("a reject during a sign attempt is refused with the in-flight stage", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const inFlight = deferred();
+        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
+        bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        const reject = bg.send(
+            { type: "AUTISTMASK_SIGN_RESPONSE", id, approved: false },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        expect(reject.sendResponse).toHaveBeenCalledWith(
+            expect.objectContaining({ retryable: false, stage: "inflight" }),
+        );
+
+        inFlight.resolve({ hash: "0xfeed" });
+        await settle();
+        expect(pending.result()).toEqual({ result: "0xfeed" });
+    });
+});
+
+describe("popup-only messages", () => {
+    test("a page sender cannot answer an approval", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        const spoof = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(7),
+            },
+            { url: ORIGIN + "/index.html" },
+        );
+        await settle();
+
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+        expect(spoof.sendResponse).toHaveBeenCalledWith({
+            error: "Unauthorized sender",
+        });
+    });
+});

tests/constants.test.js

@@ -1,4 +1,6 @@
 const {
+    DEBUG,
+    BUILD_DEBUG_MARKER,
     ETHEREUM_MAINNET_CHAIN_ID,
     DEFAULT_RPC_URL,
     BIP44_ETH_PATH,
@@ -19,6 +21,24 @@ describe("constants", () => {
         expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
     });
 
+    // This does not replace script/verify-build, which is the only thing that
+    // can see the compiled DEBUG state of a real bundle. It pins the source
+    // invariant that the marker tracks DEBUG, so the two cannot be edited
+    // apart and leave verify-build asserting something that is no longer the
+    // flag the code branches on.
+    test("build debug marker is derived from DEBUG", () => {
+        expect(BUILD_DEBUG_MARKER).toBe(
+            DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
+        );
+    });
+
+    // Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
+    // must be the safe one.
+    test("DEBUG is off when loaded outside a bundle", () => {
+        expect(DEBUG).toBe(false);
+        expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
+    });
+
     test("exports ERC-20 ABI with expected functions", () => {
         expect(Array.isArray(ERC20_ABI)).toBe(true);
         expect(ERC20_ABI.length).toBeGreaterThan(0);

tests/deleteAddress.test.js

@@ -0,0 +1,158 @@
+// Tests for the copy on the address-removal confirmation (issue #162).
+//
+// The screen's whole job is to warn before a destructive-looking action, so
+// the copy is the substance and is tested as such. Two things it must not
+// get wrong: what it takes to get the address back — the app refuses both
+// obvious routes — and what counts as holding something, which is any
+// ERC-20 as well as ETH, at any size, including a balance that rounds to
+// zero at the four decimals the balance lines render. The DOM behaviour
+// around them is driven against the real popup by tests/e2e/run.js.
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { addressHoldsFunds } = require("../src/popup/views/helpers");
+const {
+    recoveryPathText,
+    balanceWarningHtml,
+} = require("../src/popup/views/deleteAddress");
+const { prices, clearPrices } = require("../src/shared/prices");
+
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+
+const EMPTY = { address: "0x1", balance: "0.0000", tokenBalances: [] };
+const ETH_ONLY = { address: "0x1", balance: "1.5", tokenBalances: [] };
+const DUST = { address: "0x1", balance: "0.00001", tokenBalances: [] };
+const TOKEN_ONLY = {
+    address: "0x1",
+    balance: "0.0000",
+    tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
+};
+const ZERO_TOKEN = {
+    address: "0x1",
+    balance: "0",
+    tokenBalances: [{ address: USDC, symbol: "USDC", balance: "0" }],
+};
+
+afterEach(() => {
+    clearPrices();
+});
+
+describe("what the screen says it takes to get the address back", () => {
+    // The screen used to promise the address "can be brought back at any
+    // time by importing this wallet's recovery phrase again". That import is
+    // refused as a duplicate for as long as the wallet is present, which it
+    // always is here — a wallet never gives up its last address.
+    test("it does not promise a re-import while the wallet is here", () => {
+        const text = recoveryPathText({ type: "hd" });
+        expect(text).not.toMatch(/at any time/);
+        expect(text).toContain("is refused while this wallet is still here");
+    });
+
+    test("it names deleting the whole wallet as the route back", () => {
+        expect(recoveryPathText({ type: "hd" })).toContain(
+            "delete the whole wallet in Settings",
+        );
+    });
+
+    // The scan after a re-import finds used addresses only, so an address
+    // that never saw a transaction does not come back at all. Saying so is
+    // the difference between a warning and a false reassurance.
+    test("it states the limit: only on-chain activity is found", () => {
+        const text = recoveryPathText({ type: "hd" });
+        expect(text).toContain("only finds addresses that have on-chain");
+        expect(text).toContain("never been used is not found by it");
+    });
+
+    // The screen is offered on xprv wallets too, and an xprv wallet holds no
+    // recovery phrase — telling its owner to import one would send them
+    // looking for words that do not exist.
+    test("an xprv wallet is told about its extended private key", () => {
+        const text = recoveryPathText({ type: "xprv" });
+        expect(text).toContain("extended private key");
+        expect(text).not.toContain("recovery phrase");
+    });
+
+    test("an HD wallet is told about its recovery phrase", () => {
+        const text = recoveryPathText({ type: "hd" });
+        expect(text).toContain("recovery phrase");
+        expect(text).not.toContain("extended private key");
+    });
+});
+
+describe("whether an address holds anything", () => {
+    test("ETH counts", () => {
+        expect(addressHoldsFunds(ETH_ONLY)).toBe(true);
+    });
+
+    // The case that decides the screen: no ETH at all, and $2500 of a
+    // stablecoin sitting at the address.
+    test("an ERC-20 balance counts even with no ETH", () => {
+        expect(addressHoldsFunds(TOKEN_ONLY)).toBe(true);
+    });
+
+    // 0.00001 ETH renders as "0.0000" at four decimals. It is still money.
+    test("an ETH balance below the displayed precision counts", () => {
+        expect(addressHoldsFunds(DUST)).toBe(true);
+    });
+
+    test("an address holding nothing does not", () => {
+        expect(addressHoldsFunds(EMPTY)).toBe(false);
+        expect(addressHoldsFunds(ZERO_TOKEN)).toBe(false);
+    });
+
+    test("a missing address or missing fields do not", () => {
+        expect(addressHoldsFunds(undefined)).toBe(false);
+        expect(addressHoldsFunds({ address: "0x1" })).toBe(false);
+    });
+});
+
+describe("the balance warning on the removal confirmation", () => {
+    test("an address holding nothing gets a blank line, not a warning", () => {
+        expect(balanceWarningHtml(EMPTY)).toBe(" ");
+        expect(balanceWarningHtml(ZERO_TOKEN)).toBe(" ");
+    });
+
+    test("an ERC-20-only address is warned about, and its token listed", () => {
+        const html = balanceWarningHtml(TOKEN_ONLY);
+        expect(html).toContain("This address holds a balance.");
+        expect(html).toContain("does not move or spend anything");
+        expect(html).toContain("USDC");
+        expect(html).toContain("2500.0000");
+    });
+
+    // The rendered line says 0.0000 for this address — that is the display
+    // format, shared with Home and AddressDetail — and the warning is shown
+    // all the same, because the balance is not zero.
+    test("an ETH balance that renders as 0.0000 is warned about", () => {
+        const html = balanceWarningHtml(DUST);
+        expect(html).toContain("This address holds a balance.");
+        expect(html).toContain("<span>0.0000</span>");
+    });
+
+    // The sentence must not assert an amount, because any amount it could
+    // assert has been rounded: "This address holds 0.0000 ETH." is what the
+    // rounded form produces for an address that holds real money.
+    test("the warning sentence asserts no rounded amount", () => {
+        for (const addr of [DUST, ETH_ONLY, TOKEN_ONLY]) {
+            expect(balanceWarningHtml(addr)).not.toMatch(
+                /holds [\d.]+ (ETH|USDC)/,
+            );
+        }
+    });
+
+    test("the USD total is shown when prices are known", () => {
+        prices.ETH = 2000;
+        prices.USDC = 1;
+        expect(balanceWarningHtml(TOKEN_ONLY)).toContain("Total: $2,500.00");
+        expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
+    });
+
+    // getAddressValueUsd() returns null on testnet and before the first
+    // price fetch. A "Total: $0.00" there would be a lie about the holdings.
+    test("no USD total is shown when prices are not known", () => {
+        expect(balanceWarningHtml(TOKEN_ONLY)).not.toContain("Total:");
+    });
+});

tests/dustThreshold.test.js

@@ -0,0 +1,243 @@
+// Tests for the dust threshold field in Settings (issue #233).
+//
+// Two halves: what the parse accepts, and what the settings view does with a
+// rejection. The view half runs against the real change handler with the DOM
+// helpers stubbed out, because the bug was not in the parse — it was that a
+// rejection said nothing.
+
+const {
+    DUST_THRESHOLD_MESSAGE,
+    parseDustThresholdGwei,
+} = require("../src/popup/dustThreshold");
+
+describe("parsing the dust threshold", () => {
+    test("accepts a whole number of gwei", () => {
+        expect(parseDustThresholdGwei("100000")).toBe(100000);
+        expect(parseDustThresholdGwei("1")).toBe(1);
+    });
+
+    // Zero is a real setting, not an empty field: it hides nothing.
+    test("accepts zero", () => {
+        expect(parseDustThresholdGwei("0")).toBe(0);
+    });
+
+    test("accepts surrounding whitespace", () => {
+        expect(parseDustThresholdGwei("  250  ")).toBe(250);
+    });
+
+    test("rejects an empty field", () => {
+        expect(parseDustThresholdGwei("")).toBe(null);
+        expect(parseDustThresholdGwei("   ")).toBe(null);
+    });
+
+    test("rejects a negative threshold", () => {
+        expect(parseDustThresholdGwei("-1")).toBe(null);
+    });
+
+    // parseInt used to read this as 1, which is not what was typed.
+    test("rejects a fractional value", () => {
+        expect(parseDustThresholdGwei("1.5")).toBe(null);
+        expect(parseDustThresholdGwei("1.0")).toBe(null);
+    });
+
+    // parseInt used to read this as 100. The unit is printed beside the
+    // field already.
+    test("rejects a value carrying its unit", () => {
+        expect(parseDustThresholdGwei("100 gwei")).toBe(null);
+    });
+
+    // Number() reads this as 16. Storing 16 for a field that was told to
+    // want a whole number of gwei would be the same silent substitution the
+    // message exists to end.
+    test("rejects hex notation", () => {
+        expect(parseDustThresholdGwei("0x10")).toBe(null);
+    });
+
+    // Number() reads this as 1000.
+    test("rejects exponent notation", () => {
+        expect(parseDustThresholdGwei("1e3")).toBe(null);
+    });
+
+    test("rejects other non-numeric input", () => {
+        expect(parseDustThresholdGwei("lots")).toBe(null);
+        expect(parseDustThresholdGwei("+5")).toBe(null);
+        expect(parseDustThresholdGwei("Infinity")).toBe(null);
+        expect(parseDustThresholdGwei(undefined)).toBe(null);
+        expect(parseDustThresholdGwei(5)).toBe(null);
+    });
+
+    // Beyond 2^53 the digits would round on the way in, so the stored
+    // threshold would not be the one typed.
+    test("rejects a value too large to hold exactly", () => {
+        expect(parseDustThresholdGwei("9007199254740993")).toBe(null);
+    });
+});
+
+describe("the rejection message", () => {
+    // README, Language & Labeling: error messages are full sentences.
+    test("is a full sentence naming the constraint", () => {
+        expect(DUST_THRESHOLD_MESSAGE).toMatch(/^[A-Z].*\.$/);
+        expect(DUST_THRESHOLD_MESSAGE).toContain("whole number of gwei");
+        expect(DUST_THRESHOLD_MESSAGE).toContain("zero or greater");
+    });
+});
+
+describe("the flash line the message is shown in", () => {
+    const fs = require("fs");
+    const path = require("path");
+
+    const POPUP_HTML = fs.readFileSync(
+        path.join(__dirname, "..", "src", "popup", "index.html"),
+        "utf8",
+    );
+
+    // This asserts only that the reservation exists in the markup. It does
+    // NOT and CANNOT assert that the message fits inside it: jest runs on
+    // the node environment here, with no layout engine, so every rendered
+    // height is zero. An earlier version of this block claimed to pin the
+    // No Layout Shift policy with this regex, and it passed at any message
+    // length, including one that wrapped to two lines and pushed the
+    // settings view down 12px.
+    //
+    // The assertion that actually measures — empty line vs. the message,
+    // real Chromium, documented 360x600 popup — is
+    // "a rejected dust threshold shifts no layout (#233)" in
+    // tests/e2e/run.js, run by make test-e2e. It is not in make check
+    // because REPO_POLICIES.md caps make test at 20 seconds and a browser
+    // suite does not fit; run it before changing the wording.
+    test("reserves its height in the markup", () => {
+        const flashLine = POPUP_HTML.match(
+            /<div\s+id="flash-msg"\s+class="([^"]*)"/,
+        );
+        expect(flashLine).not.toBeNull();
+        expect(flashLine[1]).toMatch(/min-h-\[/);
+    });
+});
+
+describe("the settings view on a change to the field", () => {
+    let elements;
+    let flashes;
+    let saves;
+    let state;
+
+    // A stand-in for one DOM node: enough of an element for init() to set
+    // properties on it and hang listeners off it.
+    function fakeElement() {
+        return {
+            value: "",
+            checked: false,
+            textContent: "",
+            href: "",
+            style: {},
+            dataset: {},
+            classList: { add() {}, remove() {} },
+            listeners: {},
+            addEventListener(event, handler) {
+                this.listeners[event] = handler;
+            },
+            querySelectorAll: () => [],
+        };
+    }
+
+    function loadSettingsView() {
+        elements = {};
+        flashes = [];
+        saves = 0;
+
+        jest.resetModules();
+
+        jest.doMock("../src/popup/views/helpers", () => ({
+            $: (id) => (elements[id] ||= fakeElement()),
+            showView: () => {},
+            updateDebugBanner: () => {},
+            showFlash: (msg) => flashes.push(msg),
+            escapeHtml: (s) => s,
+            flashCopyFeedback: () => {},
+            goBack: () => {},
+            pushCurrentView: () => {},
+            onViewLeave: () => {},
+            VIEWS: [],
+        }));
+
+        state = require("../src/shared/state").state;
+        state.dustThresholdGwei = 100000;
+
+        const settings = require("../src/popup/views/settings");
+        settings.init({});
+        return elements["settings-dust-threshold"];
+    }
+
+    beforeEach(() => {
+        globalThis.chrome = {
+            runtime: { sendMessage: () => {} },
+            storage: {
+                local: {
+                    get: async () => ({}),
+                    set: async () => {
+                        saves++;
+                    },
+                },
+            },
+        };
+    });
+
+    afterEach(() => {
+        jest.dontMock("../src/popup/views/helpers");
+        delete globalThis.chrome;
+    });
+
+    async function change(field, typed) {
+        field.value = typed;
+        await field.listeners.change();
+    }
+
+    test("a valid value is stored and says nothing", async () => {
+        const field = loadSettingsView();
+
+        await change(field, "250");
+
+        expect(state.dustThresholdGwei).toBe(250);
+        expect(field.value).toBe(250);
+        expect(flashes).toEqual([]);
+        expect(saves).toBe(1);
+    });
+
+    test("a rejected value shows the message and is not stored", async () => {
+        const field = loadSettingsView();
+
+        await change(field, "1.5");
+
+        expect(state.dustThresholdGwei).toBe(100000);
+        expect(flashes).toEqual([DUST_THRESHOLD_MESSAGE]);
+        expect(saves).toBe(0);
+    });
+
+    // The snap-back is the behaviour the message explains, so it stays.
+    test("a rejected value still resyncs the field to what is stored", async () => {
+        const field = loadSettingsView();
+
+        await change(field, "100 gwei");
+
+        expect(field.value).toBe(100000);
+    });
+
+    test("every rejected notation gets the same one message", async () => {
+        for (const typed of ["", "-1", "1.5", "100 gwei", "0x10", "1e3"]) {
+            const field = loadSettingsView();
+
+            await change(field, typed);
+
+            expect(flashes).toEqual([DUST_THRESHOLD_MESSAGE]);
+            expect(state.dustThresholdGwei).toBe(100000);
+        }
+    });
+
+    test("zero is accepted, not treated as an empty field", async () => {
+        const field = loadSettingsView();
+
+        await change(field, "0");
+
+        expect(state.dustThresholdGwei).toBe(0);
+        expect(flashes).toEqual([]);
+    });
+});

tests/e2e/firefox/Dockerfile

@@ -0,0 +1,51 @@
+# Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
+# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
+# harness itself has no dependencies, so nothing is installed for it.
+#
+# All three external artifacts are pinned by digest. The Firefox version in
+# particular must not float: -remote-allow-system-access is mandatory on 153
+# and was not on 142, so the flag the harness passes is version-coupled.
+
+# node:22-bookworm-slim, 2026-08-12
+FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Firefox's shared-library dependencies on a slim base, plus the two tools
+# needed to fetch and unpack the pinned tarballs.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        libasound2 \
+        libdbus-glib-1-2 \
+        libgtk-3-0 \
+        libx11-xcb1 \
+        libxt6 \
+        libxtst6 \
+        xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# Firefox 153.0.3, linux-x86_64, en-US
+ARG FIREFOX_URL=https://ftp.mozilla.org/pub/firefox/releases/153.0.3/linux-x86_64/en-US/firefox-153.0.3.tar.xz
+ARG FIREFOX_SHA256=22b312280900bfb174b685ece32c7b3c6d72e7f8e53d6d30f21ac41a8dc500a2
+RUN curl -fsSL -o /tmp/firefox.tar.xz "$FIREFOX_URL" \
+    && echo "$FIREFOX_SHA256  /tmp/firefox.tar.xz" | sha256sum -c - \
+    && tar -xJf /tmp/firefox.tar.xz -C /opt \
+    && rm /tmp/firefox.tar.xz \
+    && /opt/firefox/firefox --version
+
+# geckodriver v0.36.0, linux64
+ARG GECKODRIVER_URL=https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
+ARG GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
+RUN curl -fsSL -o /tmp/geckodriver.tar.gz "$GECKODRIVER_URL" \
+    && echo "$GECKODRIVER_SHA256  /tmp/geckodriver.tar.gz" | sha256sum -c - \
+    && tar -xzf /tmp/geckodriver.tar.gz -C /usr/local/bin \
+    && rm /tmp/geckodriver.tar.gz \
+    && geckodriver --version
+
+ENV FIREFOX_BIN=/opt/firefox/firefox
+ENV GECKODRIVER=/usr/local/bin/geckodriver
+
+WORKDIR /work
+CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]

tests/e2e/firefox/driver.js

@@ -0,0 +1,464 @@
+// A minimal WebDriver client for geckodriver, plus the privileged console
+// reader the error assertions are built on. No npm dependencies: global
+// fetch and child_process against geckodriver's HTTP API is less code than
+// a driver library and keeps the harness at zero packages.
+//
+// Run through script/test-e2e-firefox, which builds dist/firefox/ and the
+// pinned container around this. FIREFOX_BIN and GECKODRIVER locate the two
+// binaries; the image sets both.
+
+"use strict";
+
+const { spawn } = require("child_process");
+const net = require("net");
+
+const FIREFOX_BIN = process.env.FIREFOX_BIN || "firefox";
+const GECKODRIVER = process.env.GECKODRIVER || "geckodriver";
+
+// The extension id declared in manifest/firefox.json, and the uuid the
+// popup is served from. Firefox normally assigns that uuid randomly per
+// profile, which would make the popup URL undiscoverable without querying
+// privileged state; setting extensions.webextensions.uuids before launch
+// pins it instead. This only works because the manifest declares a fixed
+// browser_specific_settings.gecko.id — without one the mapping has no key.
+const EXTENSION_ID = "autistmask@sneak.berlin";
+const EXTENSION_UUID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+const EXTENSION_ORIGIN = "moz-extension://" + EXTENSION_UUID;
+
+// The W3C web element identifier. Getting the last character wrong yields
+// an element reference of "undefined" and a bewildering "element with the
+// reference undefined is not known" from geckodriver, so findElement()
+// below checks for the key rather than indexing blindly.
+const WEB_ELEMENT_KEY = "element-6066-11e4-a52e-4f735466cecf";
+
+const SCRIPT_TIMEOUT_MS = 120000;
+const DEFAULT_WAIT_MS = 20000;
+const POLL_INTERVAL_MS = 100;
+
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// An ephemeral port picked by the kernel, then handed to geckodriver.
+// There is a race between closing this listener and geckodriver binding,
+// but this host runs many sessions at once and a fixed 4444 is a
+// guaranteed collision rather than a possible one.
+function freePort() {
+    return new Promise((resolve, reject) => {
+        const srv = net.createServer();
+        srv.on("error", reject);
+        srv.listen(0, "127.0.0.1", () => {
+            const { port } = srv.address();
+            srv.close(() => resolve(port));
+        });
+    });
+}
+
+class WebDriverError extends Error {
+    constructor(command, body) {
+        const v = (body && body.value) || {};
+        super(
+            command +
+                " failed: " +
+                (v.error || "unknown error") +
+                ": " +
+                (v.message || JSON.stringify(body)),
+        );
+        this.name = "WebDriverError";
+        this.error = v.error;
+    }
+}
+
+class Driver {
+    constructor(proc, base) {
+        this.proc = proc;
+        this.base = base;
+        this.sessionId = null;
+        this.context = "content";
+    }
+
+    async send(method, path, body) {
+        const url = this.base + path;
+        const res = await fetch(url, {
+            method,
+            headers: { "Content-Type": "application/json" },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        } catch (_) {
+            throw new Error(
+                method + " " + path + ": non-JSON response: " + text,
+            );
+        }
+        if (!res.ok) throw new WebDriverError(method + " " + path, parsed);
+        return parsed.value;
+    }
+
+    session(method, path, body) {
+        return this.send(method, "/session/" + this.sessionId + path, body);
+    }
+
+    // ------------------------------------------------------------ setup
+
+    async newSession() {
+        const prefs = {
+            // See EXTENSION_UUID above. The pref is a string pref whose
+            // value is itself JSON.
+            "extensions.webextensions.uuids": JSON.stringify({
+                [EXTENSION_ID]: EXTENSION_UUID,
+            }),
+        };
+
+        const value = await this.send("POST", "/session", {
+            capabilities: {
+                alwaysMatch: {
+                    browserName: "firefox",
+                    "moz:firefoxOptions": {
+                        binary: FIREFOX_BIN,
+                        args: [
+                            "-headless",
+                            // Mandatory on Firefox 153: without it,
+                            // navigating to moz-extension:// and running
+                            // chrome-context script both fail with
+                            // "unsupported operation".
+                            //
+                            // It grants the driver FULL CHROME PRIVILEGES
+                            // over this browser. Acceptable only because
+                            // the browser is a throwaway in a CI
+                            // container; never point a session with this
+                            // flag at anything you care about.
+                            "-remote-allow-system-access",
+                        ],
+                        prefs,
+                    },
+                },
+            },
+        });
+        this.sessionId = value.sessionId;
+        await this.session("POST", "/timeouts", { script: SCRIPT_TIMEOUT_MS });
+        return value;
+    }
+
+    // Installs the unpacked MV2 build straight from a directory.
+    // temporary:true bypasses signature checks, so no XPI and no signing
+    // are involved, and the add-on dies with the profile.
+    async installAddon(dir) {
+        return this.session("POST", "/moz/addon/install", {
+            path: dir,
+            temporary: true,
+        });
+    }
+
+    // Classic navigation on purpose. BiDi's browsingContext.navigate
+    // refuses moz-extension:// URLs outright.
+    async navigate(url) {
+        await this.session("POST", "/url", { url });
+    }
+
+    async quit() {
+        if (this.sessionId) {
+            await this.session("DELETE", "").catch(() => {});
+            this.sessionId = null;
+        }
+        this.proc.kill("SIGTERM");
+    }
+
+    // ---------------------------------------------------------- scripts
+
+    async setContext(context) {
+        if (this.context === context) return;
+        await this.session("POST", "/moz/context", { context });
+        this.context = context;
+    }
+
+    async execute(script, args = []) {
+        await this.setContext("content");
+        return this.session("POST", "/execute/sync", { script, args });
+    }
+
+    // Runs in the privileged chrome scope, where Services and Ci exist.
+    async executeChrome(script, args = []) {
+        await this.setContext("chrome");
+        try {
+            return await this.session("POST", "/execute/sync", {
+                script,
+                args,
+            });
+        } finally {
+            await this.setContext("content");
+        }
+    }
+
+    // ------------------------------------------------------- page waits
+
+    // Polls a content-context expression until it returns truthy. Every
+    // wait in the suite goes through here so a timeout always says which
+    // condition it was waiting on rather than "timed out".
+    async waitFor(what, script, args = [], timeout = DEFAULT_WAIT_MS) {
+        const deadline = Date.now() + timeout;
+        let last = null;
+        for (;;) {
+            try {
+                const v = await this.execute(script, args);
+                if (v) return v;
+                last = null;
+            } catch (e) {
+                // A navigation or view swap in flight makes execute
+                // throw; that is a not-yet, not a failure, until the
+                // deadline says otherwise.
+                last = e.message;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(
+                    "timed out after " +
+                        timeout +
+                        "ms waiting for " +
+                        what +
+                        (last ? " (last error: " + last + ")" : ""),
+                );
+            }
+            await sleep(POLL_INTERVAL_MS);
+        }
+    }
+
+    // Shown means shown: in the popup a view is switched by toggling a
+    // "hidden" class, and an element that is present but collapsed is not
+    // the thing a test means by visible.
+    async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
+        return this.waitFor(
+            "selector " + selector + " to be visible",
+            `const el = document.querySelector(arguments[0]);
+             if (!el) return false;
+             const r = el.getBoundingClientRect();
+             return r.width > 0 && r.height > 0;`,
+            [selector],
+            timeout,
+        );
+    }
+
+    async isVisible(selector) {
+        return this.execute(
+            `const el = document.querySelector(arguments[0]);
+             if (!el) return false;
+             const r = el.getBoundingClientRect();
+             return r.width > 0 && r.height > 0;`,
+            [selector],
+        );
+    }
+
+    async count(selector) {
+        return this.execute(
+            "return document.querySelectorAll(arguments[0]).length;",
+            [selector],
+        );
+    }
+
+    async text(selector) {
+        return this.execute(
+            `const el = document.querySelector(arguments[0]);
+             return el ? el.textContent : null;`,
+            [selector],
+        );
+    }
+
+    async title() {
+        return this.session("GET", "/title");
+    }
+
+    // The id of the view element currently on top, which is what a
+    // failing step needs to report: "the screen did not change" is only
+    // useful if it says which screen it stayed on.
+    async currentView() {
+        return this.execute(
+            `const views = document.querySelectorAll('[id^="view-"]');
+             for (const v of views) {
+                 const r = v.getBoundingClientRect();
+                 if (r.width > 0 && r.height > 0) return v.id;
+             }
+             return null;`,
+        );
+    }
+
+    // ----------------------------------------------------- interactions
+
+    async findElement(selector) {
+        const value = await this.session("POST", "/element", {
+            using: "css selector",
+            value: selector,
+        });
+        const ref = value && value[WEB_ELEMENT_KEY];
+        if (typeof ref !== "string") {
+            throw new Error(
+                "no " +
+                    WEB_ELEMENT_KEY +
+                    " in the element response for " +
+                    selector +
+                    ": " +
+                    JSON.stringify(value),
+            );
+        }
+        return ref;
+    }
+
+    // Real WebDriver clicks and real key events rather than in-page
+    // .click() and value assignment: the popup's handlers are wired to
+    // events, and synthesising them from inside the page would test the
+    // harness's idea of the UI instead of the UI.
+    async click(selector) {
+        await this.waitVisible(selector);
+        const id = await this.findElement(selector);
+        await this.session("POST", "/element/" + id + "/click", {});
+    }
+
+    async fill(selector, value) {
+        await this.waitVisible(selector);
+        const id = await this.findElement(selector);
+        await this.session("POST", "/element/" + id + "/clear", {});
+        await this.session("POST", "/element/" + id + "/value", {
+            text: String(value),
+        });
+    }
+
+    async value(selector) {
+        return this.execute(
+            `const el = document.querySelector(arguments[0]);
+             return el ? el.value : null;`,
+            [selector],
+        );
+    }
+}
+
+// ------------------------------------------------------- error capture
+
+// Uncaught errors from extension code, read out of the privileged console
+// service.
+//
+// This is not the obvious mechanism, and the obvious one does not work:
+// WebDriver BiDi's log.entryAdded delivers NOTHING for extension pages.
+// Verified on Firefox 142 and 153 against a same-session control — a plain
+// http:// page yields uncaught errors with stack traces, the
+// moz-extension:// popup yields zero events, because the remote agent
+// excludes extension browsing contexts from BiDi observation. A harness
+// built on Playwright-BiDi or Puppeteer-BiDi therefore sees nothing and
+// reports success. Do not "simplify" this back to BiDi.
+//
+// nsIConsoleService is not per-page: it also carries errors from the
+// background page, which BiDi would not have covered even if it worked.
+// Background-page capture is verified by probe — a throw at the top of
+// src/background/index.js, which kills the background page outright, fails
+// the run. Content-script errors should arrive by the same route, but that
+// is UNVERIFIED here and must not be claimed: the container runs with
+// --network none, so there is no http:// page for a content script to be
+// injected into and this suite never exercises one.
+//
+// Warnings are excluded so the semantics match Playwright's pageerror:
+// uncaught errors only.
+//
+// The read and the clear are ONE chrome script on purpose. Splitting them
+// into two round trips leaves a blind window between them in which an
+// error is logged into a buffer that is about to be discarded, and is
+// destroyed unread rather than deferred to the next drain. That was not
+// theoretical: with a separate reset() call, a probe of 100 sequenced
+// throws at 20ms spacing lost one of them outright.
+const DRAIN_ERRORS_SCRIPT = `
+    const origin = arguments[0];
+    const out = [];
+    for (const raw of Services.console.getMessageArray() || []) {
+        let e;
+        try {
+            e = raw.QueryInterface(Ci.nsIScriptError);
+        } catch (_) {
+            continue;
+        }
+        if (e.flags & Ci.nsIScriptError.warningFlag) continue;
+        const src = e.sourceName || "";
+        if (!src.startsWith(origin)) continue;
+        out.push({
+            msg: e.errorMessage,
+            src: src,
+            line: e.lineNumber,
+            cat: e.category,
+        });
+    }
+    Services.console.reset();
+    return out;
+`;
+
+class ConsoleErrors {
+    constructor(driver, originPrefix) {
+        this.driver = driver;
+        this.originPrefix = originPrefix;
+    }
+
+    // Everything logged since the last take, read and cleared atomically
+    // in a single chrome round trip. Poll-based, so an error is attributed
+    // to the step that was running when it was drained, not to the moment
+    // inside that step at which it happened — see the limitation note in
+    // run.js. An error that arrives mid-drain is not lost — it makes this
+    // batch or the next one — but the console service ring buffer holds
+    // only 250 messages, so more than that between two takes evicts the
+    // oldest unread. A clean run peaks at 4.
+    async take() {
+        const found = await this.driver.executeChrome(DRAIN_ERRORS_SCRIPT, [
+            this.originPrefix,
+        ]);
+        return found || [];
+    }
+}
+
+// ------------------------------------------------------------- startup
+
+async function waitForDriverReady(base, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            const res = await fetch(base + "/status");
+            if (res.ok) {
+                const body = await res.json();
+                if (body && body.value && body.value.ready !== false) return;
+            }
+        } catch (_) {
+            // not listening yet
+        }
+        if (Date.now() >= deadline) {
+            throw new Error(
+                "geckodriver did not become ready within " + timeoutMs + "ms",
+            );
+        }
+        await sleep(POLL_INTERVAL_MS);
+    }
+}
+
+async function start() {
+    const port = await freePort();
+    const proc = spawn(
+        GECKODRIVER,
+        ["--port", String(port), "--host", "127.0.0.1"],
+        { stdio: ["ignore", "inherit", "inherit"] },
+    );
+    proc.on("error", (e) => {
+        console.error("geckodriver failed to spawn: " + e.message);
+    });
+
+    const base = "http://127.0.0.1:" + port;
+    try {
+        await waitForDriverReady(base, 30000);
+    } catch (e) {
+        proc.kill("SIGKILL");
+        throw e;
+    }
+    return new Driver(proc, base);
+}
+
+module.exports = {
+    ConsoleErrors,
+    Driver,
+    EXTENSION_ID,
+    EXTENSION_ORIGIN,
+    EXTENSION_UUID,
+    start,
+    sleep,
+};

tests/e2e/firefox/run.js

@@ -0,0 +1,288 @@
+// Firefox end-to-end suite: drives the real popup in a real Firefox with
+// the unpacked MV2 build installed as a temporary add-on, and fails the run
+// on any uncaught error coming from an extension source.
+//
+// Run via script/test-e2e-firefox, which builds dist/firefox/ and the pinned
+// container. The extension directory is the one argument.
+//
+//   node tests/e2e/firefox/run.js [dist/firefox]
+//
+// Deliberately not part of script/check, and deliberately not named
+// *.test.js: REPO_POLICIES.md caps make test at 20 seconds and a browser
+// suite does not fit.
+//
+// This shares no driver layer with the Chrome suite in tests/e2e/, and the
+// UI steps below are written twice on purpose. Chrome runs on Playwright,
+// which cannot see extension-page errors in Firefox at all (see the BiDi
+// note in driver.js), so the two backends have no common substrate to
+// abstract over. Three duplicated steps do not pay for a shim; revisit if
+// this suite grows to where they do.
+//
+// LIMITATION, and the difference from the Chrome suite worth knowing: error
+// capture here is POLL-BASED, not event-streamed. The console service is
+// drained at each step boundary, so an error is attributed to the step it
+// was drained after, never to a moment within that step. What is drained
+// covers the whole run from add-on install to the last drain below, which
+// lands ~1.5s after the last step returns (500ms settle + 1000ms sleep +
+// two drain round trips). That cut-off jitters run to run: three runs of
+// throws at fixed offsets reported everything to +1.5s and one of them
+// also +1.6s, and past it the browser is torn down first. Inside the
+// window there is no race — the drain reads and clears in one chrome
+// round trip — but there is a capacity limit: nsIConsoleService keeps
+// only the newest 250 messages, so 400 throws in one step report as
+// exactly 250. A clean run peaks at 4 of 250, so that is headroom today
+// and not a guarantee for a step that logs heavily. The Chrome harness
+// receives pageerror events as they happen and can say more. Do not read
+// a green Firefox run as the same claim.
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const { ConsoleErrors, EXTENSION_ORIGIN, start, sleep } = require("./driver");
+
+const REPO_ROOT = path.resolve(__dirname, "..", "..", "..");
+const POPUP_URL = EXTENSION_ORIGIN + "/src/popup/index.html";
+const PASSWORD = "e2e-harness-password";
+
+// Firefox installs the add-on and starts its background page asynchronously
+// after the install call returns. Nothing observable marks the end of that,
+// so the popup's own first render is the signal we wait on instead.
+const STEP_TIMEOUT_MS = 120000;
+
+const steps = [];
+
+function step(name, fn) {
+    steps.push({ name, fn });
+}
+
+function assert(cond, message) {
+    if (!cond) throw new Error(message);
+}
+
+function withTimeout(promise, name) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(
+            () =>
+                reject(
+                    new Error(
+                        name + " timed out after " + STEP_TIMEOUT_MS + "ms",
+                    ),
+                ),
+            STEP_TIMEOUT_MS,
+        );
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+// ------------------------------------------------------------- steps
+
+step("popup loads and reaches the welcome view", async (env) => {
+    const d = env.driver;
+    await d.navigate(POPUP_URL);
+    await d.waitVisible("#view-welcome", STEP_TIMEOUT_MS);
+    const title = await d.title();
+    assert(title === "AutistMask", "unexpected popup title: " + title);
+});
+
+step("wallet creation through the UI reaches the main view", async (env) => {
+    const d = env.driver;
+    await d.click("#btn-welcome-add");
+    await d.waitVisible("#view-add-wallet");
+    await d.click("#btn-generate-phrase");
+    await d.waitFor(
+        "a generated recovery phrase of at least 12 words",
+        `const el = document.getElementById("wallet-mnemonic");
+         return !!el && el.value.trim().split(/\\s+/).length >= 12;`,
+    );
+    env.phrase = (await d.value("#wallet-mnemonic")).trim();
+
+    await d.fill("#add-wallet-password", PASSWORD);
+    await d.fill("#add-wallet-password-confirm", PASSWORD);
+    await d.click("#btn-add-wallet-confirm");
+    // Argon2id under libsodium, for real, so this is the slow one.
+    await d.waitVisible("#view-main", STEP_TIMEOUT_MS);
+
+    assert(
+        env.phrase.split(/\s+/).length >= 12,
+        "wallet creation did not yield a recovery phrase",
+    );
+    const addrs = await d.count("#wallet-list .btn-addr-info");
+    assert(addrs > 0, "no addresses rendered in the wallet list");
+});
+
+step("add token screen opens from address detail", async (env) => {
+    const d = env.driver;
+    if (!(await d.isVisible("#view-address"))) {
+        await d.waitVisible("#view-main");
+        await d.click("#wallet-list .btn-addr-info");
+    }
+    await d.waitVisible("#view-address");
+
+    await d.click("#btn-add-token");
+    // Reported with the view it actually stayed on: a screen that does
+    // not change is the symptom a missing import produces, and naming
+    // the screen is what makes that diagnosable.
+    try {
+        await d.waitVisible("#view-add-token");
+    } catch (e) {
+        throw new Error(
+            e.message + "; current view is " + (await d.currentView()),
+        );
+    }
+
+    const picks = await d.count("#common-token-list .common-token");
+    assert(picks > 0, "no common-token quick-pick buttons rendered");
+});
+
+// ------------------------------------------------------------- runner
+
+function formatError(e) {
+    return (
+        e.msg + " (" + e.src + ":" + e.line + (e.cat ? ", " + e.cat : "") + ")"
+    );
+}
+
+async function main() {
+    // A suite that runs nothing must never report success.
+    if (steps.length === 0) {
+        console.log("1..0");
+        console.log("# FAILED: the Firefox e2e suite registered no steps");
+        process.exitCode = 1;
+        return;
+    }
+
+    const extDir = path.resolve(REPO_ROOT, process.argv[2] || "dist/firefox");
+    if (!fs.existsSync(path.join(extDir, "manifest.json"))) {
+        console.error(
+            "e2e-firefox: no unpacked build at " +
+                extDir +
+                " — run make build first",
+        );
+        process.exitCode = 1;
+        return;
+    }
+
+    let driver;
+    try {
+        driver = await start();
+        await driver.newSession();
+        await driver.installAddon(extDir);
+    } catch (e) {
+        // A browser we cannot start is a failure of the suite, not an
+        // absent suite. Never skip and report success.
+        console.error("e2e-firefox: cannot run the suite: " + e.message);
+        if (driver) await driver.quit().catch(() => {});
+        process.exitCode = 1;
+        return;
+    }
+
+    const errors = new ConsoleErrors(driver, EXTENSION_ORIGIN);
+    const env = { driver, phrase: null };
+
+    console.log("# extension origin: " + EXTENSION_ORIGIN);
+    console.log("1.." + steps.length);
+
+    let failed = 0;
+    let n = 0;
+    try {
+        // Drain, never reset: anything the add-on logged while installing
+        // and starting its background page has no earlier step to belong
+        // to, so it is folded into step 1 below. Services.console.reset()
+        // here would DELETE it instead, and a background page that throws
+        // at the top of the file — a dead background page — would then
+        // produce a fully green run.
+        let installErrors = [];
+        let installFailure = null;
+        try {
+            installErrors = await errors.take();
+        } catch (e) {
+            installFailure =
+                "could not read the console after install: " + e.message;
+        }
+
+        for (const s of steps) {
+            n += 1;
+            let failure = null;
+            try {
+                await withTimeout(s.fn(env), s.name);
+            } catch (e) {
+                failure = e.message;
+            }
+
+            // Let anything the step provoked reach the console service
+            // before draining it. Without this a failure logged on the
+            // way out of the step lands in the next step's drain, which
+            // still fails the run but blames the wrong step.
+            await sleep(500);
+
+            let found = [];
+            try {
+                found = await errors.take();
+            } catch (e) {
+                failure = failure || "could not read the console: " + e.message;
+            }
+
+            if (n === 1) {
+                found = installErrors.concat(found);
+                installErrors = [];
+                failure = failure || installFailure;
+                installFailure = null;
+            }
+
+            // Any uncaught error from an extension source fails the step
+            // that provoked it, whether or not its assertions passed.
+            if (!failure && found.length > 0) {
+                failure =
+                    n === 1
+                        ? "uncaught extension errors during add-on install, " +
+                          "background startup or this step"
+                        : "uncaught extension errors during this step";
+            }
+
+            if (failure) {
+                failed += 1;
+                console.log("not ok " + n + " - " + s.name);
+                console.log("  " + failure);
+                for (const e of found) console.log("  " + formatError(e));
+            } else {
+                console.log("ok " + n + " - " + s.name);
+            }
+        }
+
+        // The tail: errors logged after the last step returned cannot be
+        // blamed on any one step, but they are still reported and they
+        // still fail the run.
+        await sleep(1000);
+        const trailing = await errors.take();
+        console.log(
+            "# " +
+                (steps.length - failed) +
+                "/" +
+                steps.length +
+                " steps passed",
+        );
+        if (trailing.length > 0) {
+            console.log(
+                "# " +
+                    trailing.length +
+                    " extension error(s) recorded after the last step, not " +
+                    "attributable to any single step:",
+            );
+            for (const e of trailing) console.log("#   " + formatError(e));
+        }
+        if (failed > 0 || trailing.length > 0) {
+            console.log("# FAILED");
+            process.exitCode = 1;
+        }
+    } finally {
+        await driver.quit().catch(() => {});
+    }
+}
+
+main().catch((e) => {
+    console.error("e2e-firefox: " + (e && e.stack ? e.stack : e));
+    process.exitCode = 1;
+});

tests/e2e/harness.js

@@ -0,0 +1,349 @@
+// End-to-end harness: launches a real Chromium with the unpacked MV3
+// build loaded, collects every uncaught page error and console.error, and
+// exposes the popup flows the tests drive.
+//
+// This runs inside the pinned Playwright container; see script/test-e2e.
+// It is deliberately NOT part of make check — REPO_POLICIES.md caps
+// make test at 20 seconds and a browser suite does not fit.
+
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const { chromium } = require("playwright-core");
+const { installNetworkStubs } = require("./network");
+
+const REPO_ROOT = path.resolve(__dirname, "..", "..");
+const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
+
+// Page errors that are known, tracked, and deliberately tolerated. Every
+// entry must name the issue that will remove it. This list is the one
+// concession in an otherwise zero-tolerance policy: an uncaught error is
+// how this harness caught issue #150 in the first place.
+//
+// Empty, and worth keeping that way. Its only entry was the WASM
+// CompileError libsodium provoked on every popup load, deleted with #182
+// when both manifests started allowing WASM; the run that used to need it
+// is now the run that proves the fix.
+const ALLOWED_ERRORS = [];
+
+function isAllowed(text) {
+    return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
+}
+
+// Collects every uncaught page error, console.error and unstubbed
+// request, and hands each one to exactly one reporter.
+//
+// This deliberately has NO window API. It used to expose mark()/since()
+// so a test could ask for "the errors since I started", and that shape
+// produced a green run that proved nothing twice over: first the mark
+// started after test 1, so everything recorded during launch was
+// discarded, then the tail after the final test was never read at all. In
+// both cases a record fell outside somebody's window and vanished, which
+// is the precise failure this harness exists to prevent.
+//
+// So there is no window left to fall outside of. take() is the only
+// reader and it always takes everything outstanding, so successive takes
+// partition the entire record stream with no gaps, and the runner turns
+// every record it reads into a failure.
+//
+// Observation ends when the browser context is closed. Nothing records
+// after that — the route handler and the console listeners are gone with
+// the context — so there is no post-teardown phase to collect, and this
+// class deliberately offers no mechanism pretending to cover one.
+//
+// One narrow exception exists, and it is not a mute: expect(). A test that
+// drives a failure path on purpose — a refused gas estimate, say — provokes
+// the console.error the code is supposed to emit, and that error is the
+// behaviour under test rather than an escape. Declaring it consumes exactly
+// one matching record and no more, and an expectation nothing matched fails
+// its test just as an unexpected error does. So it cannot be used to
+// silence anything: it can only assert that a specific error happened.
+class ErrorCollector {
+    constructor() {
+        this.entries = [];
+        this.taken = 0;
+        this.expectations = [];
+    }
+
+    // Declare a console.error this test is about to cause deliberately.
+    // `label` names it in the failure message if it never arrives.
+    expect(label, pattern) {
+        this.expectations.push({ label, pattern, matched: false });
+    }
+
+    // Declared expectations that nothing matched, clearing the list so each
+    // test starts with none outstanding.
+    unmatchedExpectations() {
+        const out = this.expectations
+            .filter((e) => !e.matched)
+            .map((e) => e.label);
+        this.expectations = [];
+        return out;
+    }
+
+    record(kind, text) {
+        const line = kind + ": " + String(text).split("\n")[0];
+        if (isAllowed(line)) return;
+        const expected = this.expectations.find(
+            (e) => !e.matched && e.pattern.test(line),
+        );
+        if (expected) {
+            expected.matched = true;
+            return;
+        }
+        this.entries.push(line);
+    }
+
+    // Everything recorded since the previous take(). Never yields a
+    // record twice and never skips one.
+    take() {
+        const out = this.entries.slice(this.taken);
+        this.taken = this.entries.length;
+        return out;
+    }
+}
+
+function attachErrorListeners(ctx, errors) {
+    const attachPage = (page) => {
+        page.on("pageerror", (err) => {
+            errors.record("pageerror", err.message || String(err));
+        });
+        page.on("console", (msg) => {
+            if (msg.type() === "error") {
+                errors.record("console.error", msg.text());
+            }
+        });
+    };
+    ctx.pages().forEach(attachPage);
+    ctx.on("page", attachPage);
+    // Per-page listeners only: the context-level "weberror" event covers
+    // the same page exceptions and would double-report them. Playwright
+    // exposes no error EVENT for service workers, so an uncaught
+    // exception in the background worker is not visible here — everything
+    // this suite drives lives in the popup page. That is an error-channel
+    // gap only: worker NETWORK traffic is intercepted and reported like
+    // any other, and assertWorkerTrafficIntercepted() below fails the run
+    // if it ever stops being.
+}
+
+async function serviceWorker(ctx) {
+    const [existing] = ctx.serviceWorkers();
+    if (existing) return existing;
+    return ctx.waitForEvent("serviceworker", { timeout: 30000 });
+}
+
+// How long to wait for the background worker's first outbound request.
+//
+// The margin that actually decides whether this check is sound is not
+// this timeout — it is whether the route handler is installed before the
+// worker fetches. Measured over several runs: route installation
+// completes 11-23ms after the context comes up, and the worker's
+// blocklist fetch arrives 525-883ms after that, so the route wins by
+// roughly 25-50x. This 30s figure is only slack for a loaded machine on
+// top of that; losing the race fails the run rather than passing it
+// quietly, which was verified by forcing a 3s delay before route
+// installation.
+const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
+
+// ctx.route() only sees service-worker requests when Playwright runs with
+// PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
+// sets. Without it the worker's traffic — notably the phishing blocklist
+// fetch src/background/index.js issues at startup — goes to the real
+// internet, and nothing says so, because src/shared/phishingDomains.js
+// swallows fetch failures. A harness whose isolation can lapse in silence
+// is worthless, so this does not take the flag on trust: the background
+// worker's own startup fetch has to show up in the route handler, or the
+// suite refuses to run.
+//
+// Deliberately NOT a synthetic probe fetched through worker.evaluate():
+// evaluating in an extension worker this early kills it (the call fails
+// with "Target page, context or browser has been closed" and the worker
+// disappears), which would break the very thing being measured. Observing
+// traffic the extension already generates costs nothing and cannot
+// perturb it.
+async function assertWorkerTrafficIntercepted(stubs) {
+    const seen = await stubs.waitForServiceWorkerTraffic(
+        WORKER_TRAFFIC_TIMEOUT_MS,
+    );
+    if (seen) return seen;
+
+    // State the observation, not a conclusion. This fires for at least
+    // two quite different causes and the harness cannot tell them apart
+    // from here, so guessing one of them in the message sends the reader
+    // the wrong way.
+    throw new Error(
+        "observed no service-worker request in the route handler within " +
+            WORKER_TRAFFIC_TIMEOUT_MS +
+            "ms. Under working interception the background worker's " +
+            "startup blocklist fetch (src/background/index.js) reaches the " +
+            "handler about half a second after the route is installed. " +
+            "Two causes are plausible and this check cannot distinguish " +
+            "them: (1) service-worker interception is not in effect, so " +
+            "that traffic went to the real internet unobserved — the suite " +
+            "must be run through script/test-e2e, which sets " +
+            "PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
+            "Playwright upgrade may have dropped or renamed that flag; " +
+            "(2) no worker request was made in the first place — the route " +
+            "lost the startup race, or the worker no longer fetches at " +
+            "startup, in which case this check needs a new anchor because " +
+            "there is no longer any worker traffic to observe. Either way " +
+            "the fix is a replacement mechanism or an honest downgrade of " +
+            "the isolation claims in tests/e2e/network.js and README.md — " +
+            "not deleting this check",
+    );
+}
+
+async function launch(routeOpts) {
+    if (!fs.existsSync(path.join(EXT_PATH, "manifest.json"))) {
+        throw new Error(
+            "no unpacked build at " +
+                EXT_PATH +
+                " — run make build before the e2e suite",
+        );
+    }
+
+    const userDir = fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-e2e-"));
+    const ctx = await chromium.launchPersistentContext(userDir, {
+        // channel: "chromium" is load-bearing. The default headless mode
+        // uses the headless shell, which silently refuses to load
+        // extensions: there is no error at all, the service worker simply
+        // never appears. This cost real debugging time once already.
+        channel: "chromium",
+        headless: true,
+        args: [
+            "--disable-extensions-except=" + EXT_PATH,
+            "--load-extension=" + EXT_PATH,
+            // The container runs unprivileged; Chrome's sandbox needs
+            // capabilities the harness deliberately does not grant it.
+            "--no-sandbox",
+            // Belt to the interception braces: nothing that slips past
+            // the route handler can resolve a name, so a request that
+            // escapes cannot actually reach the internet. Detection is
+            // still assertWorkerTrafficIntercepted()'s job — this only
+            // bounds the damage while a gap goes unnoticed. Playwright
+            // fulfils routed requests without touching the resolver, and
+            // it drives the browser over a pipe, so neither is affected.
+            "--host-resolver-rules=MAP * ~NOTFOUND",
+        ],
+    });
+
+    const cleanup = async () => {
+        await ctx.close().catch(() => {});
+        fs.rmSync(userDir, { recursive: true, force: true });
+    };
+
+    try {
+        const errors = new ErrorCollector();
+        attachErrorListeners(ctx, errors);
+        routeOpts.report = (text) => errors.record("network", text);
+        const stubs = await installNetworkStubs(ctx, routeOpts);
+
+        await assertWorkerTrafficIntercepted(stubs);
+
+        // The extension id is derived from the unpacked path, so it
+        // changes and must never be hardcoded. It is the host part of the
+        // service worker URL.
+        const sw = await serviceWorker(ctx);
+        const id = new URL(sw.url()).host;
+
+        return {
+            ctx,
+            errors,
+            extensionId: id,
+            popupUrl: "chrome-extension://" + id + "/src/popup/index.html",
+            close: cleanup,
+        };
+    } catch (e) {
+        // Anything that fails after the browser is up has to tear it down
+        // on the way out: an orphaned context keeps node alive forever,
+        // turning a clean failure into a hung run.
+        await cleanup();
+        throw e;
+    }
+}
+
+// ---------------------------------------------------------------- flows
+
+const PASSWORD = "e2e-harness-password";
+
+async function visible(page, selector, timeout = 15000) {
+    await page.waitForSelector(selector, { state: "visible", timeout });
+}
+
+// An empty WebAssembly module: magic number and version header, no
+// sections. Compiling it in the popup asks the one question that decides
+// libsodium's backend — may this realm compile WebAssembly — of the real
+// page under the real shipped manifest, which is the only place the
+// answer can be observed. Kept independent of src/shared/vault.js on
+// purpose: a bundle asked to grade itself proves less than an outside
+// observation of the same realm.
+const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
+
+async function pageCompilesWasm(page) {
+    return page.evaluate(async (bytes) => {
+        try {
+            await WebAssembly.compile(new Uint8Array(bytes));
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }, EMPTY_WASM_MODULE);
+}
+
+async function openPopup(ctx, popupUrl) {
+    const page = await ctx.newPage();
+    await page.goto(popupUrl);
+    return page;
+}
+
+// Full wallet creation through the real UI: BIP-39 generation, libsodium
+// vault encryption and extension storage persistence, for real.
+//
+// Returns the recovery phrase it generated. Tests that assert on a secret
+// need the real value — checking for "some 12 words" would pass against the
+// wrong wallet's phrase, and checking for nothing at all would pass against
+// a screen that shows the phrase it was supposed to hide.
+async function createWallet(page) {
+    await page.click("#btn-welcome-add");
+    await visible(page, "#view-add-wallet");
+    await page.click("#btn-generate-phrase");
+    await page.waitForFunction(() => {
+        const el = document.getElementById("wallet-mnemonic");
+        return el && el.value.trim().split(/\s+/).length >= 12;
+    });
+    const phrase = (await page.inputValue("#wallet-mnemonic")).trim();
+    await page.fill("#add-wallet-password", PASSWORD);
+    await page.fill("#add-wallet-password-confirm", PASSWORD);
+    await page.click("#btn-add-wallet-confirm");
+    await visible(page, "#view-main", 60000);
+    return phrase;
+}
+
+// Reach the address detail screen of the FIRST address of the first wallet,
+// from wherever the popup restored to. Clicking .address-row does not open
+// it; the [info] button does.
+//
+// .first() rather than a bare selector because the suite adds a second
+// wallet partway through, and every later test would otherwise die in
+// Playwright's strict mode rather than on an assertion.
+async function openAddressDetail(page) {
+    const onAddress = await page.isVisible("#view-address");
+    if (!onAddress) {
+        await visible(page, "#view-main");
+        await page.locator("#wallet-list .btn-addr-info").first().click();
+    }
+    await visible(page, "#view-address");
+}
+
+module.exports = {
+    PASSWORD,
+    createWallet,
+    launch,
+    openAddressDetail,
+    openPopup,
+    pageCompilesWasm,
+    visible,
+};

tests/e2e/network.js

@@ -0,0 +1,516 @@
+// Browser-level network interception for the end-to-end suite.
+//
+// Every http(s) request the extension makes — from the popup page AND
+// from the MV3 background service worker — is fulfilled from these
+// fixtures, so the suite is deterministic and runs entirely offline. The
+// probe that motivated this harness (see issue #181) observed live calls
+// to Blockscout returning 401 inside the container, which would make any
+// assertion about rendered transaction data worthless.
+//
+// Service-worker coverage is not free: ctx.route() only sees worker
+// traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
+// the environment, which script/test-e2e does. Without it the phishing
+// blocklist fetch that src/background/index.js issues at worker startup
+// silently reaches raw.githubusercontent.com on the open internet, and
+// src/shared/phishingDomains.js swallows the failure so nothing surfaces
+// it. That is not left to trust: waitForServiceWorkerTraffic() below
+// backs the launch-time canary in harness.js, which fails the entire
+// suite if worker requests stop being visible here.
+//
+// Anything not explicitly stubbed here is aborted AND reported to the
+// error collector, so a newly added outbound call shows up as a test
+// failure rather than as intermittent flakiness.
+
+"use strict";
+
+// Fictional ERC-20 used to seed the transaction-detail test. The symbol
+// must not collide with any entry in src/shared/tokenList.js, or
+// isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
+// symbol-spoofing attempt; holders_count must be >= 1000 or the default
+// hideLowHolderTokens filter drops it. Either would make the test pass
+// vacuously by never rendering a row at all.
+const STUB_TOKEN = {
+    address: "0xe2e0000000000000000000000000000000000e2e",
+    symbol: "E2E",
+    name: "End To End Test Token",
+    decimals: "6",
+    holders: "12345",
+};
+
+const STUB_COUNTERPARTY = "0xc0ffee0000000000000000000000000000c0ffee";
+
+const STUB_TX_HASH =
+    "0xe2e0000000000000000000000000000000000000000000000000000000000e2e";
+
+const STUB_BLOCK_NUMBER = 21000000;
+
+// Fixed instant so timeAgo() output is stable across runs.
+const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
+
+// A 32-byte zero word. Returned for every eth_call, which is what makes
+// ethers' ENS reverse lookup resolve to "no resolver set" and return null
+// instead of throwing. A throw would be logged by src/shared/ens.js via
+// log.errorf(), i.e. console.error, which fails the run on its own.
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+function hex(value) {
+    return "0x" + BigInt(value).toString(16);
+}
+
+// A bigint as a 32-byte ABI word.
+function word(value) {
+    return "0x" + BigInt(value).toString(16).padStart(64, "0");
+}
+
+// ------------------------------------------------------------ fee fixture
+//
+// The confirmation screen carries two different numbers for the same
+// transaction and may gate on only one of them:
+//
+//   reserve  = gasLimit * maxFeePerGas — what a node requires to be
+//              available for a type-2 transaction, and what the spend gate
+//              must use.
+//   estimate = gasLimit * gasPrice — what the transfer is expected to
+//              actually cost. Display only.
+//
+// Issue #154 was the gate reading the smaller of the two. ethers derives
+// maxFeePerGas as baseFeePerGas * 2 + maxPriorityFeePerGas, so the numbers
+// below put the reserve at very nearly twice the estimate. That gap is the
+// entire point of these values: it leaves room for a send that an
+// estimate-based gate accepts and a reserve-based gate refuses, which is
+// what lets the ConfirmTx tests tell the two apart at all. Collapse the gap
+// — by dropping baseFeePerGas from the block below, say — and those tests
+// go on passing while asserting nothing.
+const GAS_LIMIT = 21000n;
+const BASE_FEE_WEI = 100000000000n; // 100 gwei
+const PRIORITY_FEE_WEI = 1000000000n; // 1 gwei
+const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI; // 101 gwei
+const MAX_FEE_WEI = BASE_FEE_WEI * 2n + PRIORITY_FEE_WEI; // 201 gwei
+
+const FEE_ESTIMATE_WEI = GAS_LIMIT * GAS_PRICE_WEI; // 0.002121 ETH
+const FEE_RESERVE_WEI = GAS_LIMIT * MAX_FEE_WEI; // 0.004221 ETH
+
+const RPC_RESULTS = {
+    eth_chainId: "0x1",
+    net_version: "1",
+    eth_blockNumber: "0x1406f40",
+    eth_getBalance: "0x0",
+    eth_call: ZERO_WORD,
+    eth_getCode: "0x",
+    eth_gasPrice: hex(GAS_PRICE_WEI),
+    eth_estimateGas: hex(GAS_LIMIT),
+    eth_getTransactionCount: "0x0",
+    eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
+};
+
+// The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
+// to derive maxFeePerGas. Without it every fee is a legacy gasPrice, the
+// reserve and the estimate collapse to the same number, and the gate tests
+// stop being able to distinguish them.
+function latestBlock() {
+    return {
+        hash: "0x" + "11".repeat(32),
+        parentHash: "0x" + "22".repeat(32),
+        number: hex(STUB_BLOCK_NUMBER),
+        timestamp: hex(1767326645),
+        nonce: "0x0000000000000000",
+        difficulty: "0x0",
+        gasLimit: "0x1c9c380",
+        gasUsed: "0xf4240",
+        miner: STUB_COUNTERPARTY,
+        extraData: "0x",
+        baseFeePerGas: hex(BASE_FEE_WEI),
+        transactions: [],
+    };
+}
+
+// keccak("decimals()")[0:4].
+const SELECTOR_DECIMALS = "0x313ce567";
+
+// Every eth_call still answers with a zero word except decimals() on the
+// stub token. ethers reads that before it can encode an ERC-20 transfer,
+// and a zero there makes parseUnits() reject any fractional amount — so the
+// ERC-20 confirmation path would fail its gas estimate for a reason that
+// has nothing to do with what is being tested.
+function ethCallResult(req) {
+    const call = Array.isArray(req.params) ? req.params[0] : null;
+    if (!call || typeof call !== "object") return ZERO_WORD;
+    const data = String(call.data || call.input || "").toLowerCase();
+    const to = String(call.to || "").toLowerCase();
+    if (data.startsWith(SELECTOR_DECIMALS) && to === STUB_TOKEN.address) {
+        return word(STUB_TOKEN.decimals);
+    }
+    return ZERO_WORD;
+}
+
+function tokenObject() {
+    return {
+        address_hash: STUB_TOKEN.address,
+        address: STUB_TOKEN.address,
+        symbol: STUB_TOKEN.symbol,
+        name: STUB_TOKEN.name,
+        decimals: STUB_TOKEN.decimals,
+        holders_count: STUB_TOKEN.holders,
+        type: "ERC-20",
+    };
+}
+
+// One received ERC-20 transfer of 1.5 E2E to the address under test.
+function tokenTransferItems(address) {
+    return [
+        {
+            transaction_hash: STUB_TX_HASH,
+            block_number: STUB_BLOCK_NUMBER,
+            timestamp: STUB_TX_TIMESTAMP,
+            from: { hash: STUB_COUNTERPARTY },
+            to: { hash: address },
+            total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
+            token: tokenObject(),
+        },
+    ];
+}
+
+// A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
+// this is what puts an ERC-20 in the send screen's token dropdown, which is
+// the only way the confirmation screen's ERC-20 path can be reached.
+function tokenBalanceItems() {
+    return [
+        {
+            value: "1500000",
+            token: tokenObject(),
+        },
+    ];
+}
+
+// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
+// decoder short-circuits; the on-chain detail fields still populate.
+function transactionDetails() {
+    return {
+        hash: STUB_TX_HASH,
+        block_number: STUB_BLOCK_NUMBER,
+        nonce: 7,
+        gas_used: "51000",
+        gas_price: "1000000000",
+        fee: { value: "51000000000000" },
+        raw_input: "0x",
+        status: "ok",
+    };
+}
+
+function jsonResponse(route, body) {
+    return route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(body),
+    });
+}
+
+// Extract the address from a Blockscout /addresses/<addr>/... path.
+function blockscoutAddress(pathname) {
+    const m = pathname.match(/\/addresses\/(0x[0-9a-fA-F]{40})\//);
+    return m ? m[1] : null;
+}
+
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// How long a deliberately held reply is allowed to stay held, and how often
+// the release flag is re-read while it is.
+const HOLD_POLL_MS = 25;
+const HOLD_MAX_MS = 30000;
+
+// Hold a gas estimate open for as long as the test asks.
+//
+// opts.holdGasEstimate is read here rather than captured, so a test flips it
+// on the same options object the route was registered with — the same
+// pattern as seedTokenTransfer. This is the only way to observe the
+// confirmation screen while its estimate is genuinely in flight; sampling
+// the screen and hoping to win a race against the network would assert
+// nothing on a slow machine.
+//
+// It never gives up quietly. A hold that outlives the bound is reported like
+// any other harness fault, because a "pending" state that stopped being
+// pending on its own is a green assertion about the wrong screen.
+async function awaitRelease(opts, report) {
+    const started = Date.now();
+    while (opts.holdGasEstimate) {
+        if (Date.now() - started > HOLD_MAX_MS) {
+            report(
+                "held gas estimate was never released after " +
+                    HOLD_MAX_MS +
+                    "ms",
+            );
+            return;
+        }
+        await sleep(HOLD_POLL_MS);
+    }
+}
+
+// One JSON-RPC reply. Methods whose answer depends on a fixture a test has
+// set, or on the call itself, are resolved here; every other method is a
+// constant in RPC_RESULTS.
+function rpcReply(req, opts, report) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+
+    if (req.method === "eth_getBalance") {
+        return Object.assign(envelope, {
+            result: opts.ethBalanceWei || RPC_RESULTS.eth_getBalance,
+        });
+    }
+    if (req.method === "eth_call") {
+        return Object.assign(envelope, { result: ethCallResult(req) });
+    }
+    if (req.method === "eth_getBlockByNumber") {
+        return Object.assign(envelope, { result: latestBlock() });
+    }
+    if (req.method === "eth_estimateGas" && opts.failGasEstimate) {
+        // A refusal the node itself would produce, not a transport error:
+        // this is the shape the confirmation screen has to turn into
+        // "Unable to estimate" rather than into a fee of zero.
+        return Object.assign(envelope, {
+            error: {
+                code: -32000,
+                message: "e2e fixture: gas required exceeds allowance",
+            },
+        });
+    }
+
+    const result = RPC_RESULTS[req.method];
+    if (result === undefined) {
+        report("unstubbed RPC method: " + req.method);
+        return Object.assign(envelope, {
+            error: { code: -32601, message: "unstubbed in e2e harness" },
+        });
+    }
+    return Object.assign(envelope, { result });
+}
+
+async function handleRpc(route, postData, opts, report) {
+    let payload;
+    try {
+        payload = JSON.parse(postData || "null");
+    } catch {
+        report("unstubbed RPC: unparseable body " + String(postData));
+        return route.abort();
+    }
+    // ethers batches by default, so the body may be an array.
+    const batch = Array.isArray(payload) ? payload : [payload];
+
+    // Anything that is not a JSON-RPC object, or a NON-EMPTY batch of
+    // them, is not RPC at all and must be reported like any other
+    // unrecognised outbound traffic rather than dereferenced.
+    //
+    // The length check is not decoration: every() is vacuously true on an
+    // empty array, so without it a POST with body [] was answered 200 []
+    // and escaped the guard entirely (issue #187). No real batch is empty,
+    // so nothing legitimate is caught by it.
+    //
+    // Two distinct paths land a non-RPC body here, and neither is an
+    // empty-string special case. playwright-core's postData() is
+    // `buffer.toString("utf-8") || null`, so an absent or empty body
+    // decodes to null, JSON.parse("null") yields null, and the type guard
+    // below reports it. A binary body is instead decoded LOSSILY into
+    // mojibake — not null — which is not valid JSON, so the catch above
+    // reports that one. Both end up reported; only the route differs.
+    if (
+        payload === null ||
+        typeof payload !== "object" ||
+        batch.length === 0 ||
+        !batch.every((req) => req !== null && typeof req === "object")
+    ) {
+        report("unstubbed request: POST " + route.request().url());
+        return route.abort();
+    }
+    if (batch.some((req) => req.method === "eth_estimateGas")) {
+        await awaitRelease(opts, report);
+    }
+
+    const replies = batch.map((req) => rpcReply(req, opts, report));
+    return jsonResponse(route, Array.isArray(payload) ? replies : replies[0]);
+}
+
+const TRACE_TRUE = ["1", "true", "yes", "on"];
+const TRACE_FALSE = ["", "0", "false", "no", "off"];
+
+// Whether E2E_TRACE_NETWORK asks for the request trace.
+//
+// A set-but-unrecognised value is a hard error rather than a quiet
+// "off": E2E_TRACE_NETWORK=true asking for a trace and getting silence
+// is the operator being lied to about what the harness is doing, which
+// is the whole failure mode this suite exists to eliminate. Refusing to
+// guess costs one line and one obvious error message.
+function traceEnabled(raw) {
+    if (raw === undefined || raw === null) return false;
+    const v = String(raw).trim().toLowerCase();
+    if (TRACE_TRUE.includes(v)) return true;
+    if (TRACE_FALSE.includes(v)) return false;
+    throw new Error(
+        "E2E_TRACE_NETWORK is set to " +
+            JSON.stringify(String(raw)) +
+            ", which is not a recognised on/off value. Use one of " +
+            TRACE_TRUE.join(", ") +
+            " to enable the request trace, or one of " +
+            TRACE_FALSE.slice(1).join(", ") +
+            " to disable it. Refusing to guess: a diagnostic that silently " +
+            "does nothing is worse than one that is not there",
+    );
+}
+
+/**
+ * Route every http(s) request through local fixtures.
+ *
+ * @param {import("playwright-core").BrowserContext} ctx
+ * @param {object} opts
+ * @param {(text: string) => void} opts.report  called for unstubbed traffic
+ * @param {boolean} [opts.seedTokenTransfer]  serve the stubbed ERC-20
+ *   transfer. Read at request time, so a test can flip it on the same
+ *   options object without re-registering the route.
+ * @param {boolean} [opts.seedTokenBalance]  serve the stubbed ERC-20
+ *   holding, which is what makes the token reachable from the send screen.
+ * @param {string} [opts.ethBalanceWei]  hex wei answered to eth_getBalance;
+ *   defaults to zero, which is what every test that predates the funded
+ *   fixture expects.
+ * @param {boolean} [opts.failGasEstimate]  answer eth_estimateGas with a
+ *   node-side refusal.
+ * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
+ *   eth_estimateGas until this is cleared again.
+ * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
+ *   Promise<string|null>}>}
+ */
+async function installNetworkStubs(ctx, opts) {
+    const report = opts.report;
+
+    // First request seen that originated in a service worker, and the
+    // resolver waiting for it. This is what proves worker interception is
+    // actually in force; see waitForServiceWorkerTraffic below.
+    let firstWorkerRequest = null;
+    let announceWorkerRequest = null;
+
+    // E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
+    // tagged [sw] when it originated in the background service worker.
+    // It exists so the isolation claim above can be re-checked by anyone
+    // in one command, without editing files: the phishing blocklist fetch
+    // showing up with an [sw] tag is the proof that the worker really is
+    // intercepted and that the raw.githubusercontent.com stub below is
+    // live code rather than decoration.
+    const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
+
+    // Regex rather than a glob so chrome-extension:// resource loads are
+    // never touched — routing those would break the popup itself.
+    await ctx.route(/^https?:\/\//, async (route) => {
+        const req = route.request();
+        const url = new URL(req.url());
+        const p = url.pathname;
+        const fromWorker = !!req.serviceWorker();
+
+        if (fromWorker && !firstWorkerRequest) {
+            firstWorkerRequest = req.method() + " " + req.url();
+            if (announceWorkerRequest)
+                announceWorkerRequest(firstWorkerRequest);
+        }
+
+        if (trace) {
+            const origin = fromWorker ? "[sw] " : "[page] ";
+            console.log("# routed " + origin + req.method() + " " + req.url());
+        }
+
+        // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
+        if (req.method() === "POST") {
+            return handleRpc(route, req.postData(), opts, report);
+        }
+
+        // Blockscout v2
+        if (p.includes("/api/v2/")) {
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
+                return jsonResponse(route, { items: [] });
+            }
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
+                const addr = blockscoutAddress(p);
+                return jsonResponse(route, {
+                    items:
+                        opts.seedTokenTransfer && addr
+                            ? tokenTransferItems(addr)
+                            : [],
+                });
+            }
+            if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
+                return jsonResponse(
+                    route,
+                    opts.seedTokenBalance ? tokenBalanceItems() : [],
+                );
+            }
+            if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
+                return jsonResponse(route, transactionDetails());
+            }
+        }
+
+        // CoinDesk price tick
+        if (url.hostname.endsWith("coindesk.com")) {
+            return jsonResponse(route, { Data: {} });
+        }
+
+        // MetaMask phishing blocklist
+        if (
+            url.hostname === "raw.githubusercontent.com" ||
+            p.endsWith("/eth-phishing-detect/main/src/config.json")
+        ) {
+            return jsonResponse(route, {
+                version: 2,
+                tolerance: 2,
+                fuzzylist: [],
+                whitelist: [],
+                blacklist: [],
+            });
+        }
+
+        // Best-effort Etherscan address labels: served as an empty page.
+        if (url.hostname.endsWith("etherscan.io")) {
+            return route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: "<html><body></body></html>",
+            });
+        }
+
+        report("unstubbed request: " + req.method() + " " + req.url());
+        return route.abort();
+    });
+
+    return {
+        /**
+         * Resolve with the first service-worker-originated request this
+         * handler saw, or null if none arrives within `ms`.
+         *
+         * The background worker fetches the phishing blocklist at
+         * startup, unconditionally, within about a second of the context
+         * coming up — so under working interception this resolves almost
+         * immediately. Nothing arriving means worker traffic is bypassing
+         * the handler entirely and going to the real internet, which the
+         * caller turns into a hard failure of the whole suite.
+         */
+        waitForServiceWorkerTraffic(ms) {
+            if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    announceWorkerRequest = null;
+                    resolve(null);
+                }, ms);
+                announceWorkerRequest = (req) => {
+                    clearTimeout(timer);
+                    announceWorkerRequest = null;
+                    resolve(req);
+                };
+            });
+        },
+    };
+}
+
+module.exports = {
+    installNetworkStubs,
+    FEE_ESTIMATE_WEI,
+    FEE_RESERVE_WEI,
+    STUB_COUNTERPARTY,
+    STUB_TOKEN,
+    STUB_TX_HASH,
+};

tests/exportPrivkey.test.js

@@ -0,0 +1,331 @@
+// Tests for the private key export screen (issue #221).
+//
+// The screen holds the one secret that owns an address outright, so what is
+// pinned here is disposal: the key is wiped from the DOM whenever the screen
+// is left by any route, and a decrypt still in flight when the screen is
+// left never writes at all. That last case is the one a per-button wipe and
+// a naive leave hook both miss — the write lands after the wipe, with
+// nothing scheduled to wipe it again.
+//
+// The view is driven against a minimal DOM stub rather than a real browser:
+// the module is deliberately shaped like src/popup/views/showPhrase.js, with
+// no dependency that needs a document beyond the nodes it reads and writes.
+
+const mockPrivateKey = "0x" + "ab".repeat(32);
+
+jest.mock("ethereum-blockies-base64", () => () => "data:image/png;base64,x");
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+}));
+jest.mock("../src/shared/wallet", () => ({
+    getSignerForAddress: jest.fn(() => ({ privateKey: mockPrivateKey })),
+}));
+
+const { RESTORABLE_VIEWS } = require("../src/popup/restorableViews");
+
+const VIEW = "export-privkey";
+const PASSWORD = "correct horse battery";
+
+// ------------------------------------------------------------ DOM stub
+
+function makeElement(id, withParent) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        appendChild: () => {},
+        remove: () => {},
+        querySelectorAll: () => [],
+    };
+    el.parentElement = withParent ? makeElement(id + "-parent", false) : null;
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id, true));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created", false),
+        addEventListener: () => {},
+        body: { prepend: () => {} },
+    };
+}
+
+// ------------------------------------------------------------ harness
+
+function load() {
+    jest.resetModules();
+    globalThis.chrome = {
+        storage: { local: { get: async () => ({}), set: async () => {} } },
+    };
+    globalThis.document = makeDocument();
+
+    const helpers = require("../src/popup/views/helpers");
+    const { state } = require("../src/shared/state");
+    const vault = require("../src/shared/vault");
+    const wallet = require("../src/shared/wallet");
+    const exportPrivkey = require("../src/popup/views/exportPrivkey");
+
+    state.wallets = [
+        {
+            name: "Wallet 1",
+            type: "key",
+            encryptedSecret: "ciphertext",
+            addresses: [
+                {
+                    address: "0x" + "11".repeat(20),
+                    balance: "0.0000",
+                    tokenBalances: [],
+                },
+                {
+                    address: "0x" + "22".repeat(20),
+                    balance: "0.0000",
+                    tokenBalances: [],
+                },
+            ],
+        },
+    ];
+    state.viewStack = [];
+    state.currentView = "address";
+
+    exportPrivkey.init();
+    return { helpers, state, vault, wallet, exportPrivkey };
+}
+
+function click(id) {
+    const el = globalThis.document.getElementById(id);
+    return Promise.all((el.listeners.click || []).map((fn) => fn()));
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Start a reveal and hand back both the promise it returns and the resolver
+// for the decrypt it is waiting on, so a test can navigate away mid-flight.
+function startReveal(vault) {
+    let resolveDecrypt;
+    let rejectDecrypt;
+    vault.decryptWithPassword.mockImplementation(
+        () =>
+            new Promise((resolve, reject) => {
+                resolveDecrypt = resolve;
+                rejectDecrypt = reject;
+            }),
+    );
+    node("export-privkey-password").value = PASSWORD;
+    const pending = click("btn-export-privkey-confirm");
+    return {
+        pending,
+        resolve: (v) => resolveDecrypt(v),
+        reject: (e) => rejectDecrypt(e),
+    };
+}
+
+// ------------------------------------------------------------ tests
+
+describe("a decrypt still running when the screen is left", () => {
+    // The load-bearing case. Without the liveness guard in reveal(), the
+    // write lands after the leave hook has already wiped, and the key sits
+    // in the hidden view for the life of the popup.
+    test("never writes the key into the DOM", async () => {
+        const { helpers, vault, wallet, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const reveal = startReveal(vault);
+        // The settings gear, mid-decrypt.
+        helpers.showView("settings");
+        reveal.resolve("wallet secret");
+        await reveal.pending;
+
+        expect(node("export-privkey-value").textContent).toBe("");
+        // Nothing was even derived: the guard sits in front of the
+        // derivation, not just in front of the write.
+        expect(wallet.getSignerForAddress).not.toHaveBeenCalled();
+    });
+
+    // The generation counter, not merely the current-view check: by the time
+    // the stale decrypt resolves the user is back on the screen, so a guard
+    // that only asked "is this view showing?" would let the write through.
+    test("never writes it after the screen is re-entered", async () => {
+        const { helpers, vault, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const stale = startReveal(vault);
+        helpers.showView("settings");
+        exportPrivkey.show(0, 1);
+        expect(node("export-privkey-value").textContent).toBe("");
+
+        stale.resolve("wallet secret");
+        await stale.pending;
+
+        expect(node("export-privkey-value").textContent).toBe("");
+        expect(node("export-privkey-result").classList.contains("hidden")).toBe(
+            true,
+        );
+    });
+
+    // Same hole on the failure path: a wrong-password error written after
+    // the wipe would restore the flash line on a screen the user has left.
+    test("never writes the failure message either", async () => {
+        const { helpers, vault, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const reveal = startReveal(vault);
+        helpers.showView("settings");
+        reveal.reject(new Error("decryption failed"));
+        await reveal.pending;
+
+        expect(node("export-privkey-flash").textContent).toBe("");
+        expect(node("export-privkey-flash").style.visibility).toBe("hidden");
+    });
+});
+
+describe("a reveal that is not interrupted", () => {
+    // Guards the guard: a liveness check that rejected every write would
+    // pass every test above and ship a screen that reveals nothing.
+    test("puts the key on screen", async () => {
+        const { vault, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const reveal = startReveal(vault);
+        reveal.resolve("wallet secret");
+        await reveal.pending;
+
+        expect(node("export-privkey-value").textContent).toBe(mockPrivateKey);
+        expect(node("export-privkey-result").classList.contains("hidden")).toBe(
+            false,
+        );
+        // The password is dropped as soon as it has been spent.
+        expect(node("export-privkey-password").value).toBe("");
+    });
+
+    test("writes nothing before the password is accepted", async () => {
+        const { vault, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const reveal = startReveal(vault);
+        expect(node("export-privkey-value").textContent).toBe("");
+        reveal.resolve("wallet secret");
+        await reveal.pending;
+    });
+
+    test("reveals nothing when the password is wrong", async () => {
+        const { vault, exportPrivkey } = load();
+        exportPrivkey.show(0, 0);
+
+        const reveal = startReveal(vault);
+        reveal.reject(new Error("decryption failed"));
+        await reveal.pending;
+
+        expect(node("export-privkey-value").textContent).toBe("");
+        expect(node("export-privkey-flash").textContent).toBe(
+            "That password is incorrect. Please try again.",
+        );
+    });
+});
+
+describe("leaving the screen after the key is on it", () => {
+    async function revealed() {
+        const loaded = load();
+        loaded.exportPrivkey.show(0, 0);
+        const reveal = startReveal(loaded.vault);
+        reveal.resolve("wallet secret");
+        await reveal.pending;
+        expect(node("export-privkey-value").textContent).toBe(mockPrivateKey);
+        return loaded;
+    }
+
+    test("the Back button clears the key", async () => {
+        await revealed();
+        await click("btn-export-privkey-back");
+
+        expect(node("export-privkey-value").textContent).toBe("");
+        expect(node("export-privkey-password").value).toBe("");
+    });
+
+    test("the settings gear clears the key", async () => {
+        const { helpers } = await revealed();
+        helpers.showView("settings");
+
+        expect(node("export-privkey-value").textContent).toBe("");
+        expect(node("export-privkey-password").value).toBe("");
+        // And the screen is back to its password prompt, not to a result
+        // panel that would flash an empty well on the next visit.
+        expect(node("export-privkey-result").classList.contains("hidden")).toBe(
+            true,
+        );
+        expect(
+            node("export-privkey-password-section").classList.contains(
+                "hidden",
+            ),
+        ).toBe(false);
+    });
+
+    // Any other navigation: the same hook covers routes that do not exist
+    // yet, which is the point of registering it on the view rather than on
+    // the controls that leave it.
+    test("any other navigation clears the key", async () => {
+        const { helpers } = await revealed();
+        helpers.showView("main");
+
+        expect(node("export-privkey-value").textContent).toBe("");
+    });
+});
+
+describe("views the popup may reopen onto", () => {
+    // Restoring onto this screen would put a private key on display with no
+    // password prompt in front of it, on a popup reopened by accident.
+    test("the private key export screen is not restorable", () => {
+        expect(RESTORABLE_VIEWS.has(VIEW)).toBe(false);
+    });
+
+    test("it is still a registered view", () => {
+        const { helpers } = load();
+        expect(helpers.VIEWS).toContain(VIEW);
+    });
+});
+
+describe("the key cannot reach the logger", () => {
+    const fs = require("fs");
+    const path = require("path");
+    const source = fs.readFileSync(
+        path.join(__dirname, "..", "src", "popup", "views", "exportPrivkey.js"),
+        "utf8",
+    );
+
+    test("the view does not import src/shared/log.js", () => {
+        expect(source).not.toMatch(/require\(["'][^"']*shared\/log["']\)/);
+    });
+
+    test("the view calls no logger method", () => {
+        expect(source).not.toMatch(/\blog\.(debugf|infof|warnf|errorf)\b/);
+    });
+});

tests/holders.test.js

@@ -0,0 +1,166 @@
+// Tests for src/shared/holders.js and the balance-list spam gate that reads
+// it (issue #230).
+//
+// The rule these pin down: an explorer that reports no holders_count has told
+// us nothing, and "nothing" must not be recorded as "zero holders".  Zero is
+// the strongest spam signal the wallet has, so handing it out for free turns
+// a missing field into a hidden asset.
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: jest.fn(),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+global.chrome = { storage: { local: {} } };
+
+const {
+    LOW_HOLDER_THRESHOLD,
+    parseHoldersCount,
+    isLowHolderCount,
+} = require("../src/shared/holders");
+const { fetchTokenBalances } = require("../src/shared/balances");
+const { debugFetch } = require("../src/shared/log");
+
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+const HOLDER = "0x66133e8ea0f5d1d612d2502a968757d1048c214a";
+const USDC_CONTRACT = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+const NOVEL_TOKEN = "0x1111111111111111111111111111111111111111";
+
+describe("parseHoldersCount", () => {
+    test("a reported count parses to that number", () => {
+        expect(parseHoldersCount("3500000")).toBe(3500000);
+        expect(parseHoldersCount(3500000)).toBe(3500000);
+    });
+
+    test('a reported "0" parses to 0, which is not null', () => {
+        expect(parseHoldersCount("0")).toBe(0);
+        expect(parseHoldersCount(0)).toBe(0);
+    });
+
+    test("an omitted, null or empty count is unknown", () => {
+        expect(parseHoldersCount(undefined)).toBeNull();
+        expect(parseHoldersCount(null)).toBeNull();
+        expect(parseHoldersCount("")).toBeNull();
+    });
+
+    test("an unparseable count is unknown rather than zero", () => {
+        expect(parseHoldersCount("many")).toBeNull();
+        expect(parseHoldersCount(NaN)).toBeNull();
+    });
+});
+
+describe("isLowHolderCount", () => {
+    test("the threshold is the documented 1,000 holders", () => {
+        expect(LOW_HOLDER_THRESHOLD).toBe(1000);
+    });
+
+    test("a reported count below the threshold is low", () => {
+        expect(isLowHolderCount(0)).toBe(true);
+        expect(isLowHolderCount(999)).toBe(true);
+    });
+
+    test("a reported count at or above the threshold is not low", () => {
+        expect(isLowHolderCount(1000)).toBe(false);
+        expect(isLowHolderCount(1001)).toBe(false);
+    });
+
+    test("an unknown count is not low", () => {
+        expect(isLowHolderCount(null)).toBe(false);
+        expect(isLowHolderCount(undefined)).toBe(false);
+    });
+});
+
+// fetchTokenBalances applies its own spam gate, which is not the low-holder
+// display filter: it has no setting behind it and decides what the balance
+// list contains at all.  It stays strict on an unknown count — see the
+// comment at the gate — but must stop recording that unknown as zero.
+describe("the balance-list spam gate", () => {
+    function respondWith(items) {
+        debugFetch.mockImplementation(async () => ({
+            ok: true,
+            status: 200,
+            statusText: "OK",
+            json: async () => items,
+        }));
+    }
+
+    function item(overrides = {}) {
+        const { token, ...rest } = overrides;
+        return {
+            value: "12500000",
+            ...rest,
+            token: {
+                type: "ERC-20",
+                address_hash: NOVEL_TOKEN,
+                symbol: "SPAMTKN",
+                name: "Spam Token",
+                decimals: "6",
+                holders_count: "50000",
+                ...token,
+            },
+        };
+    }
+
+    beforeEach(() => {
+        debugFetch.mockReset();
+    });
+
+    test("a token with plenty of reported holders is listed", async () => {
+        respondWith([item()]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBe(50000);
+    });
+
+    test("a token reporting zero holders is still excluded", async () => {
+        respondWith([item({ token: { holders_count: "0" } })]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    test("an unknown holder count does not admit an unvouched token", async () => {
+        respondWith([item({ token: { holders_count: null } })]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    // The path that reaches the send selector and the history filter: a token
+    // the user vouched for by tracking it is listed whatever the explorer
+    // says, and it must carry the unknown count through as null, not as the
+    // zero that would then hide it downstream.
+    test("a tracked token with an unknown count is listed with holders null", async () => {
+        respondWith([item({ token: { holders_count: undefined } })]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+            { address: NOVEL_TOKEN.toUpperCase() },
+        ]);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBeNull();
+    });
+
+    test("a known-list token with an unknown count is listed with holders null", async () => {
+        respondWith([
+            item({
+                token: {
+                    address_hash: USDC_CONTRACT,
+                    symbol: "USDC",
+                    holders_count: null,
+                },
+            }),
+        ]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBeNull();
+    });
+
+    test("no test in this file performed a network request", () => {
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});

tests/manifest.test.js

@@ -0,0 +1,105 @@
+// The shipped Content Security Policy, pinned in both directions.
+//
+// This is the anti-regression check for #182. libsodium decides its
+// backend by trying to compile WebAssembly and catching the failure, so a
+// CSP that refuses WASM demotes the vault to the wasm2js translation —
+// roughly 20x slower per Argon2id derivation — and says so only in a
+// console message nobody reads. Dropping 'wasm-unsafe-eval' from either
+// manifest therefore has to fail a check, not a log line.
+//
+// It is equally a check against loosening. 'wasm-unsafe-eval' is granted
+// deliberately and narrowly (see the backend note in src/shared/vault.js);
+// 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
+// an exact match on the token set is what keeps the next edit from
+// smuggling one in alongside.
+//
+// build.js copies these files to dist/<target>/manifest.json verbatim, so
+// what is asserted here is what ships.
+
+const fs = require("fs");
+const path = require("path");
+
+const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
+
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
+
+const FORBIDDEN_SOURCES = [
+    "'unsafe-eval'",
+    "'unsafe-inline'",
+    "http:",
+    "https:",
+    "data:",
+    "blob:",
+    "*",
+];
+
+function readManifest(name) {
+    return JSON.parse(
+        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
+    );
+}
+
+// "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
+function parseCsp(policy) {
+    const directives = {};
+    for (const part of policy.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length === 0) continue;
+        directives[tokens[0]] = tokens.slice(1);
+    }
+    return directives;
+}
+
+function assertPolicy(policy) {
+    const directives = parseCsp(policy);
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
+    );
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
+    }
+}
+
+describe("shipped Content Security Policy", () => {
+    // MV3 takes an object and applies extension_pages to the popup and the
+    // background service worker, which is where libsodium runs.
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("chrome").content_security_policy;
+        expect(typeof csp).toBe("object");
+        expect(Object.keys(csp)).toEqual(["extension_pages"]);
+        assertPolicy(csp.extension_pages);
+    });
+
+    // MV2 takes the policy as a bare string. Firefox does not require
+    // 'wasm-unsafe-eval' for MV2 today — enforcement is report-only and
+    // Bugzilla 1770909 is still open — so that token is future-proofing
+    // for when it lands, not a mandate, and it stays inside Firefox's MV2
+    // base-CSP ceiling. object-src 'self' is the load-bearing half: a
+    // Firefox before 106 rejects an MV2 policy string that omits
+    // object-src and falls back to its own default, discarding everything
+    // declared here. Same policy as Chrome, different manifest shape.
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("firefox").content_security_policy;
+        expect(typeof csp).toBe("string");
+        assertPolicy(csp);
+    });
+
+    // The two targets share one codebase and one crypto path; a policy
+    // that drifts apart between them means one of the two builds is
+    // running a backend nothing tests.
+    test("both targets ship the same policy", () => {
+        const chrome =
+            readManifest("chrome").content_security_policy.extension_pages;
+        const firefox = readManifest("firefox").content_security_policy;
+        expect(firefox).toBe(chrome);
+    });
+});

tests/passwordMessages.test.js

@@ -0,0 +1,213 @@
+// One wording for one condition (issue #172).
+//
+// Every screen that asks for the password decrypts the vault itself, and
+// each one used to write its own sentence for the same failure: the send
+// confirmation and the delete-wallet confirmation said "Wrong password."
+// (a fragment, which RULES.md Language & Labeling forbids), the reveal
+// screens said "That password is not correct.", and the two dApp approval
+// paths said "That password is incorrect." A user hitting two of those
+// minutes apart had no way to tell whether the wallet meant the same
+// thing.
+//
+// This scans the source rather than driving six views, because the
+// invariant is about the set of call sites and not about any one of them:
+// a seventh screen that decrypts the vault has to join the set, and a
+// DOM test per view cannot notice one that was never written.
+//
+// The assertions are per CALL SITE, not per file. approval.js decrypts in
+// two places and is where the divergence came from; a per-file check that
+// only asks whether the canonical sentence appears somewhere in the file
+// passes while one of those two says something else entirely. So each
+// call site is read back to its own catch handler and the prose that
+// handler shows the user must be the canonical sentence and nothing else
+// — which fails on a novel wording, not only on a known-superseded one.
+
+const fs = require("fs");
+const path = require("path");
+
+const SRC = path.join(__dirname, "..", "src");
+
+const CANONICAL = "That password is incorrect. Please try again.";
+
+// Wordings this repo has actually shipped for the same condition. This is
+// a secondary, whole-file sweep for stragglers outside a decrypt handler;
+// divergence at a call site is caught by the exact-match assertion, which
+// needs no list of phrasings to guess at.
+const SUPERSEDED = [
+    "Wrong password.",
+    "That password is not correct. Please try again.",
+];
+
+function jsFilesUnder(dir) {
+    return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) return jsFilesUnder(full);
+        return entry.name.endsWith(".js") ? [full] : [];
+    });
+}
+
+// Blank out the interior of every comment and string literal, keeping the
+// offsets and line breaks, so braces can be counted without a quote or a
+// commented-out block throwing the count off. The literals are returned
+// alongside with the offset of their opening quote, which is how a
+// message is later attributed to the handler it sits in.
+function scan(source) {
+    const masked = source.split("");
+    const strings = [];
+    const blank = (from, to) => {
+        for (let k = from; k < to; k++) if (masked[k] !== "\n") masked[k] = " ";
+    };
+    let i = 0;
+    while (i < source.length) {
+        const two = source.slice(i, i + 2);
+        if (two === "//") {
+            const nl = source.indexOf("\n", i);
+            const stop = nl === -1 ? source.length : nl;
+            blank(i, stop);
+            i = stop;
+        } else if (two === "/*") {
+            const close = source.indexOf("*/", i + 2);
+            const stop = close === -1 ? source.length : close + 2;
+            blank(i, stop);
+            i = stop;
+        } else if (
+            source[i] === '"' ||
+            source[i] === "'" ||
+            source[i] === "`"
+        ) {
+            const quote = source[i];
+            let j = i + 1;
+            let value = "";
+            while (j < source.length && source[j] !== quote) {
+                if (source[j] === "\\") {
+                    value += source[j + 1];
+                    j += 2;
+                    continue;
+                }
+                value += source[j];
+                j += 1;
+            }
+            blank(i + 1, j);
+            strings.push({ offset: i, value });
+            i = j + 1;
+        } else {
+            i += 1;
+        }
+    }
+    return { masked: masked.join(""), strings };
+}
+
+// Offset of the `{` that opens the block containing `at`, or -1.
+function enclosingBlockStart(masked, at) {
+    let depth = 0;
+    for (let i = at; i >= 0; i--) {
+        if (masked[i] === "}") depth += 1;
+        else if (masked[i] === "{") {
+            if (depth === 0) return i;
+            depth -= 1;
+        }
+    }
+    return -1;
+}
+
+// Offset just past the `}` matching the `{` at `open`.
+function blockEnd(masked, open) {
+    let depth = 0;
+    for (let i = open; i < masked.length; i++) {
+        if (masked[i] === "{") depth += 1;
+        else if (masked[i] === "}") {
+            depth -= 1;
+            if (depth === 0) return i + 1;
+        }
+    }
+    throw new Error("unterminated block");
+}
+
+// The catch handler guarding a given decryptWithPassword call: walk out to
+// the try block the call sits in, then take the catch that follows it.
+function handlerSpan(masked, callOffset, label) {
+    const tryOpen = enclosingBlockStart(masked, callOffset);
+    if (tryOpen === -1 || !/\btry\s*$/.test(masked.slice(0, tryOpen)))
+        throw new Error(`${label}: the decrypt is not inside a try block`);
+    const rest = masked.slice(blockEnd(masked, tryOpen));
+    const catchMatch = /^\s*catch\s*(\([^)]*\)\s*)?\{/.exec(rest);
+    if (!catchMatch)
+        throw new Error(`${label}: the decrypt's try block has no catch`);
+    const catchOpen = blockEnd(masked, tryOpen) + catchMatch[0].length - 1;
+    return [catchOpen, blockEnd(masked, catchOpen)];
+}
+
+// The prose the handler puts in front of the user. Element ids, class
+// names and visibility keywords are single words; a sentence has a space
+// in it, and that is the whole distinction needed here.
+function handlerMessages(file, callOffset, label) {
+    const { masked, strings } = scan(fs.readFileSync(file, "utf8"));
+    const [from, to] = handlerSpan(masked, callOffset, label);
+    return strings
+        .filter((s) => s.offset >= from && s.offset < to)
+        .map((s) => s.value)
+        .filter((v) => v.includes(" "));
+}
+
+// The call sites are found, not listed: the file layout moves (the private
+// key export was in addressDetail.js when #172 was filed and is its own
+// view now), and a hardcoded list would quietly stop covering a screen it
+// no longer names.
+function callSites() {
+    const sites = [];
+    for (const file of jsFilesUnder(SRC)) {
+        if (file === path.join(SRC, "shared", "vault.js")) continue;
+        const { masked } = scan(fs.readFileSync(file, "utf8"));
+        const rel = path.relative(SRC, file).split(path.sep).join("/");
+        let n = 0;
+        let at = masked.indexOf("decryptWithPassword(");
+        while (at !== -1) {
+            n += 1;
+            sites.push({ file, rel, offset: at, label: `${rel} #${n}` });
+            at = masked.indexOf("decryptWithPassword(", at + 1);
+        }
+    }
+    return sites.sort((a, b) => a.label.localeCompare(b.label));
+}
+
+describe("password failure messages", () => {
+    const sites = callSites();
+    const files = [...new Set(sites.map((s) => s.file))].sort();
+
+    test("the call sites are found where they are expected", () => {
+        const counts = {};
+        for (const site of sites)
+            counts[site.rel] = (counts[site.rel] ?? 0) + 1;
+        expect(counts).toEqual({
+            "popup/views/approval.js": 2,
+            "popup/views/confirmTx.js": 1,
+            "popup/views/deleteWallet.js": 1,
+            "popup/views/exportPrivkey.js": 1,
+            "popup/views/showPhrase.js": 1,
+        });
+    });
+
+    test("the canonical message is a full sentence", () => {
+        expect(CANONICAL).toMatch(/^[A-Z][^]*\.$/);
+    });
+
+    // Exact equality, per call site: a message that is merely different
+    // rather than known-obsolete fails here too, which a scan for historic
+    // wordings cannot do.
+    test.each(sites.map((s) => [s.label, s]))(
+        "%s answers a rejected password with the canonical sentence",
+        (label, site) => {
+            expect(handlerMessages(site.file, site.offset, label)).toEqual([
+                CANONICAL,
+            ]);
+        },
+    );
+
+    test.each(files.map((f) => [path.relative(SRC, f), f]))(
+        "%s carries no superseded wording",
+        (_rel, file) => {
+            const source = fs.readFileSync(file, "utf8");
+            for (const old of SUPERSEDED) expect(source).not.toContain(old);
+        },
+    );
+});

tests/phishingDomains.test.js

@@ -1,17 +1,24 @@
-// Provide a localStorage mock for Node.js test environment.
+// Extension storage stub for the Node test environment. The module resolves
-// Must be set before requiring the module since it calls loadDeltaFromStorage()
+// the storage API on use, so this only has to exist before the first call.
-// at module load time.
+// Values round-trip through JSON the way structured cloning would, so a test
-const localStorageStore = {};
+// cannot pass by holding a live reference to the module's own array.
-global.localStorage = {
+const storageStore = {};
-    getItem: (key) =>
+global.chrome = {
-        Object.prototype.hasOwnProperty.call(localStorageStore, key)
+    storage: {
-            ? localStorageStore[key]
+        local: {
-            : null,
+            get: async (key) =>
-    setItem: (key, value) => {
+                Object.prototype.hasOwnProperty.call(storageStore, key)
-        localStorageStore[key] = String(value);
+                    ? { [key]: JSON.parse(JSON.stringify(storageStore[key])) }
-    },
+                    : {},
-    removeItem: (key) => {
+            set: async (items) => {
-        delete localStorageStore[key];
+                for (const [key, value] of Object.entries(items)) {
+                    storageStore[key] = JSON.parse(JSON.stringify(value));
+                }
+            },
+            remove: async (key) => {
+                delete storageStore[key];
+            },
+        },
     },
 };
 
@@ -21,19 +28,32 @@ const {
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,
+    DELTA_STORAGE_KEY,
     _reset,
     _getVendoredBlacklistSize,
     _getDeltaBlacklist,
 } = require("../src/shared/phishingDomains");
 
+function clearStorage() {
+    for (const key of Object.keys(storageStore)) {
+        delete storageStore[key];
+    }
+}
+
+// The MV3 service worker is torn down when idle and re-evaluated on the next
+// event, which wipes every module-level variable. Re-requiring the module with
+// the registry reset is exactly that: fresh in-memory state, same extension
+// storage underneath.
+function restartWorker() {
+    jest.resetModules();
+    return require("../src/shared/phishingDomains");
+}
+
 // Reset delta state before each test to avoid cross-test contamination.
 // Note: vendored sets are immutable and always present.
 beforeEach(() => {
     _reset();
-    // Clear localStorage mock between tests
+    clearStorage();
-    for (const key of Object.keys(localStorageStore)) {
-        delete localStorageStore[key];
-    }
 });
 
 describe("phishingDomains", () => {
@@ -169,15 +189,34 @@ describe("phishingDomains", () => {
         });
     });
 
-    describe("localStorage persistence", () => {
+    describe("extension storage persistence", () => {
-        test("saveDeltaToStorage persists delta under 256KiB", () => {
+        test("delta is persisted to extension storage, not localStorage", async () => {
-            loadConfig({
+            await loadConfig({
                 blacklist: ["persisted-scam-xyz.com"],
             });
-            const stored = localStorage.getItem("phishing-delta");
+            const stored = storageStore[DELTA_STORAGE_KEY];
-            expect(stored).not.toBeNull();
+            expect(stored).toBeDefined();
-            const data = JSON.parse(stored);
+            expect(stored.blacklist).toContain("persisted-scam-xyz.com");
-            expect(data.blacklist).toContain("persisted-scam-xyz.com");
+        });
+
+        test("the fetch timestamp is persisted alongside the delta", async () => {
+            const before = Date.now();
+            await loadConfig({ blacklist: ["timestamped-scam-xyz.com"] });
+            const stored = storageStore[DELTA_STORAGE_KEY];
+            expect(typeof stored.lastFetchTime).toBe("number");
+            expect(stored.lastFetchTime).toBeGreaterThanOrEqual(before);
+        });
+
+        test("an oversized delta is dropped entirely, timestamp included", async () => {
+            // A record above the 256 KiB cap is not worth keeping; the
+            // timestamp goes with it so the next start re-fetches rather than
+            // claiming freshness for a delta that was never stored.
+            const huge = [];
+            for (let i = 0; i < 20000; i++) {
+                huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+            }
+            await loadConfig({ blacklist: huge });
+            expect(storageStore[DELTA_STORAGE_KEY]).toBeUndefined();
         });
 
         test("delta is cleared on _reset", () => {
@@ -203,3 +242,332 @@ describe("phishingDomains", () => {
         });
     });
 });
+
+describe("phishing list across a service worker restart", () => {
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+    });
+
+    afterEach(() => {
+        delete global.fetch;
+    });
+
+    test("a revived worker restores the persisted delta without re-fetching", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["restart-scam-xyz.com"] });
+
+        const revived = restartWorker();
+        // Nothing in memory yet — this is a brand new module instance.
+        expect(revived.getDeltaSize()).toBe(0);
+
+        global.fetch = jest.fn();
+        await revived.initPhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.getDeltaSize()).toBe(1);
+        expect(revived.isPhishingDomain("restart-scam-xyz.com")).toBe(true);
+    });
+
+    test("repeated wakes inside the cache window never re-fetch", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["no-storm-scam-xyz.com"] });
+
+        global.fetch = jest.fn();
+        for (let i = 0; i < 5; i++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+        }
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    test("a persisted timestamp older than the TTL causes a fetch on startup", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["stale-scam-xyz.com"] });
+
+        // Age the persisted record past the 24-hour TTL.
+        storageStore[first.DELTA_STORAGE_KEY].lastFetchTime =
+            Date.now() - first.CACHE_TTL_MS - 1000;
+
+        const revived = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["refreshed-scam-xyz.com"] }),
+        }));
+        await revived.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(revived.isPhishingDomain("refreshed-scam-xyz.com")).toBe(true);
+        expect(revived.isPhishingDomain("stale-scam-xyz.com")).toBe(false);
+    });
+
+    test("a first start with nothing persisted fetches immediately", async () => {
+        const fresh = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["first-run-scam-xyz.com"] }),
+        }));
+        await fresh.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(fresh.isPhishingDomain("first-run-scam-xyz.com")).toBe(true);
+    });
+
+    test("updatePhishingList honours the persisted timestamp on its own", async () => {
+        // The startup path calls updatePhishingList() directly, so it must
+        // load persisted state itself rather than relying on anything else
+        // having finished first.
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["alarm-tick-scam-xyz.com"] });
+
+        const revived = restartWorker();
+        global.fetch = jest.fn();
+        await revived.updatePhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.isPhishingDomain("alarm-tick-scam-xyz.com")).toBe(true);
+    });
+});
+
+// The alarm period alone must set the cadence. lastFetchTime is stamped when
+// the fetch completes, so it lands one fetch latency after the alarm that
+// caused it; a freshness guard timed to the alarm period therefore vetoes
+// every scheduled tick and halves the real refresh rate. These tests measure
+// the interval between fetches that actually happened.
+describe("phishing refresh steady-state cadence", () => {
+    const { PHISHING_REFRESH_PERIOD_MINUTES } = require("../src/shared/alarms");
+    const PERIOD_MS = PHISHING_REFRESH_PERIOD_MINUTES * 60 * 1000;
+
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function fetchStub(latencyMs, seen) {
+        return jest.fn(async () => {
+            seen.push(now);
+            // A network fetch takes time, and lastFetchTime is stamped after
+            // it, not when the alarm fired.
+            now += latencyMs;
+            return { ok: true, json: async () => ({ blacklist: [] }) };
+        });
+    }
+
+    test("ten alarm ticks produce ten fetches, one per period", async () => {
+        const fetchedAt = [];
+        global.fetch = fetchStub(5000, fetchedAt);
+
+        const startup = require("../src/shared/phishingDomains");
+        const T0 = now;
+        await startup.initPhishingList();
+        expect(fetchedAt).toEqual([T0]);
+
+        const TICKS = 10;
+        let tickAt = T0 + PERIOD_MS;
+        for (let i = 0; i < TICKS; i++) {
+            now = tickAt;
+            tickAt += PERIOD_MS;
+            // The browser wakes a terminated worker to deliver the alarm, so
+            // every tick starts from cold memory and the persisted record.
+            const revived = restartWorker();
+            await revived.refreshPhishingListOnSchedule();
+        }
+
+        expect(fetchedAt).toHaveLength(TICKS + 1);
+        const intervals = fetchedAt.slice(1).map((t, i) => t - fetchedAt[i]);
+        expect(intervals).toEqual(new Array(TICKS).fill(PERIOD_MS));
+    });
+
+    test("the scheduled tick fetches whatever the last fetch's latency was", async () => {
+        // The alarm fires one period after the previous alarm, which is
+        // `latency` short of one period since the fetch it caused completed.
+        for (const latency of [200, 1000, 5000]) {
+            clearStorage();
+            jest.resetModules();
+            storageStore[DELTA_STORAGE_KEY] = {
+                blacklist: [],
+                lastFetchTime: now - PERIOD_MS + latency,
+                lastAttemptTime: now - PERIOD_MS,
+            };
+            const mod = require("../src/shared/phishingDomains");
+            const fetchedAt = [];
+            global.fetch = fetchStub(latency, fetchedAt);
+
+            await mod.refreshPhishingListOnSchedule();
+            expect(fetchedAt).toHaveLength(1);
+        }
+    });
+
+    test("a worker wake inside the cache window still does not fetch", async () => {
+        // The TTL is not removed, only taken off the scheduled path. Chrome
+        // revives the worker every ~30 seconds and every revival runs the
+        // startup path, so the TTL still has to keep that off the network.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: [],
+            lastFetchTime: now - PERIOD_MS + 5000,
+            lastAttemptTime: now - PERIOD_MS,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = jest.fn();
+
+        await mod.initPhishingList();
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});
+
+describe("phishing list timestamps that cannot be trusted", () => {
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function okFetch() {
+        return jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["recovered-scam-xyz.com"] }),
+        }));
+    }
+
+    // jest.resetModules() clears the call record of a jest.fn, and simulating
+    // a worker restart is exactly that call. Anything counted across restarts
+    // has to be counted outside the mock.
+    function countingFetch(counter, response) {
+        return async () => {
+            counter.calls++;
+            return response();
+        };
+    }
+
+    test("a lastFetchTime in the future is discarded rather than trusted", async () => {
+        // Clock skew or a restored profile backup writes one. Every guard
+        // measures `Date.now() - stamp` and only tests the lower bound, so a
+        // stamp a year ahead would suppress updates for a year, and now that
+        // the value is persisted it would outlive every worker.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: ["poisoned-scam-xyz.com"],
+            lastFetchTime: now + 365 * 24 * 60 * 60 * 1000,
+            lastAttemptTime: 0,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(mod.isPhishingDomain("recovered-scam-xyz.com")).toBe(true);
+        // And the record it leaves behind is sane, so recovery is permanent.
+        expect(
+            storageStore[DELTA_STORAGE_KEY].lastFetchTime,
+        ).toBeLessThanOrEqual(now);
+    });
+
+    test("a lastAttemptTime in the future does not suppress the retry", async () => {
+        storageStore[DELTA_STORAGE_KEY] = {
+            lastAttemptTime: now + 365 * 24 * 60 * 60 * 1000,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+    });
+
+    test("an oversized delta does not re-download on every worker wake", async () => {
+        // The delta and its freshness claim are both dropped, which is right,
+        // but nothing then says a fetch just happened. Chrome cycles the
+        // worker roughly every 30 seconds idle, so without the attempt stamp
+        // this is a full blocklist download per wake, forever.
+        const huge = [];
+        for (let i = 0; i < 20000; i++) {
+            huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+        }
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: true,
+            json: async () => ({ blacklist: huge }),
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000; // idle timeout, worker torn down and revived
+        }
+
+        expect(counter.calls).toBe(1);
+        expect(storageStore[DELTA_STORAGE_KEY].blacklist).toBeUndefined();
+        expect(typeof storageStore[DELTA_STORAGE_KEY].lastAttemptTime).toBe(
+            "number",
+        );
+    });
+
+    test("a failing fetch is not retried on every worker wake either", async () => {
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000;
+        }
+
+        expect(counter.calls).toBe(1);
+    });
+
+    test("the retry floor expires, so a failure is not permanent", async () => {
+        const {
+            MIN_FETCH_ATTEMPT_INTERVAL_MS,
+        } = require("../src/shared/phishingDomains");
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Still inside the floor: no retry.
+        now += MIN_FETCH_ATTEMPT_INTERVAL_MS - 1000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Past it: the extension goes back to the network.
+        now += 2000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(2);
+    });
+
+    test("the scheduled tick ignores the retry floor", async () => {
+        // The alarm period is far above the floor, but the floor exists to
+        // throttle wakes, not the schedule.
+        storageStore[DELTA_STORAGE_KEY] = { lastAttemptTime: now - 1000 };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.refreshPhishingListOnSchedule();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+    });
+});

tests/sendTokenSelect.test.js

@@ -0,0 +1,123 @@
+// Tests for the token filtering in the Send view's token selector
+// (src/popup/views/send.js).
+//
+// The selector decides which of the user's tokens can be spent at all, so
+// over-filtering here is worse than in the history list: the asset is not
+// merely hidden, it becomes unspendable through the UI.  Issue #230: an
+// explorer that omits holders_count was read as "zero holders" and the token
+// disappeared from this list.
+//
+// renderSendTokenSelect only ever touches getElementById, createElement,
+// innerHTML, value, textContent and appendChild, so a small stub document is
+// enough to drive it; the real DOM behaviour of the view is covered by
+// tests/e2e/run.js.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const { renderSendTokenSelect } = require("../src/popup/views/send");
+
+const USDC_CONTRACT = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+const NOVEL_TOKEN = "0x1111111111111111111111111111111111111111";
+
+let select;
+
+function installStubDocument() {
+    select = { innerHTML: "", children: [] };
+    select.appendChild = (child) => select.children.push(child);
+    globalThis.document = {
+        getElementById: (id) => (id === "send-token" ? select : null),
+        createElement: () => ({ value: "", textContent: "" }),
+    };
+}
+
+// The symbols offered for sending, excluding the hardcoded ETH option that
+// renderSendTokenSelect writes straight into innerHTML.
+function offeredTokens() {
+    return select.children.map((opt) => opt.value.toLowerCase());
+}
+
+function tokenBalance(overrides) {
+    return {
+        address: NOVEL_TOKEN,
+        symbol: "SPAMTKN",
+        decimals: 18,
+        balance: "12.5",
+        holders: 50000,
+        ...overrides,
+    };
+}
+
+function render(tokenBalances) {
+    installStubDocument();
+    renderSendTokenSelect({ address: "0x" + "a".repeat(40), tokenBalances });
+}
+
+beforeEach(() => {
+    state.fraudContracts = [];
+    state.hideLowHolderTokens = true;
+});
+
+describe("the low-holder rule in the send token selector", () => {
+    test("ETH is always offered", () => {
+        render([]);
+        expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
+        expect(offeredTokens()).toEqual([]);
+    });
+
+    test("a token with plenty of holders is offered", () => {
+        render([tokenBalance()]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("a token reporting zero holders is withheld", () => {
+        render([tokenBalance({ holders: 0 })]);
+        expect(offeredTokens()).toEqual([]);
+    });
+
+    test("boundary: 999 holders is withheld, 1000 is offered", () => {
+        render([tokenBalance({ holders: 999 })]);
+        expect(offeredTokens()).toEqual([]);
+        render([tokenBalance({ holders: 1000 })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    // Issue #230: an unknown holder count must not read as zero.  A token the
+    // user demonstrably holds — it has a balance — cannot be made unspendable
+    // by a field the block explorer failed to report.
+    test("a token whose holder count is unknown is still offered", () => {
+        render([tokenBalance({ holders: null })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("a token balance carrying no holders field at all is offered", () => {
+        const t = tokenBalance();
+        delete t.holders;
+        render([t]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("the rule is bypassed entirely when the setting is off", () => {
+        state.hideLowHolderTokens = false;
+        render([tokenBalance({ holders: 0 })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+});
+
+describe("the other send-selector rules are unaffected", () => {
+    test("a token spoofing a known symbol from a wrong address is withheld", () => {
+        render([
+            tokenBalance({ symbol: "USDC", holders: null }),
+            tokenBalance({ address: USDC_CONTRACT, symbol: "USDC" }),
+        ]);
+        expect(offeredTokens()).toEqual([USDC_CONTRACT.toLowerCase()]);
+    });
+
+    test("a blocklisted fraud contract is withheld even with an unknown count", () => {
+        state.fraudContracts = [NOVEL_TOKEN.toUpperCase()];
+        render([tokenBalance({ holders: null })]);
+        expect(offeredTokens()).toEqual([]);
+    });
+});

tests/settingsUtcTimestamps.test.js

@@ -0,0 +1,111 @@
+// Tests for the UTC Timestamps setting.
+//
+// The checkbox was moved out of the Token Spam Protection well and into the
+// Display well next to the theme selector.  It is wired by id through the $()
+// helper, so the move cannot break the handler — but nothing in the suite said
+// so.  These tests pin both halves down: the markup lives in Display and
+// nowhere else, and the value still round-trips through storage.
+
+const fs = require("fs");
+const path = require("path");
+
+const POPUP_HTML = fs.readFileSync(
+    path.join(__dirname, "..", "src", "popup", "index.html"),
+    "utf8",
+);
+
+// The body of one `<div class="bg-well ...">` well, selected by its heading.
+function wellWithHeading(html, heading) {
+    const headingIndex = html.indexOf(
+        '<h3 class="font-bold mb-1">' + heading + "</h3>",
+    );
+    expect(headingIndex).toBeGreaterThan(-1);
+    const start = html.lastIndexOf('<div class="bg-well', headingIndex);
+    const end = html.indexOf('<div class="bg-well', headingIndex);
+    return html.slice(start, end === -1 ? html.length : end);
+}
+
+describe("the UTC Timestamps checkbox placement", () => {
+    test("the checkbox appears exactly once in the popup markup", () => {
+        const matches = POPUP_HTML.match(/id="settings-utc-timestamps"/g);
+        expect(matches).toHaveLength(1);
+    });
+
+    test("it renders in the Display well, alongside the theme selector", () => {
+        const display = wellWithHeading(POPUP_HTML, "Display");
+
+        expect(display).toContain('id="settings-utc-timestamps"');
+        expect(display).toContain('id="settings-theme"');
+    });
+
+    test("it does not render in the Token Spam Protection well", () => {
+        const spam = wellWithHeading(POPUP_HTML, "Token Spam Protection");
+
+        expect(spam).not.toContain('id="settings-utc-timestamps"');
+        // The filters that do belong there are untouched.
+        expect(spam).toContain('id="settings-hide-low-holders"');
+        expect(spam).toContain('id="settings-hide-fraud-contracts"');
+        expect(spam).toContain('id="settings-hide-dust"');
+        expect(spam).toContain('id="settings-dust-threshold"');
+    });
+});
+
+describe("the UTC Timestamps setting round-trips through storage", () => {
+    let store;
+
+    function loadStateModule() {
+        store = {};
+        global.chrome = {
+            storage: {
+                local: {
+                    get: async (key) =>
+                        key in store ? { [key]: store[key] } : {},
+                    set: async (obj) => Object.assign(store, obj),
+                },
+            },
+        };
+        jest.resetModules();
+        return require("../src/shared/state");
+    }
+
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("defaults to off with nothing persisted", async () => {
+        const { state, loadState } = loadStateModule();
+
+        await loadState();
+
+        expect(state.utcTimestamps).toBe(false);
+    });
+
+    test("an enabled checkbox is persisted and read back", async () => {
+        const first = loadStateModule();
+
+        // What the change handler in views/settings.js does.
+        first.state.utcTimestamps = true;
+        await first.saveState();
+        expect(store.autistmask.utcTimestamps).toBe(true);
+
+        // A fresh popup load sees it.
+        jest.resetModules();
+        const second = require("../src/shared/state");
+        expect(second.state.utcTimestamps).toBe(false);
+        await second.loadState();
+        expect(second.state.utcTimestamps).toBe(true);
+    });
+
+    test("turning it back off is persisted too", async () => {
+        const { state, saveState, loadState } = loadStateModule();
+
+        state.utcTimestamps = true;
+        await saveState();
+        state.utcTimestamps = false;
+        await saveState();
+
+        state.utcTimestamps = true;
+        await loadState();
+        expect(state.utcTimestamps).toBe(false);
+    });
+});

tests/showPhrase.test.js

@@ -0,0 +1,94 @@
+// Tests for the recovery phrase display (issue #161).
+//
+// These cover the parts that do not need a DOM: which wallet types may be
+// offered the action at all, the exclusion of the screen from the set of
+// views the popup may reopen onto, and the absence of any path from this
+// module to the logger. The DOM behaviour it guards — nothing rendered
+// before the password is accepted, a wrong password revealing nothing, and
+// the wipe on leaving — is driven against the real popup in a real browser
+// by tests/e2e/run.js, which is where every other view behaviour is tested.
+
+const fs = require("fs");
+const path = require("path");
+
+const { walletHasRecoveryPhrase } = require("../src/shared/wallet");
+const { RESTORABLE_VIEWS } = require("../src/popup/restorableViews");
+
+const SHOW_PHRASE_VIEW = "show-phrase";
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+function loadHelpers() {
+    globalThis.chrome = {
+        storage: { local: { get: async () => ({}), set: async () => {} } },
+    };
+    return require("../src/popup/views/helpers");
+}
+
+describe("which wallets have a recovery phrase", () => {
+    test("an HD wallet does", () => {
+        expect(walletHasRecoveryPhrase({ type: "hd" })).toBe(true);
+    });
+
+    // A key wallet holds a bare private key and an xprv wallet an extended
+    // private key. Neither can be turned back into words, so neither may be
+    // offered the action.
+    test("a key wallet does not", () => {
+        expect(walletHasRecoveryPhrase({ type: "key" })).toBe(false);
+    });
+
+    test("an xprv wallet does not", () => {
+        expect(walletHasRecoveryPhrase({ type: "xprv" })).toBe(false);
+    });
+
+    test("an unknown or missing wallet type does not", () => {
+        expect(walletHasRecoveryPhrase({ type: "something-new" })).toBe(false);
+        expect(walletHasRecoveryPhrase({})).toBe(false);
+        expect(walletHasRecoveryPhrase(undefined)).toBe(false);
+    });
+});
+
+describe("views the popup may reopen onto", () => {
+    // Restoring onto a secret screen would put the phrase on screen with no
+    // password prompt in front of it, on a popup the user may have reopened
+    // by accident.
+    test("the recovery phrase screen is not restorable", () => {
+        expect(RESTORABLE_VIEWS.has(SHOW_PHRASE_VIEW)).toBe(false);
+    });
+
+    test("the private key export screen is not restorable either", () => {
+        expect(RESTORABLE_VIEWS.has("export-privkey")).toBe(false);
+    });
+
+    test("the recovery phrase screen is still a registered view", () => {
+        const { VIEWS } = loadHelpers();
+        expect(VIEWS).toContain(SHOW_PHRASE_VIEW);
+    });
+
+    // Guards the other direction: a restorable name that is not a real view
+    // would leave restoreView() showing nothing at all.
+    test("every restorable view is a registered view", () => {
+        const { VIEWS } = loadHelpers();
+        for (const view of RESTORABLE_VIEWS) {
+            expect(VIEWS).toContain(view);
+        }
+    });
+});
+
+describe("the phrase cannot reach the logger", () => {
+    const source = fs.readFileSync(
+        path.join(__dirname, "..", "src", "popup", "views", "showPhrase.js"),
+        "utf8",
+    );
+
+    // The decrypted phrase only ever lives in a local and in the DOM node
+    // that displays it. The module has no logger to hand it to, and this
+    // pins that: src/shared/log.js writes to the console, and a console
+    // record of a recovery phrase outlives the popup.
+    test("the view does not import src/shared/log.js", () => {
+        expect(source).not.toMatch(/require\(["'][^"']*shared\/log["']\)/);
+    });
+
+    test("the view calls no logger method", () => {
+        expect(source).not.toMatch(/\blog\.(debugf|infof|warnf|errorf)\b/);
+    });
+});

tests/state.test.js

@@ -0,0 +1,271 @@
+const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+function oneWallet() {
+    return [{ name: "Wallet 1", type: "hd", addresses: [ADDRESS] }];
+}
+
+// state.js resolves the storage API at require time, so the stub has to exist
+// before the module is loaded, and the module registry has to be reset between
+// cases because `state` is a module-level singleton.
+function loadModuleWith(persisted) {
+    jest.resetModules();
+    const set = jest.fn(async () => {});
+    global.chrome = {
+        storage: {
+            local: {
+                get: jest.fn(async () =>
+                    persisted ? { autistmask: persisted } : {},
+                ),
+                set,
+            },
+        },
+    };
+    return { mod: require("../src/shared/state"), set };
+}
+
+afterEach(() => {
+    delete global.chrome;
+});
+
+describe("loadState hasWallet reconciliation", () => {
+    // A profile that deleted its last wallet on a build predating the write
+    // path fix keeps hasWallet: true forever. It must load as no wallet, which
+    // is what sends the popup to the welcome view.
+    test("stored hasWallet true with zero wallets loads as no wallet", async () => {
+        const { mod } = loadModuleWith({ hasWallet: true, wallets: [] });
+        await mod.loadState();
+        expect(mod.state.hasWallet).toBe(false);
+    });
+
+    test("stored hasWallet true with a missing wallets key loads as no wallet", async () => {
+        const { mod } = loadModuleWith({ hasWallet: true });
+        await mod.loadState();
+        expect(mod.state.wallets).toEqual([]);
+        expect(mod.state.hasWallet).toBe(false);
+    });
+
+    test("stored hasWallet false with one wallet loads as having a wallet", async () => {
+        const { mod } = loadModuleWith({
+            hasWallet: false,
+            wallets: oneWallet(),
+        });
+        await mod.loadState();
+        expect(mod.state.hasWallet).toBe(true);
+    });
+
+    test("absent hasWallet with wallets present loads as having a wallet", async () => {
+        const { mod } = loadModuleWith({ wallets: oneWallet() });
+        await mod.loadState();
+        expect(mod.state.hasWallet).toBe(true);
+    });
+
+    test("consistent stored states are preserved", async () => {
+        const withWallet = loadModuleWith({
+            hasWallet: true,
+            wallets: oneWallet(),
+        });
+        await withWallet.mod.loadState();
+        expect(withWallet.mod.state.hasWallet).toBe(true);
+
+        const without = loadModuleWith({ hasWallet: false, wallets: [] });
+        await without.mod.loadState();
+        expect(without.mod.state.hasWallet).toBe(false);
+    });
+
+    test("empty storage leaves the default no-wallet state", async () => {
+        const { mod } = loadModuleWith(null);
+        await mod.loadState();
+        expect(mod.state.hasWallet).toBe(false);
+        expect(mod.state.wallets).toEqual([]);
+    });
+
+    // The correction is derived on every load rather than written back, so a
+    // load never has a storage side effect.
+    test("loadState does not write to storage", async () => {
+        const { mod, set } = loadModuleWith({ hasWallet: true, wallets: [] });
+        await mod.loadState();
+        expect(set).not.toHaveBeenCalled();
+    });
+
+    // Deriving must not disturb the rest of the load.
+    test("other persisted fields still load", async () => {
+        const { mod } = loadModuleWith({
+            hasWallet: false,
+            wallets: oneWallet(),
+            networkId: "sepolia",
+            theme: "dark",
+            activeAddress: ADDRESS,
+        });
+        await mod.loadState();
+        expect(mod.state.networkId).toBe("sepolia");
+        expect(mod.state.theme).toBe("dark");
+        expect(mod.state.activeAddress).toBe(ADDRESS);
+    });
+});
+
+// The known-symbol spoof filter is a safety filter, so an existing profile
+// stored before the setting existed must load with it on rather than with
+// undefined, which would read as off.
+describe("hideSpoofedSymbols persistence", () => {
+    test("defaults to on with empty storage", async () => {
+        const { mod } = loadModuleWith(null);
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(true);
+    });
+
+    test("a profile stored without the key loads with it on", async () => {
+        const { mod } = loadModuleWith({ wallets: oneWallet() });
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(true);
+    });
+
+    test("an explicit false survives the load", async () => {
+        const { mod } = loadModuleWith({
+            wallets: oneWallet(),
+            hideSpoofedSymbols: false,
+        });
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(false);
+    });
+
+    test("saveState persists the flag", async () => {
+        const { mod, set } = loadModuleWith(null);
+        mod.state.hideSpoofedSymbols = false;
+        await mod.saveState();
+        expect(set).toHaveBeenCalledWith({
+            autistmask: expect.objectContaining({ hideSpoofedSymbols: false }),
+        });
+    });
+
+    test("the flag round-trips off through save and load", async () => {
+        const first = loadModuleWith(null);
+        first.mod.state.hideSpoofedSymbols = false;
+        await first.mod.saveState();
+        const persisted = first.set.mock.calls[0][0].autistmask;
+
+        const second = loadModuleWith(persisted);
+        await second.mod.loadState();
+        expect(second.mod.state.hideSpoofedSymbols).toBe(false);
+    });
+
+    test("the flag round-trips back on through save and load", async () => {
+        const first = loadModuleWith(null);
+        first.mod.state.hideSpoofedSymbols = true;
+        await first.mod.saveState();
+        const persisted = first.set.mock.calls[0][0].autistmask;
+
+        const second = loadModuleWith(persisted);
+        await second.mod.loadState();
+        expect(second.mod.state.hideSpoofedSymbols).toBe(true);
+    });
+});
+
+// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
+// behind it was restored verbatim, so Back could still walk onto a screen
+// whose content is deliberately never re-rendered — and "show-phrase" has no
+// Back control of its own to leave by. The stack is filtered on load, at the
+// first entry the popup would not render, and everything above it goes too:
+// those entries were reached THROUGH the dropped one.
+describe("restored viewStack is filtered against RESTORABLE_VIEWS", () => {
+    const NON_RESTORABLE = ["export-privkey", "show-phrase"];
+
+    function restoredStack(viewStack, currentView = "settings") {
+        return loadModuleWith({
+            wallets: oneWallet(),
+            currentView,
+            viewStack,
+        });
+    }
+
+    test("a non-restorable view at the top of the stack is dropped", async () => {
+        const { mod } = restoredStack(["main", "address", "export-privkey"]);
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(["main", "address"]);
+    });
+
+    test("a non-restorable view in the middle truncates the stack there", async () => {
+        const { mod } = restoredStack(["main", "show-phrase", "address"]);
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(["main"]);
+    });
+
+    // Truncating a stack rooted at a non-restorable view leaves nothing, and
+    // the restored view still needs somewhere for Back to go.
+    test("a non-restorable view at the bottom leaves main to go back to", async () => {
+        const { mod } = restoredStack(["export-privkey", "address", "receive"]);
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(["main"]);
+    });
+
+    test("no restored stack retains a secret-bearing view", async () => {
+        for (const view of NON_RESTORABLE) {
+            const { mod } = restoredStack(["main", "address", view, "receive"]);
+            await mod.loadState();
+            expect(mod.state.viewStack).not.toContain(view);
+        }
+    });
+
+    // The rule is "views the popup will render", not a blocklist of the two
+    // secret screens: a name no longer in the set (or never a view at all)
+    // has to go the same way.
+    test("a name that is not a restorable view at all is dropped", async () => {
+        const { mod } = restoredStack(["main", "welcome", "address"]);
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(["main"]);
+    });
+
+    // Restorable entries are kept verbatim. That they are then unhidden
+    // without being re-rendered is a separate defect, tracked in #268; this
+    // filter is only about views the popup declined to restore.
+    test("an ordinary restorable stack is restored unchanged", async () => {
+        const stack = ["main", "address", "address-token"];
+        const { mod } = restoredStack(stack);
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(stack);
+    });
+
+    test("restoring onto main keeps the stack empty", async () => {
+        const { mod } = restoredStack(["show-phrase"], "main");
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual([]);
+    });
+
+    // main is not the only view that gets no ["main"] beneath it: restoreView()
+    // will not reopen onto a non-restorable view either, so nothing is left for
+    // Back to sit under and the stack stays empty.
+    test("restoring onto a view the popup will not reopen keeps the stack empty", async () => {
+        const { mod } = restoredStack(["export-privkey"], "show-phrase");
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual([]);
+    });
+
+    // Not an array means nothing survives, but the never-empty rule still
+    // applies: a corrupt stack must not leave a restored view with no Back
+    // target of its own.
+    test("a stack that is not an array still gets main beneath a restored view", async () => {
+        const { mod } = restoredStack("main");
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual(["main"]);
+    });
+
+    test("a stack that is not an array loads as empty under main", async () => {
+        const { mod } = restoredStack({ 0: "main" }, "main");
+        await mod.loadState();
+        expect(mod.state.viewStack).toEqual([]);
+    });
+
+    // Filtering belongs on load, not on save: the live in-session stack is
+    // legitimate — the user really is one Back away from a screen that is
+    // rendered right now — and only a load-side filter also cleans the
+    // stacks already sitting in storage.
+    test("saveState persists the live stack verbatim", async () => {
+        const { mod, set } = loadModuleWith(null);
+        mod.state.viewStack = ["main", "address", "export-privkey"];
+        await mod.saveState();
+        expect(set).toHaveBeenCalledWith({
+            autistmask: expect.objectContaining({
+                viewStack: ["main", "address", "export-privkey"],
+            }),
+        });
+    });
+});

tests/symbolSpoof.test.js

@@ -0,0 +1,296 @@
+// Tests for the known-symbol spoof rule (src/shared/symbolSpoof.js) and for
+// its application on all three surfaces that show tokens: the transaction
+// history, the Send token selector, and the balance list.
+//
+// Issue #235: the three surfaces disagreed about what a `null` entry in
+// KNOWN_SYMBOLS means.  The history and the selector read it as "no contract
+// may bear this symbol" and filtered a fake `ETH` ERC-20; the balance list
+// read it as "no comparison is possible" and listed the fake token next to
+// the user's real ETH, which is where a user forms their belief about what
+// they own.  The rule now lives in one module, so a fourth surface cannot
+// reintroduce a fourth reading, and these tests assert the same attack on
+// each surface.
+//
+// Nothing here touches the network: global.fetch is a throwing stub and the
+// only fetch path in the modules under test (debugFetch, from
+// src/shared/log) is mocked at the module boundary.
+
+// The RPC provider is replaced so that refreshBalances can be driven end to
+// end: the native balance it reports must survive a balance list in which
+// every ERC-20 row is a fake ETH.  Everything else in ethers is the real
+// module, including the formatters the assertions depend on.
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    class StubProvider {
+        async getBalance() {
+            return 1234500000000000000n;
+        }
+        async lookupAddress() {
+            return null;
+        }
+    }
+    return {
+        ...actual,
+        JsonRpcProvider: StubProvider,
+        Network: { from: () => ({}) },
+    };
+});
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: jest.fn(),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+global.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
+const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { filterTransactions } = require("../src/shared/transactions");
+const {
+    fetchTokenBalances,
+    refreshBalances,
+} = require("../src/shared/balances");
+const { renderSendTokenSelect } = require("../src/popup/views/send");
+const { state } = require("../src/shared/state");
+const { debugFetch } = require("../src/shared/log");
+
+// The fake "Ethereum" token with symbol "ETH" from the attack documented in
+// README.md, given a holder count high enough to clear every other filter so
+// that only the known-symbol rule can catch it.
+const FAKE_ETH_CONTRACT = "0xd05339f9ea5ab9d9f03b9d57f671d2abd1f55c82";
+const HOLDER = "0x66133e8ea0f5d1d612d2502a968757d1048c214a";
+const USDC_CONTRACT = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+const WETH_CONTRACT = "0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2";
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+
+describe("the shared rule", () => {
+    test('"ETH" is still the null-mapped symbol these tests assume', () => {
+        expect(KNOWN_SYMBOLS.get("ETH")).toBeNull();
+    });
+
+    test("a contract bearing a null-mapped symbol is a spoof", () => {
+        expect(isSpoofedSymbol("ETH", FAKE_ETH_CONTRACT)).toBe(true);
+    });
+
+    test("even a genuine contract may not bear a null-mapped symbol", () => {
+        expect(isSpoofedSymbol("ETH", WETH_CONTRACT)).toBe(true);
+    });
+
+    test("the native asset carries no contract and is never a spoof", () => {
+        expect(isSpoofedSymbol("ETH", null)).toBe(false);
+        expect(isSpoofedSymbol("ETH", undefined)).toBe(false);
+        expect(isSpoofedSymbol("ETH", "")).toBe(false);
+    });
+
+    // The native exemption is "has no contract address", not "the symbol is
+    // ETH".  A second null-mapped symbol added to the table later inherits
+    // both halves of the rule without any call site being revisited.
+    test("a newly null-mapped symbol behaves the same way", () => {
+        const added = !KNOWN_SYMBOLS.has("XTZTEST");
+        KNOWN_SYMBOLS.set("XTZTEST", null);
+        try {
+            expect(isSpoofedSymbol("XTZTEST", FAKE_ETH_CONTRACT)).toBe(true);
+            expect(isSpoofedSymbol("XTZTEST", null)).toBe(false);
+        } finally {
+            if (added) KNOWN_SYMBOLS.delete("XTZTEST");
+        }
+    });
+
+    test("a known symbol from its own contract is not a spoof", () => {
+        expect(isSpoofedSymbol("USDC", USDC_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase())).toBe(
+            false,
+        );
+    });
+
+    test("a known symbol from another contract is a spoof", () => {
+        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT)).toBe(true);
+    });
+
+    test("a symbol that is not in the table is not judged here", () => {
+        expect(isSpoofedSymbol("SPAMTKN", FAKE_ETH_CONTRACT)).toBe(false);
+    });
+});
+
+describe("surface 1: the transaction history", () => {
+    function fakeEthTransfer() {
+        return {
+            hash: "0x" + "1".repeat(64),
+            symbol: "ETH",
+            contractAddress: FAKE_ETH_CONTRACT,
+            holders: 900000,
+            valueGwei: null,
+            isContractCall: false,
+        };
+    }
+
+    test("a fake ETH token transfer is filtered", () => {
+        const result = filterTransactions([fakeEthTransfer()], {
+            hideSpoofedSymbols: true,
+            hideFraudContracts: true,
+            hideLowHolderTokens: true,
+            hideDustTransactions: true,
+            dustThresholdGwei: 100000,
+        });
+        expect(result.transactions).toEqual([]);
+    });
+
+    test("a real native ETH transfer survives", () => {
+        const native = {
+            hash: "0x" + "2".repeat(64),
+            symbol: "ETH",
+            contractAddress: null,
+            holders: null,
+            valueGwei: 5000000,
+            isContractCall: false,
+        };
+        const result = filterTransactions([native], {
+            hideSpoofedSymbols: true,
+            hideFraudContracts: true,
+            hideLowHolderTokens: true,
+            hideDustTransactions: true,
+            dustThresholdGwei: 100000,
+        });
+        expect(result.transactions).toEqual([native]);
+    });
+});
+
+describe("surface 2: the Send token selector", () => {
+    let select;
+
+    function render(tokenBalances) {
+        select = { innerHTML: "", children: [] };
+        select.appendChild = (child) => select.children.push(child);
+        globalThis.document = {
+            getElementById: (id) => (id === "send-token" ? select : null),
+            createElement: () => ({ value: "", textContent: "" }),
+        };
+        renderSendTokenSelect({
+            address: "0x" + "a".repeat(40),
+            tokenBalances,
+        });
+    }
+
+    beforeEach(() => {
+        state.fraudContracts = [];
+        state.hideLowHolderTokens = true;
+    });
+
+    test("a fake ETH token is not selectable", () => {
+        render([
+            {
+                address: FAKE_ETH_CONTRACT,
+                symbol: "ETH",
+                decimals: 18,
+                balance: "0.005",
+                holders: 900000,
+            },
+        ]);
+        expect(select.children).toEqual([]);
+    });
+
+    test("native ETH remains the always-present option", () => {
+        render([]);
+        expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
+    });
+});
+
+describe("surface 3: the balance list", () => {
+    function respondWith(items) {
+        debugFetch.mockImplementation(async () => ({
+            ok: true,
+            status: 200,
+            statusText: "OK",
+            json: async () => items,
+        }));
+    }
+
+    function fakeEthItem(overrides = {}) {
+        return {
+            value: "5000000000000000",
+            token: {
+                type: "ERC-20",
+                address_hash: FAKE_ETH_CONTRACT,
+                symbol: "ETH",
+                name: "Ethereum",
+                decimals: "18",
+                holders_count: "900000",
+                ...overrides,
+            },
+        };
+    }
+
+    beforeEach(() => {
+        debugFetch.mockReset();
+    });
+
+    // The bug in issue #235: this token cleared the balance list's own
+    // 1,000-holder floor and was listed as a holding named ETH.
+    test("a fake ETH token clearing the holder floor is filtered", async () => {
+        respondWith([fakeEthItem()]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    test("tracking the fake token manually does not admit it either", async () => {
+        respondWith([fakeEthItem({ holders_count: "0" })]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+            { address: FAKE_ETH_CONTRACT },
+        ]);
+        expect(balances).toEqual([]);
+    });
+
+    test("a genuine token keeps its place in the list", async () => {
+        respondWith([
+            fakeEthItem({
+                address_hash: USDC_CONTRACT,
+                symbol: "USDC",
+                name: "USD Coin",
+                decimals: "6",
+            }),
+        ]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].symbol).toBe("USDC");
+    });
+
+    // The trap in this change: the user's real ETH balance is not an ERC-20
+    // and is fetched over RPC in refreshBalances, so it never passes through
+    // this loop at all.  An explorer row that is not an ERC-20 is dropped
+    // before the symbol rule is consulted.
+    test("a non-ERC-20 row claiming ETH never reaches the symbol rule", async () => {
+        respondWith([fakeEthItem({ type: "ERC-721" })]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    // The money test: the user holds real ETH and has been airdropped a fake
+    // ETH ERC-20.  The fake is gone from the list of tokens; the real balance
+    // is exactly what the node reported.
+    test("the real native ETH balance survives a fake ETH airdrop", async () => {
+        respondWith([fakeEthItem()]);
+        const addr = { address: HOLDER };
+        await refreshBalances(
+            [{ addresses: [addr] }],
+            "https://rpc.example.invalid",
+            BLOCKSCOUT,
+            [],
+        );
+        expect(addr.balance).toBe("1.2345");
+        expect(addr.tokenBalances).toEqual([]);
+    });
+
+    test("no test in this file performed a network request", () => {
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});

tests/txStatus.test.js

@@ -0,0 +1,482 @@
+// Lifecycle tests for the post-broadcast transaction status views
+// (src/popup/views/txStatus.js).
+//
+// The bug these pin down: the receipt poll rendered both outcomes on the tick
+// that crossed the 60-second deadline, so a confirmed transaction was replaced
+// by "not confirmed within 60 seconds" — the user is told their transaction
+// failed when it succeeded. The same shape applies to any callback that
+// outlives its wait: a receipt lookup still in flight when the view is left
+// must not render over whatever replaced it.
+//
+// Fake timers make the race deterministic: the receipt promise is already
+// resolved when the deadline tick runs, so in the unfixed code showSuccess()
+// is always followed by showError() on that tick.
+//
+// No network: getProvider is mocked at the module boundary and there is no
+// jsdom in this repo, so the handful of DOM calls these views make are served
+// by the stub below.
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: jest.fn(),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+const mockReceiptLookup = jest.fn();
+jest.mock("../src/shared/balances", () => ({
+    getProvider: () => ({ getTransactionReceipt: mockReceiptLookup }),
+    refreshBalances: jest.fn(),
+}));
+
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+
+// ---------------------------------------------------------------------------
+// Minimal DOM. Every element is created on demand and remembered by id, so a
+// test can read back what a view wrote into it.
+// ---------------------------------------------------------------------------
+
+const elements = new Map();
+
+function makeElement(id) {
+    const classes = new Set(["view", "hidden"]);
+    const el = {
+        id,
+        textContent: "",
+        innerHTML: "",
+        style: {},
+        classList: {
+            add: (c) => classes.add(c),
+            remove: (c) => classes.delete(c),
+            contains: (c) => classes.has(c),
+            toggle: (c, on) => (on ? classes.add(c) : classes.delete(c)),
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        remove: () => {},
+        prepend: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => getElement(id + "-parent"),
+    });
+    return el;
+}
+
+function getElement(id) {
+    if (!elements.has(id)) elements.set(id, makeElement(id));
+    return elements.get(id);
+}
+
+global.document = {
+    getElementById: (id) => getElement(id),
+    // escapeHtml() builds a detached div; textContent in, escaped HTML out.
+    createElement: () => {
+        const el = { innerHTML: "" };
+        Object.defineProperty(el, "textContent", {
+            set(v) {
+                el.innerHTML = String(v)
+                    .replace(/&/g, "&")
+                    .replace(/</g, "&lt;")
+                    .replace(/>/g, "&gt;");
+            },
+        });
+        return el;
+    },
+    body: { prepend: () => {} },
+    addEventListener: () => {},
+};
+
+global.window = { location: { search: "" } };
+
+const stored = {};
+global.chrome = {
+    storage: {
+        local: {
+            set: (obj) => {
+                Object.assign(stored, obj);
+                return Promise.resolve();
+            },
+            get: () => Promise.resolve(stored),
+        },
+    },
+};
+
+const txStatus = require("../src/popup/views/txStatus");
+const { state } = require("../src/shared/state");
+const { RESTORABLE_VIEWS } = require("../src/popup/restorableViews");
+
+const TX_HASH =
+    "0x85215772ed26ea8b39c2b3b18779030487efbe0b5fd7e882592b2f62b837be84";
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const TX_INFO = {
+    to: RECIPIENT,
+    amount: "0.0050",
+    token: "ETH",
+    tokenSymbol: null,
+};
+
+// True when a view element is not hidden.
+function visible(view) {
+    return !getElement("view-" + view).classList.contains("hidden");
+}
+
+function waitStatusText() {
+    return getElement("wait-tx-status").textContent;
+}
+
+beforeEach(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date("2026-08-11T12:00:00Z"));
+    elements.clear();
+    mockReceiptLookup.mockReset();
+    state.wallets = [];
+    state.viewData = {};
+    state.viewStack = [];
+    state.currentView = null;
+    txStatus.init({ doRefreshAndRender: jest.fn() });
+});
+
+afterEach(() => {
+    txStatus.endWait();
+    jest.useRealTimers();
+});
+
+describe("WaitTx receipt/timeout race", () => {
+    test("a receipt arriving on the deadline tick leaves the user on SuccessTx", async () => {
+        // No receipt for the first five polls; the sixth — the tick at
+        // t=60s, which is also the timeout deadline — returns one.
+        mockReceiptLookup
+            .mockResolvedValueOnce(null)
+            .mockResolvedValueOnce(null)
+            .mockResolvedValueOnce(null)
+            .mockResolvedValueOnce(null)
+            .mockResolvedValueOnce(null)
+            .mockResolvedValue({ blockNumber: 21000000 });
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+        expect(visible("wait-tx")).toBe(true);
+
+        await jest.advanceTimersByTimeAsync(60000);
+
+        expect(visible("success-tx")).toBe(true);
+        expect(visible("error-tx")).toBe(false);
+        expect(state.currentView).toBe("success-tx");
+        expect(state.viewData.blockNumber).toBe(21000000);
+        expect(state.viewData.message).toBeUndefined();
+
+        // And nothing is left running to undo it.
+        expect(jest.getTimerCount()).toBe(0);
+        await jest.advanceTimersByTimeAsync(300000);
+        expect(state.currentView).toBe("success-tx");
+        expect(mockReceiptLookup).toHaveBeenCalledTimes(6);
+    });
+
+    test("a genuine timeout still shows ErrorTx with the hash", async () => {
+        mockReceiptLookup.mockResolvedValue(null);
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+        await jest.advanceTimersByTimeAsync(60000);
+
+        expect(visible("error-tx")).toBe(true);
+        expect(state.currentView).toBe("error-tx");
+        expect(state.viewData.message).toMatch(
+            /not confirmed within 60 seconds/,
+        );
+        expect(state.viewData.hash).toBe(TX_HASH);
+        // The hash section carries the hash and the etherscan link.
+        expect(getElement("error-tx-hash").innerHTML).toContain(TX_HASH);
+        expect(getElement("error-tx-hash").innerHTML).toContain(
+            "/tx/" + TX_HASH,
+        );
+        expect(jest.getTimerCount()).toBe(0);
+    });
+
+    test("a receipt still in flight when the view is left does not render over it", async () => {
+        let resolveReceipt;
+        mockReceiptLookup.mockReturnValue(
+            new Promise((r) => {
+                resolveReceipt = r;
+            }),
+        );
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(mockReceiptLookup).toHaveBeenCalledTimes(1);
+
+        // User leaves the wait (popup navigation / teardown) while the
+        // lookup is outstanding, then the lookup finally answers.
+        txStatus.endWait();
+        state.currentView = "main";
+        resolveReceipt({ blockNumber: 21000000 });
+        await Promise.resolve();
+        await Promise.resolve();
+
+        expect(state.currentView).toBe("main");
+        expect(visible("success-tx")).toBe(false);
+    });
+
+    test("no timer survives the view being left", async () => {
+        mockReceiptLookup.mockResolvedValue(null);
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+        expect(jest.getTimerCount()).toBeGreaterThan(0);
+
+        txStatus.endWait();
+        expect(jest.getTimerCount()).toBe(0);
+
+        await jest.advanceTimersByTimeAsync(120000);
+        expect(mockReceiptLookup).not.toHaveBeenCalled();
+    });
+});
+
+describe("WaitTx persistence across popup close", () => {
+    test("restoreWait resumes the poll with the deadline running from broadcast", async () => {
+        mockReceiptLookup.mockResolvedValue(null);
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+        expect(state.viewData.pendingWait.hash).toBe(TX_HASH);
+        const persisted = JSON.parse(JSON.stringify(state.viewData));
+
+        // Popup closes: timers die with the page.
+        txStatus.endWait();
+
+        // 45 seconds pass with the popup shut, then it is reopened.
+        jest.advanceTimersByTime(45000);
+        state.viewData = persisted;
+        expect(txStatus.restoreWait()).toBe(true);
+
+        expect(visible("wait-tx")).toBe(true);
+        // Elapsed is counted from the broadcast, not from the reopen.
+        expect(waitStatusText()).toBe("Waiting for confirmation... 45s");
+        // The immediate poll on resume has already run.
+        await Promise.resolve();
+        expect(mockReceiptLookup).toHaveBeenCalledTimes(1);
+
+        // The deadline is 15 seconds away, not 60.
+        await jest.advanceTimersByTimeAsync(20000);
+        expect(state.currentView).toBe("error-tx");
+    });
+
+    test("a rejected lookup on the resume poll keeps waiting instead of reporting failure", async () => {
+        // A wait resumed after the deadline has already passed: the first
+        // poll is immediate and past 60s, so a thrown lookup must not be
+        // read as "no receipt". It means "no answer this tick" — keep
+        // polling, because the transaction may well have confirmed.
+        mockReceiptLookup.mockResolvedValue(null);
+        txStatus.showWait(TX_INFO, TX_HASH);
+        const persisted = JSON.parse(JSON.stringify(state.viewData));
+        txStatus.endWait();
+
+        // Ten minutes with the popup shut, then it is reopened and the
+        // first receipt lookup fails transiently.
+        jest.advanceTimersByTime(600000);
+        mockReceiptLookup.mockReset();
+        mockReceiptLookup
+            .mockRejectedValueOnce(new Error("rpc unavailable"))
+            .mockResolvedValue({ blockNumber: 21000000 });
+
+        state.viewData = persisted;
+        expect(txStatus.restoreWait()).toBe(true);
+        await jest.advanceTimersByTimeAsync(0);
+
+        // The wait is still alive: no timeout was declared off one error.
+        expect(visible("wait-tx")).toBe(true);
+        expect(visible("error-tx")).toBe(false);
+        expect(state.currentView).toBe("wait-tx");
+        expect(jest.getTimerCount()).toBeGreaterThan(0);
+
+        // And the next tick answers, so the confirmed transaction is
+        // reported as confirmed.
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(state.currentView).toBe("success-tx");
+        expect(state.viewData.blockNumber).toBe(21000000);
+    });
+
+    test("a lookup returning null past the deadline still times out", async () => {
+        // The counterpart to the test above: the deadline must still fire
+        // when the lookup actually answers "no receipt".
+        mockReceiptLookup.mockResolvedValue(null);
+        txStatus.showWait(TX_INFO, TX_HASH);
+        const persisted = JSON.parse(JSON.stringify(state.viewData));
+        txStatus.endWait();
+
+        jest.advanceTimersByTime(600000);
+        state.viewData = persisted;
+        expect(txStatus.restoreWait()).toBe(true);
+        await jest.advanceTimersByTimeAsync(0);
+
+        expect(state.currentView).toBe("error-tx");
+        expect(state.viewData.message).toMatch(
+            /not confirmed within 60 seconds/,
+        );
+    });
+
+    test("restoreWait reports nothing to resume when no wait is persisted", () => {
+        state.viewData = {};
+        expect(txStatus.restoreWait()).toBe(false);
+        expect(jest.getTimerCount()).toBe(0);
+    });
+
+    test("restoreWait rejects a persisted wait missing its txInfo or broadcast time", () => {
+        for (const bad of [
+            { hash: TX_HASH, broadcastTime: Date.now() },
+            { hash: TX_HASH, txInfo: TX_INFO },
+            { hash: TX_HASH, txInfo: TX_INFO, broadcastTime: "soon" },
+            { hash: TX_HASH, txInfo: TX_INFO, broadcastTime: NaN },
+            { hash: TX_HASH, txInfo: "nope", broadcastTime: Date.now() },
+            // An object that merely lacks a field startWait() dereferences
+            // is the shape that actually escaped: txInfo.to reaches
+            // addressTitle(), which calls address.toLowerCase(). typeof []
+            // is "object", so an array passes an object check.
+            { hash: TX_HASH, txInfo: {}, broadcastTime: Date.now() },
+            { hash: TX_HASH, txInfo: [], broadcastTime: Date.now() },
+            { hash: TX_HASH, txInfo: { to: 42 }, broadcastTime: Date.now() },
+            // Otherwise complete but for a non-string `to`: only the `to`
+            // check rejects this one, and without it addressTitle() throws
+            // out of restoreView().
+            {
+                hash: TX_HASH,
+                txInfo: { to: 42, amount: "0.0050" },
+                broadcastTime: Date.now(),
+            },
+            // Otherwise complete but an array: only Array.isArray() rejects
+            // it, since typeof [] is "object" and the fields are present.
+            {
+                hash: TX_HASH,
+                txInfo: Object.assign([], { to: RECIPIENT, amount: "0.0050" }),
+                broadcastTime: Date.now(),
+            },
+            {
+                hash: TX_HASH,
+                txInfo: { to: RECIPIENT },
+                broadcastTime: Date.now(),
+            },
+        ]) {
+            state.viewData = { pendingWait: bad };
+            expect(txStatus.restoreWait()).toBe(false);
+            expect(jest.getTimerCount()).toBe(0);
+        }
+    });
+
+    test("restoreWait resumes a wait whose recipient is the empty string", () => {
+        // The shape a contract-deployment approval persists: approval.js
+        // writes `to: toAddr || ""`, and showWait() renders it without
+        // complaint. Validation must not be stricter than the live path, or
+        // that wait is silently abandoned on every popup open.
+        mockReceiptLookup.mockResolvedValue(null);
+        state.viewData = {
+            pendingWait: {
+                hash: TX_HASH,
+                txInfo: { ...TX_INFO, to: "" },
+                broadcastTime: Date.now(),
+            },
+        };
+        expect(txStatus.restoreWait()).toBe(true);
+        expect(visible("wait-tx")).toBe(true);
+    });
+});
+
+describe("WaitTx against an RPC that never answers", () => {
+    test("a permanently failing lookup ends the wait instead of polling forever", async () => {
+        mockReceiptLookup.mockRejectedValue(new Error("rpc unavailable"));
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+
+        // Six consecutive failures is 60 seconds at the 10s cadence — the
+        // same patience as the confirmation deadline.
+        await jest.advanceTimersByTimeAsync(60000);
+
+        expect(state.currentView).toBe("error-tx");
+        expect(visible("wait-tx")).toBe(false);
+        // The user is told what actually happened: the lookup failed. It is
+        // not the same fact as "the transaction did not confirm".
+        expect(state.viewData.message).toMatch(/could not be reached/i);
+        expect(state.viewData.message).not.toMatch(/not confirmed within/);
+        expect(state.viewData.hash).toBe(TX_HASH);
+
+        // Nothing is left running, and nothing is left to resume onto.
+        expect(jest.getTimerCount()).toBe(0);
+        expect(state.viewData.pendingWait).toBeUndefined();
+
+        const calls = mockReceiptLookup.mock.calls.length;
+        await jest.advanceTimersByTimeAsync(3600000);
+        expect(mockReceiptLookup).toHaveBeenCalledTimes(calls);
+        expect(state.currentView).toBe("error-tx");
+    });
+
+    test("an answered lookup clears the failure count, so the bound is on consecutive failures", async () => {
+        // The bound counts failures in a row, not failures in total: a
+        // flaky RPC that keeps answering in between must not accumulate its
+        // way to a false "network unreachable".
+        //
+        // Polls 1-5 (t=10s..50s) alternate reject / null, so three fail and
+        // the last answer resets the count at poll 4. From poll 6 on every
+        // lookup fails. Six in a row is then poll 10, at t=100s. A counter
+        // that never reset would have reached six at poll 8, t=80s, so the
+        // window between those two is what this test occupies.
+        mockReceiptLookup.mockImplementation(() => {
+            const n = mockReceiptLookup.mock.calls.length;
+            if (n <= 5 && n % 2 === 0) return Promise.resolve(null);
+            return Promise.reject(new Error("flaky"));
+        });
+
+        txStatus.showWait(TX_INFO, TX_HASH);
+
+        // t=90s: eight failures in total, five of them in a row. A
+        // cumulative counter has long since fired; a consecutive one has not.
+        await jest.advanceTimersByTimeAsync(90000);
+        expect(state.currentView).toBe("wait-tx");
+        expect(visible("wait-tx")).toBe(true);
+        expect(jest.getTimerCount()).toBeGreaterThan(0);
+
+        // t=100s: the sixth in a row.
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(state.currentView).toBe("error-tx");
+        expect(state.viewData.message).toMatch(/could not be reached/i);
+        // No lookup ever answered "no receipt" past the deadline, so this
+        // is not the timeout and must not be reported as one.
+        expect(state.viewData.message).not.toMatch(/not confirmed within/);
+        expect(jest.getTimerCount()).toBe(0);
+    });
+
+    test("a resumed wait against a dead RPC also terminates", async () => {
+        // The reopen path is the one that made this unbounded: the wait is
+        // persisted, so without a bound every popup open resumes it forever.
+        mockReceiptLookup.mockResolvedValue(null);
+        txStatus.showWait(TX_INFO, TX_HASH);
+        const persisted = JSON.parse(JSON.stringify(state.viewData));
+        txStatus.endWait();
+
+        jest.advanceTimersByTime(3600000);
+        mockReceiptLookup.mockReset();
+        mockReceiptLookup.mockRejectedValue(new Error("rpc unavailable"));
+
+        state.viewData = persisted;
+        expect(txStatus.restoreWait()).toBe(true);
+        await jest.advanceTimersByTimeAsync(60000);
+
+        expect(state.currentView).toBe("error-tx");
+        expect(state.viewData.message).toMatch(/could not be reached/i);
+        expect(jest.getTimerCount()).toBe(0);
+        expect(state.viewData.pendingWait).toBeUndefined();
+    });
+});
+
+describe("wait-tx is a view the popup may reopen onto", () => {
+    // The resume feature is wired through RESTORABLE_VIEWS: restoreView()
+    // refuses any view not in the set, so dropping "wait-tx" from it kills
+    // the resume silently — the tests above call restoreWait() directly and
+    // would all still pass. This pins the membership. Mirrors the exclusion
+    // assertions in tests/showPhrase.test.js.
+    test("wait-tx is restorable", () => {
+        expect(RESTORABLE_VIEWS.has("wait-tx")).toBe(true);
+    });
+});

tests/txValidation.test.js

@@ -0,0 +1,357 @@
+const { parseEther } = require("ethers");
+const {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    feeReserveWei,
+    feeEstimateWei,
+    toFixedPoint,
+    validateTransfer,
+} = require("../src/shared/txValidation");
+
+// A plausible mainnet fee: 21000 gas at 20 gwei.
+const FEE = 21000n * 20000000000n; // 0.00042 ETH
+
+const GWEI = 1000000000n;
+const GAS_LIMIT = 21000n;
+
+describe("toFixedPoint", () => {
+    test("scales human decimals to 18 places", () => {
+        expect(toFixedPoint("1.5")).toBe(parseEther("1.5"));
+        expect(toFixedPoint("0")).toBe(0n);
+    });
+
+    test("rejects values it cannot represent exactly", () => {
+        expect(toFixedPoint("not a number")).toBe(null);
+        expect(toFixedPoint("")).toBe(null);
+        expect(toFixedPoint(null)).toBe(null);
+        // More precision than 18 decimals can hold.
+        expect(toFixedPoint("0.0000000000000000001")).toBe(null);
+    });
+});
+
+describe("validateTransfer, native ETH", () => {
+    const eth = (over) => ({
+        isErc20: false,
+        amount: "0.5",
+        ethBalance: "1.0",
+        feeStatus: FEE_KNOWN,
+        feeWei: FEE,
+        ...over,
+    });
+
+    test("allows a send comfortably within balance", () => {
+        const r = validateTransfer(eth());
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("blocks a send whose amount plus fee exceeds the balance", () => {
+        // The whole balance: passes an amount-only check, fails once the fee
+        // is counted. This is the bug this module exists to prevent.
+        const r = validateTransfer(eth({ amount: "1.0", ethBalance: "1.0" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("blocks a send left short by less than one fee", () => {
+        const balance = "1.0";
+        // One wei less headroom than the fee needs.
+        const amount = "0.99958000000000001"; // 1.0 - 0.00042 + 1e-17
+        const r = validateTransfer(eth({ amount, ethBalance: balance }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("allows a send that leaves exactly the fee behind", () => {
+        const r = validateTransfer(
+            eth({ amount: "0.99958", ethBalance: "1.0" }),
+        );
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("reports plain insufficient balance when the amount alone is too big", () => {
+        const r = validateTransfer(eth({ amount: "2.0", ethBalance: "1.0" }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH]);
+    });
+
+    test("blocks while the fee estimate is still pending", () => {
+        const r = validateTransfer(
+            eth({ feeStatus: FEE_PENDING, feeWei: null }),
+        );
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.FEE_PENDING]);
+    });
+
+    test("blocks when the fee estimate failed, without assuming zero", () => {
+        const r = validateTransfer(
+            eth({
+                amount: "1.0",
+                ethBalance: "1.0",
+                feeStatus: FEE_UNAVAILABLE,
+                feeWei: null,
+            }),
+        );
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.FEE_UNAVAILABLE]);
+        // A zero fee would have let this exact transfer through.
+        expect(
+            validateTransfer(
+                eth({ amount: "1.0", ethBalance: "1.0", feeWei: 0n }),
+            ).canSend,
+        ).toBe(true);
+    });
+
+    test("still reports an over-balance amount before the estimate lands", () => {
+        const r = validateTransfer(
+            eth({
+                amount: "2.0",
+                ethBalance: "1.0",
+                feeStatus: FEE_PENDING,
+                feeWei: null,
+            }),
+        );
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH, CODES.FEE_PENDING]);
+    });
+
+    test("rejects an amount it cannot do exact arithmetic on", () => {
+        const r = validateTransfer(eth({ amount: "abc" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.AMOUNT_INVALID]);
+    });
+
+    test("rejects a negative amount", () => {
+        // A negative amount parses to a perfectly good bigint, so neither
+        // balance comparison can fire: both are trivially false against it.
+        // Left unblocked it clears the screen and then dies at encode time.
+        const r = validateTransfer(
+            eth({ amount: "-1", ethBalance: "1.0", feeWei: 861000000000000n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+        expect(
+            validateTransfer(eth({ amount: "-0.000000000000000001" })),
+        ).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+    });
+
+    test("treats a missing balance as zero, not as unlimited", () => {
+        const r = validateTransfer(eth({ ethBalance: undefined }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH]);
+    });
+});
+
+describe("validateTransfer, ERC-20", () => {
+    const erc20 = (over) => ({
+        isErc20: true,
+        amount: "100.0",
+        tokenBalance: "250.0",
+        ethBalance: "1.0",
+        feeStatus: FEE_KNOWN,
+        feeWei: FEE,
+        ...over,
+    });
+
+    test("allows a transfer with tokens to spend and ETH for the fee", () => {
+        expect(validateTransfer(erc20())).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("checks the token amount against the token balance", () => {
+        const r = validateTransfer(erc20({ amount: "250.000001" }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_TOKEN]);
+    });
+
+    test("does not charge the fee against the token balance", () => {
+        // The full token balance is sendable: the fee is paid in ETH.
+        expect(validateTransfer(erc20({ amount: "250.0" })).canSend).toBe(true);
+    });
+
+    test("blocks when the ETH balance does not cover the fee", () => {
+        const r = validateTransfer(erc20({ ethBalance: "0.0001" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_FOR_FEE]);
+    });
+
+    test("allows a fee exactly equal to the ETH balance", () => {
+        const r = validateTransfer(erc20({ ethBalance: "0.00042" }));
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("reports both shortfalls when tokens and ETH are both short", () => {
+        const r = validateTransfer(
+            erc20({ amount: "300.0", ethBalance: "0.0" }),
+        );
+        expect(r.codes).toEqual([
+            CODES.INSUFFICIENT_TOKEN,
+            CODES.INSUFFICIENT_ETH_FOR_FEE,
+        ]);
+    });
+
+    test("blocks while the fee estimate is pending or failed", () => {
+        expect(
+            validateTransfer(erc20({ feeStatus: FEE_PENDING, feeWei: null }))
+                .codes,
+        ).toEqual([CODES.FEE_PENDING]);
+        expect(
+            validateTransfer(
+                erc20({ feeStatus: FEE_UNAVAILABLE, feeWei: null }),
+            ).codes,
+        ).toEqual([CODES.FEE_UNAVAILABLE]);
+    });
+
+    test("rejects a negative token amount", () => {
+        const r = validateTransfer(
+            erc20({ amount: "-0.5", feeWei: 861000000000000n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+    });
+
+    test("treats a missing token balance as zero", () => {
+        const r = validateTransfer(erc20({ tokenBalance: undefined }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_TOKEN]);
+    });
+});
+
+// The reserve a node requires, not the fee the transaction is expected to
+// actually cost. An unpinned send goes out as type-2, and the node checks it
+// against maxFeePerGas; reserving gasPrice lets a transaction the node will
+// reject pass the gate.
+describe("feeReserveWei", () => {
+    // baseFee 20 gwei, tip 1 gwei: eth_gasPrice reports ~21 gwei, while
+    // ethers populates maxFeePerGas as baseFee * 2 + tip = 41 gwei.
+    const type2 = {
+        gasPrice: 21n * GWEI,
+        maxFeePerGas: 41n * GWEI,
+        maxPriorityFeePerGas: 1n * GWEI,
+    };
+
+    test("reserves gasLimit * maxFeePerGas, not gasLimit * gasPrice", () => {
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(GAS_LIMIT * 41n * GWEI);
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(861000000000000n);
+        // The number the node would not have accepted.
+        expect(feeReserveWei(GAS_LIMIT, type2)).not.toBe(441000000000000n);
+    });
+
+    test("gates out a send the type-2 reserve cannot fund", () => {
+        // Exactly fundable against a gasPrice reserve (0.999559 + 0.000441 is
+        // the whole balance to the wei), and short against the reserve the
+        // node will actually require.
+        const send = {
+            isErc20: false,
+            amount: "0.999559",
+            ethBalance: "1.0",
+            feeStatus: FEE_KNOWN,
+        };
+        expect(
+            validateTransfer({
+                ...send,
+                feeWei: GAS_LIMIT * type2.gasPrice,
+            }).canSend,
+        ).toBe(true);
+        const r = validateTransfer({
+            ...send,
+            feeWei: feeReserveWei(GAS_LIMIT, type2),
+        });
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("falls back to gasPrice on a network with no type-2 pricing", () => {
+        const legacy = { gasPrice: 21n * GWEI, maxFeePerGas: null };
+        expect(feeReserveWei(GAS_LIMIT, legacy)).toBe(GAS_LIMIT * 21n * GWEI);
+    });
+
+    test("returns null when no usable price or gas limit is available", () => {
+        expect(feeReserveWei(GAS_LIMIT, { gasPrice: null })).toBe(null);
+        expect(feeReserveWei(GAS_LIMIT, {})).toBe(null);
+        expect(feeReserveWei(GAS_LIMIT, null)).toBe(null);
+        expect(feeReserveWei(21000, type2)).toBe(null);
+    });
+});
+
+// The display counterpart of the reserve: what the transaction is expected to
+// cost. Shown alongside the reserve so the screen neither contradicts the gate
+// nor quotes the user roughly double what they will pay.
+describe("feeEstimateWei", () => {
+    const type2 = {
+        gasPrice: 21n * GWEI,
+        maxFeePerGas: 41n * GWEI,
+        maxPriorityFeePerGas: 1n * GWEI,
+    };
+
+    test("estimates gasLimit * gasPrice, below the reserve", () => {
+        expect(feeEstimateWei(GAS_LIMIT, type2)).toBe(441000000000000n);
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(861000000000000n);
+        expect(feeEstimateWei(GAS_LIMIT, type2)).toBeLessThan(
+            feeReserveWei(GAS_LIMIT, type2),
+        );
+    });
+
+    test("equals the reserve when the network has no type-2 pricing", () => {
+        const legacy = { gasPrice: 21n * GWEI, maxFeePerGas: null };
+        expect(feeEstimateWei(GAS_LIMIT, legacy)).toBe(
+            feeReserveWei(GAS_LIMIT, legacy),
+        );
+    });
+
+    test("falls back to maxFeePerGas when there is no gasPrice", () => {
+        const noLegacy = { gasPrice: null, maxFeePerGas: 41n * GWEI };
+        expect(feeEstimateWei(GAS_LIMIT, noLegacy)).toBe(
+            feeReserveWei(GAS_LIMIT, noLegacy),
+        );
+    });
+
+    test("returns null on the same unusable inputs as the reserve", () => {
+        expect(feeEstimateWei(GAS_LIMIT, {})).toBe(null);
+        expect(feeEstimateWei(GAS_LIMIT, null)).toBe(null);
+        expect(feeEstimateWei(GAS_LIMIT, { gasPrice: -1n })).toBe(null);
+        expect(feeEstimateWei(21000, type2)).toBe(null);
+    });
+});
+
+// Everything that is not a usable fee blocks exactly as FEE_UNAVAILABLE does.
+// Each of these previously returned { canSend: true, codes: [] } — counting no
+// fee at all, on a full-balance send, in the direction that lets money out.
+describe("validateTransfer, unusable fee input fails closed", () => {
+    const fullBalanceSend = (over) => ({
+        isErc20: false,
+        amount: "1.0",
+        ethBalance: "1.0",
+        ...over,
+    });
+
+    test("blocks a null fee claiming to be known", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: null }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks a known fee that is a number rather than a bigint", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: 420000000000000 }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks an unrecognised fee status", () => {
+        const r = validateTransfer(fullBalanceSend({ feeStatus: "bogus" }));
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks a negative fee", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: -1n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks an ERC-20 transfer on an unusable fee too", () => {
+        const r = validateTransfer({
+            isErc20: true,
+            amount: "100.0",
+            tokenBalance: "250.0",
+            ethBalance: "1.0",
+            feeStatus: FEE_KNOWN,
+            feeWei: null,
+        });
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+});

tests/vault.test.js

@@ -0,0 +1,346 @@
+// Tests for src/shared/vault.js: the Argon2id + XSalsa20-Poly1305 encryption
+// that protects recovery phrases and private keys at rest.
+//
+// The properties that matter here are the ones whose failure is silent. A
+// vault that decrypts under the wrong password, that hands back plaintext from
+// a ciphertext an attacker edited, that reuses a nonce, or that leaves the
+// recovery phrase readable somewhere in the stored blob all look exactly like
+// a working vault from the UI. So each test below asserts a negative: the
+// thing that must not happen.
+//
+// Cost: every encrypt and decrypt runs one Argon2id pwhash at the production
+// interactive parameters, which the module hardcodes. The parameters are not
+// weakened or overridden anywhere in this file — they are pinned by the "key
+// derivation cost" tests, since they are the vault's only defence against an
+// offline attack on a stolen blob. The suite is kept inside script/test's
+// 30-second budget by sharing one encrypted fixture across the tamper cases
+// instead of re-encrypting per test.
+
+const sodium = require("libsodium-wrappers-sumo");
+const {
+    encryptWithPassword,
+    decryptWithPassword,
+} = require("../src/shared/vault");
+
+// A publicly known development phrase. Never fund it.
+const SECRET = "test test test test test test test test test test test junk";
+const PASSWORD = "correct horse battery staple";
+const WRONG_PASSWORD = "correct horse battery stapl";
+
+const SALT_BYTES = 16;
+const NONCE_BYTES = 24;
+const POLY1305_TAG_BYTES = 16;
+
+const BASE64 = /^[A-Za-z0-9+/_-]+={0,2}$/;
+
+function b64decode(s) {
+    return sodium.from_base64(s);
+}
+
+// A shallow copy with one field replaced, so the shared fixture is never
+// mutated by a tamper test.
+function withField(blob, field, value) {
+    return { ...blob, [field]: value };
+}
+
+// Flip the low bit of one byte of a base64-encoded field.
+function flipByte(b64, index) {
+    const bytes = b64decode(b64);
+    bytes[index] ^= 0x01;
+    return sodium.to_base64(bytes);
+}
+
+let vault;
+
+beforeAll(async () => {
+    await sodium.ready;
+    vault = await encryptWithPassword(SECRET, PASSWORD);
+});
+
+describe("stored blob shape", () => {
+    test("is exactly the documented { salt, nonce, ciphertext }", () => {
+        expect(Object.keys(vault).sort()).toEqual([
+            "ciphertext",
+            "nonce",
+            "salt",
+        ]);
+    });
+
+    test("every field is a base64 string", () => {
+        for (const field of ["salt", "nonce", "ciphertext"]) {
+            expect(typeof vault[field]).toBe("string");
+            expect(vault[field]).toMatch(BASE64);
+        }
+    });
+
+    test("salt and nonce are full length", () => {
+        expect(b64decode(vault.salt)).toHaveLength(SALT_BYTES);
+        expect(b64decode(vault.nonce)).toHaveLength(NONCE_BYTES);
+    });
+
+    test("ciphertext carries a Poly1305 authentication tag", () => {
+        expect(b64decode(vault.ciphertext)).toHaveLength(
+            SECRET.length + POLY1305_TAG_BYTES,
+        );
+    });
+
+    test("the blob survives JSON storage unchanged", async () => {
+        const stored = JSON.parse(JSON.stringify(vault));
+
+        await expect(decryptWithPassword(stored, PASSWORD)).resolves.toBe(
+            SECRET,
+        );
+    });
+});
+
+describe("no plaintext leakage", () => {
+    test("the secret does not appear in the serialized vault", () => {
+        const serialized = JSON.stringify(vault);
+
+        expect(serialized).not.toContain(SECRET);
+        for (const word of new Set(SECRET.split(" "))) {
+            expect(serialized).not.toContain(word);
+        }
+    });
+
+    test("the ciphertext bytes do not contain the secret bytes", () => {
+        const bytes = Buffer.from(b64decode(vault.ciphertext));
+
+        expect(bytes.includes(Buffer.from(SECRET, "utf8"))).toBe(false);
+        // Not even the first word, which would betray an unencrypted prefix.
+        expect(bytes.includes(Buffer.from("test test", "utf8"))).toBe(false);
+    });
+
+    test("the password does not appear in the serialized vault", () => {
+        expect(JSON.stringify(vault)).not.toContain(PASSWORD);
+    });
+});
+
+describe("round trip", () => {
+    test("decrypts back to the original secret", async () => {
+        await expect(decryptWithPassword(vault, PASSWORD)).resolves.toBe(
+            SECRET,
+        );
+    });
+
+    test("survives a non-ASCII plaintext byte for byte", async () => {
+        const unicode = "recovery phrase é中文\u{1f600}";
+
+        const blob = await encryptWithPassword(unicode, PASSWORD);
+
+        await expect(decryptWithPassword(blob, PASSWORD)).resolves.toBe(
+            unicode,
+        );
+    });
+
+    test("an empty password still round-trips and is not a bypass", async () => {
+        const blob = await encryptWithPassword(SECRET, "");
+
+        await expect(decryptWithPassword(blob, "")).resolves.toBe(SECRET);
+        // An empty password must not act as a skeleton key on other vaults,
+        // nor may a real password open an empty-password vault.
+        await expect(decryptWithPassword(vault, "")).rejects.toThrow();
+        await expect(decryptWithPassword(blob, PASSWORD)).rejects.toThrow();
+    });
+});
+
+describe("fresh salt and nonce", () => {
+    test("two encryptions of the same plaintext differ in all three fields", async () => {
+        const second = await encryptWithPassword(SECRET, PASSWORD);
+
+        expect(second.salt).not.toBe(vault.salt);
+        expect(second.nonce).not.toBe(vault.nonce);
+        expect(second.ciphertext).not.toBe(vault.ciphertext);
+        await expect(decryptWithPassword(second, PASSWORD)).resolves.toBe(
+            SECRET,
+        );
+    });
+});
+
+describe("key derivation cost", () => {
+    // Argon2id's opslimit and memlimit are the whole of the vault's resistance
+    // to an offline attack on a stolen blob, and lowering them breaks nothing
+    // any other test here can see — the suite merely runs faster. So pin them
+    // directly, both to libsodium's INTERACTIVE constants and to the absolute
+    // values those constants must keep meaning.
+    const INTERACTIVE_OPSLIMIT = 2;
+    const INTERACTIVE_MEMLIMIT = 64 * 1024 * 1024;
+
+    test("the interactive constants still mean 2 passes over 64 MiB", () => {
+        expect(sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE).toBe(
+            INTERACTIVE_OPSLIMIT,
+        );
+        expect(sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE).toBe(
+            INTERACTIVE_MEMLIMIT,
+        );
+        // The floor these must never quietly be swapped for: _MIN is one pass
+        // over 8 KiB, an 8192x reduction in memory cost.
+        expect(sodium.crypto_pwhash_OPSLIMIT_MIN).toBeLessThan(
+            INTERACTIVE_OPSLIMIT,
+        );
+        expect(sodium.crypto_pwhash_MEMLIMIT_MIN).toBeLessThan(
+            INTERACTIVE_MEMLIMIT,
+        );
+    });
+
+    test("a key derived at the interactive parameters opens the vault", () => {
+        // Independent of any spy, and of the module's own code path: derive
+        // the key here from the vault's published salt at the interactive cost
+        // and open its ciphertext directly. A vault whose key came from any
+        // other opslimit, memlimit or Argon2id variant yields a different key
+        // and cannot be opened this way.
+        const key = sodium.crypto_pwhash(
+            sodium.crypto_secretbox_KEYBYTES,
+            PASSWORD,
+            b64decode(vault.salt),
+            INTERACTIVE_OPSLIMIT,
+            INTERACTIVE_MEMLIMIT,
+            sodium.crypto_pwhash_ALG_ARGON2ID13,
+        );
+        const opened = sodium.crypto_secretbox_open_easy(
+            b64decode(vault.ciphertext),
+            b64decode(vault.nonce),
+            key,
+        );
+
+        expect(sodium.to_string(opened)).toBe(SECRET);
+    });
+
+    test.each([
+        [
+            "encrypt",
+            async () => {
+                await encryptWithPassword(SECRET, PASSWORD);
+            },
+        ],
+        [
+            "decrypt",
+            async () => {
+                await decryptWithPassword(vault, PASSWORD);
+            },
+        ],
+    ])("%s derives exactly one key at the interactive cost", async (_, run) => {
+        const spy = jest.spyOn(sodium, "crypto_pwhash");
+        try {
+            await run();
+
+            expect(spy).toHaveBeenCalledTimes(1);
+            const [keyBytes, , salt, opslimit, memlimit, alg] =
+                spy.mock.calls[0];
+            expect(keyBytes).toBe(sodium.crypto_secretbox_KEYBYTES);
+            expect(salt).toHaveLength(SALT_BYTES);
+            expect(opslimit).toBe(sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE);
+            expect(memlimit).toBe(sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE);
+            expect(alg).toBe(sodium.crypto_pwhash_ALG_ARGON2ID13);
+        } finally {
+            spy.mockRestore();
+        }
+    });
+});
+
+describe("wrong password", () => {
+    test("is rejected, and rejects cleanly", async () => {
+        // rejects.toThrow asserts a rejected promise, not a synchronous throw
+        // and not an unhandled rejection: the caller can catch this.
+        await expect(
+            decryptWithPassword(vault, WRONG_PASSWORD),
+        ).rejects.toThrow();
+    });
+
+    test("returns no plaintext, not even partially", async () => {
+        const result = await decryptWithPassword(vault, WRONG_PASSWORD).catch(
+            (err) => err,
+        );
+
+        expect(result).toBeInstanceOf(Error);
+        expect(String(result)).not.toContain("test");
+    });
+
+    test("the empty password is rejected on a password-protected vault", async () => {
+        await expect(decryptWithPassword(vault, "")).rejects.toThrow();
+    });
+});
+
+describe("tampering", () => {
+    test("a flipped ciphertext bit is rejected by the auth tag", async () => {
+        const tampered = withField(
+            vault,
+            "ciphertext",
+            flipByte(vault.ciphertext, 0),
+        );
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a flipped bit in the authentication tag itself is rejected", async () => {
+        const tagStart = b64decode(vault.ciphertext).length - 1;
+        const tampered = withField(
+            vault,
+            "ciphertext",
+            flipByte(vault.ciphertext, tagStart),
+        );
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a flipped nonce bit is rejected", async () => {
+        const tampered = withField(vault, "nonce", flipByte(vault.nonce, 0));
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a flipped salt bit is rejected", async () => {
+        const tampered = withField(vault, "salt", flipByte(vault.salt, 0));
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a truncated ciphertext is rejected", async () => {
+        const bytes = b64decode(vault.ciphertext);
+        const tampered = withField(
+            vault,
+            "ciphertext",
+            sodium.to_base64(bytes.slice(0, bytes.length - 4)),
+        );
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a ciphertext shorter than the auth tag is rejected", async () => {
+        const tampered = withField(
+            vault,
+            "ciphertext",
+            sodium.to_base64(b64decode(vault.ciphertext).slice(0, 4)),
+        );
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a truncated nonce is rejected", async () => {
+        const tampered = withField(
+            vault,
+            "nonce",
+            sodium.to_base64(b64decode(vault.nonce).slice(0, NONCE_BYTES - 1)),
+        );
+
+        await expect(decryptWithPassword(tampered, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a ciphertext from another vault is rejected", async () => {
+        const other = await encryptWithPassword("a different secret", PASSWORD);
+        const spliced = withField(vault, "ciphertext", other.ciphertext);
+
+        await expect(decryptWithPassword(spliced, PASSWORD)).rejects.toThrow();
+    });
+
+    test("a missing field is rejected rather than decrypted", async () => {
+        for (const field of ["salt", "nonce", "ciphertext"]) {
+            const broken = { ...vault };
+            delete broken[field];
+
+            await expect(
+                decryptWithPassword(broken, PASSWORD),
+            ).rejects.toThrow();
+        }
+    });
+});

tests/vaultBackend.test.js

@@ -0,0 +1,52 @@
+// The unit tests must exercise the libsodium backend that actually ships
+// (#182). Before this, they could not: node compiles WebAssembly happily,
+// the extension CSP refused it, and so the browser silently ran the
+// wasm2js translation while every test ran the WASM build.
+//
+// With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
+// hold that agreement in place from the node side. tests/manifest.test.js
+// holds up the CSP end of it, and the end-to-end suite observes the real
+// popup.
+
+const { cryptoBackend } = require("../src/shared/vault");
+
+// The module libsodium-wrappers-sumo itself requires and drives. Not a new
+// dependency: it is inspected here, never used to perform crypto, because
+// it is the only thing that can say which backend is loaded.
+const SODIUM_CORE = "libsodium-sumo";
+
+describe("libsodium backend", () => {
+    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
+        await expect(cryptoBackend()).resolves.toBe("wasm");
+    });
+
+    test("libsodium did not swap in the wasm2js fallback", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        // useBackupModule is the entry point to the fallback; taking it
+        // replaces the module's exports with the translation's, and the
+        // entry point goes with them. Still present after ready means the
+        // WASM module is the one in place. The test below is what keeps
+        // that inference honest.
+        expect(typeof core.useBackupModule).toBe("function");
+    });
+
+    // Deliberately last, and deliberately destructive: it takes the
+    // fallback, which replaces the loaded module for the rest of this
+    // file. Jest gives each test file its own module registry, so nothing
+    // outside sees it.
+    //
+    // Without this, the check above would be a claim about libsodium's
+    // internals with nothing holding it to account: if a future version
+    // kept useBackupModule on the fallback module too, the marker would
+    // quietly become true in both backends and the test would pass while
+    // measuring nothing. Forcing the fallback and watching the marker
+    // disappear is what makes its presence mean something.
+    test("the fallback marker distinguishes the two backends", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        expect(typeof core.useBackupModule).toBe("function");
+        await core.useBackupModule();
+        expect(typeof core.useBackupModule).toBe("undefined");
+    });
+});

tests/wallet.test.js

@@ -1,4 +1,6 @@
-// Tests for the DEBUG build flag as it gates mnemonic generation.
+// Tests for src/shared/wallet.js: the DEBUG build flag as it gates mnemonic
+// generation (first two describes), and HD key derivation against published
+// known-answer vectors (rest of the file).
 //
 // The modules read the __BUILD_DEBUG__ global that esbuild replaces at bundle
 // time. Under jest the global is absent, which is exactly the release-build
@@ -92,3 +94,449 @@ describe("generateMnemonic in a debug build", () => {
         );
     });
 });
+
+// ---------------------------------------------------------------------------
+// Key derivation.
+//
+// Every address below is a published constant, not something this codebase
+// produced. Asserting against what the implementation happens to return today
+// would pass just as happily with the wrong coin type, the wrong path depth or
+// a non-empty seed passphrase, all of which silently send funds to addresses
+// no other wallet can recover.
+//
+// Vector sources:
+//
+//   VECTOR_PHRASE / VECTOR_ADDRESSES / VECTOR_PRIVATE_KEYS — the standard
+//   development recovery phrase and the first three accounts it yields at
+//   m/44'/60'/0'/0/n with an empty seed passphrase, as published in the
+//   Hardhat and Ganache documentation. Publicly known; never fund it.
+//
+//   ZERO_ENTROPY_PHRASE / ZERO_ENTROPY_ADDRESS — the BIP-39 all-zero-entropy
+//   phrase (Trezor's official BIP-39 vector set, first entry) and its
+//   m/44'/60'/0'/0/0 Ethereum address with an empty seed passphrase. A second,
+//   independently published phrase so the pin is not one vector deep.
+//
+//   BIP32_VECTOR_1_XPRV — the master key of BIP-32 test vector 1
+//   (seed 000102030405060708090a0b0c0d0e0f).
+//
+// The two Hardhat facts cross-check each other: VECTOR_PRIVATE_KEYS[n] is the
+// published key for VECTOR_ADDRESSES[n], so addressFromPrivateKey and the HD
+// path must meet at the same address from two different directions.
+
+const { HDNodeWallet, Mnemonic, verifyMessage } = require("ethers");
+const wallet = require("../src/shared/wallet");
+const { BIP44_ETH_PATH } = require("../src/shared/constants");
+
+const VECTOR_PHRASE =
+    "test test test test test test test test test test test junk";
+
+const VECTOR_ADDRESSES = [
+    "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+    "0x70997970C51812dc3A010C7d01b50e0d17dc79C8",
+    "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC",
+];
+
+const VECTOR_PRIVATE_KEYS = [
+    "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80",
+    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d",
+    "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a",
+];
+
+const ZERO_ENTROPY_PHRASE =
+    "abandon abandon abandon abandon abandon abandon " +
+    "abandon abandon abandon abandon abandon about";
+const ZERO_ENTROPY_ADDRESS = "0x9858EfFD232B4033E47d90003D41EC34EcaEda94";
+
+const BIP32_VECTOR_1_XPRV =
+    "xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqji" +
+    "ChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi";
+
+// The master (depth-0) extended private key for a phrase, which is what the
+// import-an-xprv flow is handed. Built with ethers rather than with the module
+// under test, so hdWalletFromXprv is not being checked against itself.
+function masterXprv(phrase, passphrase = "") {
+    return HDNodeWallet.fromSeed(
+        Mnemonic.fromPhrase(phrase, passphrase).computeSeed(),
+    ).extendedKey;
+}
+
+// The account-level (depth-3) extended private key m/44'/60'/0' for a phrase.
+// A normal thing for a user to hold, and not something the import flow can
+// derive the BIP-44 account path from.
+function accountXprv(phrase) {
+    return HDNodeWallet.fromSeed(
+        Mnemonic.fromPhrase(phrase, "").computeSeed(),
+    ).derivePath("m/44'/60'/0'").extendedKey;
+}
+
+// Every single-character substitution of `key`, using base58 characters that
+// are not the original. Base58 has no visually ambiguous characters, so each
+// of these is a plausible typo rather than a contrived string.
+const TYPO_CHARS = ["a", "b", "2", "Z"];
+
+function singleCharacterTypos(key) {
+    const out = [];
+    for (let i = 0; i < key.length; i++) {
+        for (const c of TYPO_CHARS) {
+            if (c === key[i]) continue;
+            out.push(key.slice(0, i) + c + key.slice(i + 1));
+        }
+    }
+    return out;
+}
+
+describe("hdWalletFromMnemonic", () => {
+    test("first address matches the published vector for m/44'/60'/0'/0/0", () => {
+        expect(wallet.hdWalletFromMnemonic(VECTOR_PHRASE).firstAddress).toBe(
+            VECTOR_ADDRESSES[0],
+        );
+    });
+
+    test("second published phrase derives its published address", () => {
+        expect(
+            wallet.hdWalletFromMnemonic(ZERO_ENTROPY_PHRASE).firstAddress,
+        ).toBe(ZERO_ENTROPY_ADDRESS);
+    });
+
+    test("returns the account-level xpub, which is watch-only", () => {
+        const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+        expect(xpub.startsWith("xpub")).toBe(true);
+        // A neutered ethers node exposes no private key at all, so accept
+        // either absent or null rather than pinning which.
+        expect(
+            HDNodeWallet.fromExtendedKey(xpub).privateKey ?? null,
+        ).toBeNull();
+        expect(wallet.isValidXprv(xpub)).toBe(false);
+    });
+
+    test("the account path is the documented BIP-44 Ethereum path", () => {
+        expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
+    });
+
+    test("rejects an invalid recovery phrase rather than deriving from it", () => {
+        expect(() => wallet.hdWalletFromMnemonic("not a phrase")).toThrow();
+    });
+});
+
+describe("deriveAddressFromXpub", () => {
+    const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+    test.each([0, 1, 2])(
+        "child %i matches the published vector address",
+        (index) => {
+            expect(wallet.deriveAddressFromXpub(xpub, index)).toBe(
+                VECTOR_ADDRESSES[index],
+            );
+        },
+    );
+
+    test("agrees with hdWalletFromMnemonic at index 0", () => {
+        expect(wallet.deriveAddressFromXpub(xpub, 0)).toBe(
+            wallet.hdWalletFromMnemonic(VECTOR_PHRASE).firstAddress,
+        );
+    });
+
+    test("rejects garbage instead of returning an address", () => {
+        expect(() =>
+            wallet.deriveAddressFromXpub("xpub-nonsense", 0),
+        ).toThrow();
+    });
+});
+
+describe("hdWalletFromMnemonic seed passphrase handling", () => {
+    // The vectors above are only reproducible with an empty BIP-39 seed
+    // passphrase. This pins that the empty string reaching
+    // HDNodeWallet.fromPhrase is load-bearing: with any passphrase applied the
+    // published address is unreachable, and a wallet derived that way could
+    // not be restored anywhere else from the phrase alone.
+    test("a non-empty seed passphrase would yield a different address", () => {
+        const withPassphrase = HDNodeWallet.fromPhrase(
+            VECTOR_PHRASE,
+            "TREZOR",
+            BIP44_ETH_PATH,
+        ).deriveChild(0).address;
+
+        expect(withPassphrase).not.toBe(VECTOR_ADDRESSES[0]);
+    });
+});
+
+describe("hdWalletFromXprv", () => {
+    // hdWalletFromMnemonic derives the absolute path "m/44'/60'/0'/0" while
+    // hdWalletFromXprv derives the relative path "44'/60'/0'/0". For a
+    // depth-0 master key the two are the same derivation; these tests pin that
+    // equivalence to a published address rather than assuming it.
+    test("master xprv for the vector phrase yields the vector address", () => {
+        expect(
+            wallet.hdWalletFromXprv(masterXprv(VECTOR_PHRASE)).firstAddress,
+        ).toBe(VECTOR_ADDRESSES[0]);
+    });
+
+    test("agrees with hdWalletFromMnemonic on xpub and address", () => {
+        const fromPhrase = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+        const fromXprv = wallet.hdWalletFromXprv(masterXprv(VECTOR_PHRASE));
+
+        expect(fromXprv).toEqual(fromPhrase);
+    });
+
+    test("derived xpub generates the same child addresses", () => {
+        const { xpub } = wallet.hdWalletFromXprv(masterXprv(VECTOR_PHRASE));
+
+        expect(
+            [0, 1, 2].map((i) => wallet.deriveAddressFromXpub(xpub, i)),
+        ).toEqual(VECTOR_ADDRESSES);
+    });
+
+    test("accepts the BIP-32 test vector 1 master key", () => {
+        const { xpub, firstAddress } =
+            wallet.hdWalletFromXprv(BIP32_VECTOR_1_XPRV);
+
+        expect(xpub.startsWith("xpub")).toBe(true);
+        expect(firstAddress).toMatch(/^0x[0-9a-fA-F]{40}$/);
+    });
+
+    test("rejects a watch-only xpub", () => {
+        const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+        expect(() => wallet.hdWalletFromXprv(xpub)).toThrow();
+    });
+
+    test("rejects garbage", () => {
+        expect(() => wallet.hdWalletFromXprv("nonsense")).toThrow();
+    });
+});
+
+describe("isValidXprv", () => {
+    test.each([
+        ["BIP-32 test vector 1 master key", BIP32_VECTOR_1_XPRV, true],
+        ["the empty string", "", false],
+        ["garbage", "not-a-key", false],
+        ["a bare private key", VECTOR_PRIVATE_KEYS[0], false],
+        ["a truncated xprv", BIP32_VECTOR_1_XPRV.slice(0, -6), false],
+        ["an xprv with an extra character", BIP32_VECTOR_1_XPRV + "a", false],
+    ])("%s -> %s", (_name, key, expected) => {
+        expect(wallet.isValidXprv(key)).toBe(expected);
+    });
+
+    test("a watch-only xpub is not an xprv", () => {
+        const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+        expect(wallet.isValidXprv(xpub)).toBe(false);
+    });
+
+    test("rejects an extended key with a one-character typo", () => {
+        const index = BIP32_VECTOR_1_XPRV.length - 8;
+        const typo =
+            BIP32_VECTOR_1_XPRV.slice(0, index) +
+            (BIP32_VECTOR_1_XPRV[index] === "a" ? "b" : "a") +
+            BIP32_VECTOR_1_XPRV.slice(index + 1);
+
+        expect(wallet.isValidXprv(typo)).toBe(false);
+    });
+
+    // The base58 checksum exists to make a mistyped key impossible to use, and
+    // ethers does not enforce it: HDNodeWallet.fromExtendedKey skips checksum
+    // verification whenever the decoded payload is the usual 82 bytes, which
+    // is precisely the case it is there to catch. A typo anywhere in the key
+    // must be refused, not silently turned into someone else's wallet.
+    test("no single-character typo anywhere in the key is accepted", () => {
+        const accepted = singleCharacterTypos(BIP32_VECTOR_1_XPRV).filter(
+            (typo) => wallet.isValidXprv(typo),
+        );
+
+        expect(accepted).toEqual([]);
+    });
+
+    test("a typo never yields a wallet, let alone a different one", () => {
+        const correct = wallet.hdWalletFromXprv(BIP32_VECTOR_1_XPRV);
+        const derived = [];
+        for (const typo of singleCharacterTypos(BIP32_VECTOR_1_XPRV)) {
+            try {
+                derived.push(wallet.hdWalletFromXprv(typo).firstAddress);
+            } catch {
+                // Rejected, which is the required behaviour.
+            }
+        }
+
+        expect(derived).toEqual([]);
+        expect(correct.firstAddress).toBe(
+            "0x022b971dFF0C43305e691DEd7a14367AF19D6407",
+        );
+    });
+});
+
+describe("extended key depth", () => {
+    // hdWalletFromXprv derives the BIP-44 Ethereum account path from the key
+    // it is given. That is only the path it names when the key is the master
+    // key. Under an account-level key the same derivation lands at
+    // m/44'/60'/0'/44'/60'/0'/0, whose addresses correspond to nothing the
+    // user holds, so a non-master key is refused rather than derived from.
+    test("a master key is a master key", () => {
+        expect(wallet.isMasterExtendedKey(masterXprv(VECTOR_PHRASE))).toBe(
+            true,
+        );
+        expect(wallet.isMasterExtendedKey(BIP32_VECTOR_1_XPRV)).toBe(true);
+    });
+
+    test("an account-level key is not a master key", () => {
+        expect(wallet.isMasterExtendedKey(accountXprv(VECTOR_PHRASE))).toBe(
+            false,
+        );
+    });
+
+    test("a derived xpub is not a master key", () => {
+        expect(
+            wallet.isMasterExtendedKey(
+                wallet.hdWalletFromMnemonic(VECTOR_PHRASE).xpub,
+            ),
+        ).toBe(false);
+    });
+
+    test("a mistyped key is not a master key either", () => {
+        expect(wallet.isMasterExtendedKey(BIP32_VECTOR_1_XPRV + "a")).toBe(
+            false,
+        );
+    });
+
+    test("hdWalletFromXprv rejects an account-level key", () => {
+        expect(() =>
+            wallet.hdWalletFromXprv(accountXprv(VECTOR_PHRASE)),
+        ).toThrow(/master/i);
+    });
+
+    test("getSignerForAddress rejects an account-level key", () => {
+        expect(() =>
+            wallet.getSignerForAddress(
+                { type: "xprv" },
+                0,
+                accountXprv(VECTOR_PHRASE),
+            ),
+        ).toThrow(/master/i);
+    });
+
+    test("the account-level key is well-formed, so only depth rejects it", () => {
+        expect(wallet.isValidXprv(accountXprv(VECTOR_PHRASE))).toBe(true);
+    });
+
+    test("a master key still imports and derives the published addresses", () => {
+        const { xpub, firstAddress } = wallet.hdWalletFromXprv(
+            masterXprv(VECTOR_PHRASE),
+        );
+
+        expect(firstAddress).toBe(VECTOR_ADDRESSES[0]);
+        expect(
+            [0, 1, 2].map((i) => wallet.deriveAddressFromXpub(xpub, i)),
+        ).toEqual(VECTOR_ADDRESSES);
+    });
+});
+
+describe("deriveAddressFromXpub checksum enforcement", () => {
+    // The xpub path shares the hole: fromExtendedKey accepts a mistyped xpub
+    // just as readily, and deriveAddressFromXpub would hand back addresses
+    // from a different tree.
+    const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+    test("the correct xpub still derives the published addresses", () => {
+        expect(wallet.deriveAddressFromXpub(xpub, 0)).toBe(VECTOR_ADDRESSES[0]);
+    });
+
+    test("no single-character typo anywhere in an xpub is accepted", () => {
+        const derived = [];
+        for (const typo of singleCharacterTypos(xpub)) {
+            try {
+                derived.push(wallet.deriveAddressFromXpub(typo, 0));
+            } catch {
+                // Rejected, which is the required behaviour.
+            }
+        }
+
+        expect(derived).toEqual([]);
+    });
+});
+
+describe("isValidMnemonic", () => {
+    test.each([
+        ["the vector phrase", VECTOR_PHRASE, true],
+        ["the BIP-39 zero-entropy phrase", ZERO_ENTROPY_PHRASE, true],
+        [
+            "a 12-word phrase with a bad checksum",
+            "abandon abandon abandon abandon abandon abandon " +
+                "abandon abandon abandon abandon abandon abandon",
+            false,
+        ],
+        ["an 11-word phrase", "abandon ".repeat(10) + "about", false],
+        ["a word outside the wordlist", VECTOR_PHRASE + " zzzzzz", false],
+        ["the empty string", "", false],
+        ["garbage", "correct horse battery staple", false],
+    ])("%s -> %s", (_name, phrase, expected) => {
+        expect(wallet.isValidMnemonic(phrase)).toBe(expected);
+    });
+});
+
+describe("addressFromPrivateKey", () => {
+    test.each([0, 1, 2])(
+        "published key %i yields its published address",
+        (index) => {
+            expect(
+                wallet.addressFromPrivateKey(VECTOR_PRIVATE_KEYS[index]),
+            ).toBe(VECTOR_ADDRESSES[index]);
+        },
+    );
+
+    test("rejects a key of the wrong length", () => {
+        expect(() => wallet.addressFromPrivateKey("0xdeadbeef")).toThrow();
+    });
+
+    test("rejects the empty string", () => {
+        expect(() => wallet.addressFromPrivateKey("")).toThrow();
+    });
+});
+
+describe("getSignerForAddress", () => {
+    test.each([0, 1, 2])("hd wallet, address index %i", (index) => {
+        const signer = wallet.getSignerForAddress(
+            { type: "hd" },
+            index,
+            VECTOR_PHRASE,
+        );
+
+        expect(signer.address).toBe(VECTOR_ADDRESSES[index]);
+        expect(signer.privateKey).toBe(VECTOR_PRIVATE_KEYS[index]);
+    });
+
+    test.each([0, 1, 2])("xprv wallet, address index %i", (index) => {
+        const signer = wallet.getSignerForAddress(
+            { type: "xprv" },
+            index,
+            masterXprv(VECTOR_PHRASE),
+        );
+
+        expect(signer.address).toBe(VECTOR_ADDRESSES[index]);
+        expect(signer.privateKey).toBe(VECTOR_PRIVATE_KEYS[index]);
+    });
+
+    test("single private key ignores the address index", () => {
+        for (const index of [0, 1, 2]) {
+            const signer = wallet.getSignerForAddress(
+                { type: "privkey" },
+                index,
+                VECTOR_PRIVATE_KEYS[1],
+            );
+
+            expect(signer.address).toBe(VECTOR_ADDRESSES[1]);
+        }
+    });
+
+    test("the returned signer signs recoverably as the expected address", async () => {
+        const signer = wallet.getSignerForAddress(
+            { type: "hd" },
+            1,
+            VECTOR_PHRASE,
+        );
+        const message = "AutistMask derivation test";
+
+        const signature = await signer.signMessage(message);
+
+        expect(verifyMessage(message, signature)).toBe(VECTOR_ADDRESSES[1]);
+    });
+});

tests/walletDefects.test.js

@@ -0,0 +1,290 @@
+// Tests for the stored-state half of the non-master extended key problem.
+//
+// Refusing a non-master xprv at import time does nothing for a wallet that is
+// already in storage: the import that created it ran before the refusal
+// existed. Such a wallet used to sign for the wrong tree and now throws on the
+// send screen instead. These tests pin down that it is named and explained in
+// the wallet list, that nothing on the way there throws, and that a wallet
+// imported from a real master key is untouched by any of it.
+
+const { HDNodeWallet, Mnemonic } = require("ethers");
+
+const wallet = require("../src/shared/wallet");
+const {
+    walletDefect,
+    walletDefectHtml,
+    NON_MASTER_XPRV,
+} = require("../src/shared/walletDefects");
+
+// BIP-39 test vector phrase, published; never used for real funds.
+const VECTOR_PHRASE =
+    "test test test test test test test test test test test junk";
+
+function seedNode(phrase) {
+    return HDNodeWallet.fromSeed(Mnemonic.fromPhrase(phrase, "").computeSeed());
+}
+
+// The master (depth-0) key, which is what the import flow accepts today.
+function masterXprv(phrase) {
+    return seedNode(phrase).extendedKey;
+}
+
+// The account-level (depth-3) key m/44'/60'/0'. A normal thing for a user to
+// hold, and what the import flow used to accept.
+function accountXprv(phrase) {
+    return seedNode(phrase).derivePath("m/44'/60'/0'").extendedKey;
+}
+
+// The wallet record the CURRENT import path writes for a master key: the
+// neutered m/44'/60'/0'/0 node, four levels below a depth-0 key.
+function healthyXprvWallet(name = "Master") {
+    const { xpub, firstAddress } = wallet.hdWalletFromXprv(
+        masterXprv(VECTOR_PHRASE),
+    );
+    return {
+        name,
+        type: "xprv",
+        xpub,
+        nextIndex: 1,
+        encryptedSecret: "irrelevant-to-these-tests",
+        addresses: [{ address: firstAddress, balance: "0.0000" }],
+    };
+}
+
+// The wallet record the PRE-#210 import path wrote for an account-level key:
+// the same four levels, but derived as a relative path *beneath* the key, so
+// the stored xpub sits at depth 3 + 4 = 7. Built here the way the old code
+// built it rather than by calling the module under test, which now refuses.
+function brokenXprvWallet(name = "Imported xprv") {
+    const node = HDNodeWallet.fromExtendedKey(
+        accountXprv(VECTOR_PHRASE),
+    ).derivePath("44'/60'/0'/0");
+    return {
+        name,
+        type: "xprv",
+        xpub: node.neuter().extendedKey,
+        nextIndex: 1,
+        encryptedSecret: "irrelevant-to-these-tests",
+        addresses: [
+            { address: node.deriveChild(0).address, balance: "0.0000" },
+        ],
+    };
+}
+
+describe("the fixtures are what the two import paths actually produced", () => {
+    test("a master import stores a depth-4 xpub", () => {
+        expect(
+            HDNodeWallet.fromExtendedKey(healthyXprvWallet().xpub).depth,
+        ).toBe(4);
+    });
+
+    test("the pre-fix account-level import stored a depth-7 xpub", () => {
+        expect(
+            HDNodeWallet.fromExtendedKey(brokenXprvWallet().xpub).depth,
+        ).toBe(7);
+    });
+});
+
+describe("walletDefect", () => {
+    test("names the defect on a stored non-master xprv wallet", () => {
+        const defect = walletDefect(brokenXprvWallet());
+
+        expect(defect).not.toBeNull();
+        expect(defect.id).toBe(NON_MASTER_XPRV);
+    });
+
+    test("a depth-0 xprv wallet has no defect", () => {
+        expect(walletDefect(healthyXprvWallet())).toBeNull();
+    });
+
+    test("hd and key wallets are never assessed", () => {
+        expect(
+            walletDefect({ type: "hd", xpub: brokenXprvWallet().xpub }),
+        ).toBe(null);
+        expect(walletDefect({ type: "key" })).toBeNull();
+    });
+
+    test("an xprv wallet whose xpub cannot be parsed makes no claim", () => {
+        // No basis to say the key was non-master, so nothing is asserted
+        // about it rather than guessing.
+        expect(walletDefect({ type: "xprv", xpub: "not-a-key" })).toBeNull();
+        expect(walletDefect({ type: "xprv" })).toBeNull();
+    });
+
+    test("nothing about the wallet record is modified by the check", () => {
+        const w = brokenXprvWallet();
+        const before = JSON.stringify(w);
+
+        walletDefect(w);
+
+        expect(JSON.stringify(w)).toBe(before);
+    });
+});
+
+describe("the explanatory copy", () => {
+    const defect = walletDefect(brokenXprvWallet());
+
+    test("every sentence of it is a full sentence", () => {
+        for (const text of [defect.heading, ...defect.paragraphs]) {
+            expect(text).toMatch(/^[A-Z]/);
+            expect(text.trimEnd()).toMatch(/\.$/);
+        }
+    });
+
+    test("it says what was derived wrongly and that these are not the standard addresses", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toContain("not a master key");
+        expect(body).toMatch(/standard path/);
+    });
+
+    test("it does not claim the funds are safe and does not claim a loss", () => {
+        const all = [defect.heading, ...defect.paragraphs].join(" ");
+
+        expect(all).not.toMatch(/\bsafe\b/i);
+        expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
+    });
+
+    test("it says the wallet is not deleted and what the user can do", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toMatch(/until you delete it yourself/);
+        expect(body).toMatch(/recovery phrase/);
+    });
+
+    test("it uses the project's vocabulary", () => {
+        const all = [
+            defect.heading,
+            ...defect.paragraphs,
+            defect.shortMessage,
+        ].join(" ");
+
+        expect(all).not.toMatch(/seed phrase|mnemonic|passphrase/i);
+        expect(all).not.toMatch(/\baccounts?\b/i);
+    });
+});
+
+describe("walletDefectHtml", () => {
+    test("renders the heading and every paragraph for a defective wallet", () => {
+        const defect = walletDefect(brokenXprvWallet());
+        const html = walletDefectHtml(brokenXprvWallet());
+
+        expect(html).toContain(defect.heading);
+        for (const p of defect.paragraphs) {
+            expect(html).toContain(p);
+        }
+    });
+
+    test("renders nothing at all for a healthy wallet", () => {
+        expect(walletDefectHtml(healthyXprvWallet())).toBe("");
+    });
+});
+
+describe("the wallet list", () => {
+    let home;
+    let state;
+
+    beforeAll(() => {
+        global.chrome = {
+            storage: { local: { get: async () => ({}), set: async () => {} } },
+            runtime: { sendMessage: () => {} },
+        };
+        home = require("../src/popup/views/home");
+        state = require("../src/shared/state").state;
+    });
+
+    afterEach(() => {
+        state.wallets = [];
+        state.activeAddress = null;
+    });
+
+    test("a stored depth-3 xprv wallet renders the explanation", () => {
+        state.wallets = [brokenXprvWallet("Imported xprv")];
+
+        const html = home.walletListHtml();
+
+        expect(html).toContain(walletDefect(state.wallets[0]).heading);
+        expect(html).toContain("Imported xprv");
+    });
+
+    test("it does not offer to derive further addresses from that wallet", () => {
+        state.wallets = [brokenXprvWallet()];
+
+        expect(home.walletListHtml()).not.toContain("btn-add-address");
+    });
+
+    test("a normal depth-0 xprv wallet renders exactly as it did before", () => {
+        state.wallets = [healthyXprvWallet("Master")];
+
+        const html = home.walletListHtml();
+
+        expect(html).not.toContain(walletDefect(brokenXprvWallet()).heading);
+        expect(html).toContain("btn-add-address");
+        expect(html).toContain(state.wallets[0].addresses[0].address);
+    });
+
+    test("the defective wallet's notice does not bleed onto a healthy one", () => {
+        state.wallets = [brokenXprvWallet("Broken"), healthyXprvWallet("Fine")];
+
+        const html = home.walletListHtml();
+        const healthyPart = html.slice(html.indexOf("Fine"));
+
+        expect(html).toContain(walletDefect(state.wallets[0]).heading);
+        expect(healthyPart).not.toContain(
+            walletDefect(state.wallets[0]).heading,
+        );
+        expect(healthyPart).toContain("btn-add-address");
+    });
+});
+
+describe("no path throws an unhandled error for a defective wallet", () => {
+    test("address derivation from the stored xpub still works", () => {
+        // The stored xpub is at a non-standard depth but is a valid extended
+        // key; deriving from it is what the list render already does.
+        const w = brokenXprvWallet();
+
+        expect(() => wallet.deriveAddressFromXpub(w.xpub, 0)).not.toThrow();
+        expect(wallet.deriveAddressFromXpub(w.xpub, 0)).toBe(
+            w.addresses[0].address,
+        );
+    });
+
+    test("the wallet list renders without throwing", () => {
+        const { state } = require("../src/shared/state");
+        const home = require("../src/popup/views/home");
+        state.wallets = [brokenXprvWallet()];
+
+        expect(() => home.walletListHtml()).not.toThrow();
+
+        state.wallets = [];
+    });
+
+    test("signing refuses with the named defect rather than a bare failure", () => {
+        // getSignerForAddress is the backstop behind the UI gate. It must
+        // still refuse, and it must say why in a sentence the user can read.
+        let thrown = null;
+        try {
+            wallet.getSignerForAddress(
+                { type: "xprv" },
+                0,
+                accountXprv(VECTOR_PHRASE),
+            );
+        } catch (e) {
+            thrown = e;
+        }
+
+        expect(thrown).not.toBeNull();
+        expect(thrown.message).toMatch(/master key/);
+        expect(thrown.message.trimEnd()).toMatch(/\.$/);
+    });
+
+    test("a healthy xprv wallet signs as it always did", () => {
+        const signer = wallet.getSignerForAddress(
+            { type: "xprv" },
+            0,
+            masterXprv(VECTOR_PHRASE),
+        );
+
+        expect(signer.address).toBe(healthyXprvWallet().addresses[0].address);
+    });
+});

tests/walletDelete.test.js

@@ -0,0 +1,345 @@
+const {
+    canRemoveAddress,
+    removeAddressFromState,
+    removeWalletFromState,
+    broadcastActiveChanged,
+} = require("../src/shared/walletDelete");
+
+// Fixed addresses — never used for anything but these tests.
+const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+const A2 = "0x514910771AF9Ca656af840dff83E8264EcF986CA";
+const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
+const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+
+function wallet(name, addresses) {
+    return {
+        name,
+        addresses: addresses.map((address) => ({ address })),
+    };
+}
+
+// A three-wallet state; wallet A is an HD wallet with two addresses.
+function makeState(overrides = {}) {
+    return {
+        hasWallet: true,
+        wallets: [wallet("A", [A0, A1]), wallet("B", [B0]), wallet("C", [C0])],
+        selectedWallet: 0,
+        selectedAddress: 0,
+        activeAddress: A0,
+        allowedSites: {
+            [A0]: ["a.example"],
+            [A1]: ["b.example"],
+            [B0]: ["c.example"],
+        },
+        deniedSites: { [A1]: ["d.example"], [C0]: ["e.example"] },
+        ...overrides,
+    };
+}
+
+describe("removeWalletFromState", () => {
+    test("deleting the last wallet clears hasWallet", () => {
+        const state = makeState({
+            wallets: [wallet("A", [A0])],
+            allowedSites: { [A0]: ["a.example"] },
+            deniedSites: {},
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 0);
+
+        expect(state.hasWallet).toBe(false);
+        expect(state.wallets).toEqual([]);
+        expect(state.selectedWallet).toBeNull();
+        expect(state.selectedAddress).toBeNull();
+        expect(state.activeAddress).toBeNull();
+        expect(activeAddressChanged).toBe(true);
+    });
+
+    test("deleting a non-selected wallet leaves the selection intact", () => {
+        const state = makeState({
+            selectedWallet: 2,
+            selectedAddress: 0,
+            activeAddress: C0,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 1);
+
+        // Wallet C moved from index 2 to index 1 by the splice.
+        expect(state.wallets.map((w) => w.name)).toEqual(["A", "C"]);
+        expect(state.selectedWallet).toBe(1);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(C0);
+        expect(activeAddressChanged).toBe(false);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    test("deleting a wallet after the selection does not shift it", () => {
+        const state = makeState({
+            selectedWallet: 1,
+            selectedAddress: 0,
+            activeAddress: B0,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 2);
+
+        expect(state.selectedWallet).toBe(1);
+        expect(state.activeAddress).toBe(B0);
+        expect(activeAddressChanged).toBe(false);
+    });
+
+    test("deleting the active wallet falls back to the first remaining address", () => {
+        const state = makeState({
+            selectedWallet: 0,
+            selectedAddress: 1,
+            activeAddress: A1,
+        });
+
+        const { activeAddressChanged } = removeWalletFromState(state, 0);
+
+        expect(state.wallets.map((w) => w.name)).toEqual(["B", "C"]);
+        expect(state.selectedWallet).toBe(0);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(B0);
+        expect(activeAddressChanged).toBe(true);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    test("site permissions are dropped for every address of the wallet", () => {
+        const state = makeState();
+
+        removeWalletFromState(state, 0);
+
+        expect(state.allowedSites).toEqual({ [B0]: ["c.example"] });
+        expect(state.deniedSites).toEqual({ [C0]: ["e.example"] });
+    });
+});
+
+// An HD wallet with three addresses next to a single-address key wallet.
+// `nextIndex` is the wallet's derivation high-water mark, three addresses in.
+function makeAddressState(overrides = {}) {
+    return {
+        hasWallet: true,
+        wallets: [
+            { ...wallet("A", [A0, A1, A2]), type: "hd", nextIndex: 3 },
+            { ...wallet("B", [B0]), type: "key" },
+        ],
+        selectedWallet: 0,
+        selectedAddress: 0,
+        activeAddress: A0,
+        allowedSites: { [A0]: ["a.example"], [A1]: ["b.example"] },
+        deniedSites: { [A1]: ["d.example"], [B0]: ["e.example"] },
+        ...overrides,
+    };
+}
+
+describe("canRemoveAddress", () => {
+    test("an HD wallet with more than one address may remove one", () => {
+        expect(canRemoveAddress({ type: "hd", addresses: [{}, {}] })).toBe(
+            true,
+        );
+    });
+
+    test("an xprv wallet with more than one address may too", () => {
+        expect(canRemoveAddress({ type: "xprv", addresses: [{}, {}] })).toBe(
+            true,
+        );
+    });
+
+    // The last address is what delete-wallet is for.
+    test("a wallet holding a single address may not", () => {
+        expect(canRemoveAddress({ type: "hd", addresses: [{}] })).toBe(false);
+    });
+
+    // A key wallet holds one bare private key and cannot derive more, so it
+    // has no "+" button and gets no remove control either.
+    test("a key wallet may not, whatever its address count", () => {
+        expect(canRemoveAddress({ type: "key", addresses: [{}] })).toBe(false);
+        expect(canRemoveAddress({ type: "key", addresses: [{}, {}] })).toBe(
+            false,
+        );
+    });
+
+    test("a missing or typeless wallet may not", () => {
+        expect(canRemoveAddress(undefined)).toBe(false);
+        expect(canRemoveAddress({})).toBe(false);
+    });
+});
+
+describe("removeAddressFromState", () => {
+    test("removing a non-selected address leaves the selection where it is", () => {
+        const state = makeAddressState({
+            selectedAddress: 2,
+            activeAddress: A2,
+        });
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            0,
+            0,
+        );
+
+        expect(removed).toBe(true);
+        // A2 moved from index 2 to index 1 by the splice.
+        expect(state.wallets[0].addresses.map((a) => a.address)).toEqual([
+            A1,
+            A2,
+        ]);
+        expect(state.selectedWallet).toBe(0);
+        expect(state.selectedAddress).toBe(1);
+        expect(state.activeAddress).toBe(A2);
+        expect(activeAddressChanged).toBe(false);
+        // The wallet list itself is untouched.
+        expect(state.wallets).toHaveLength(2);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    test("removing an address after the selection does not shift it", () => {
+        const state = makeAddressState({
+            selectedAddress: 0,
+            activeAddress: A0,
+        });
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            0,
+            2,
+        );
+
+        expect(removed).toBe(true);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(A0);
+        expect(activeAddressChanged).toBe(false);
+    });
+
+    test("a selection in another wallet is untouched", () => {
+        const state = makeAddressState({
+            selectedWallet: 1,
+            selectedAddress: 0,
+            activeAddress: B0,
+        });
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            0,
+            1,
+        );
+
+        expect(removed).toBe(true);
+        expect(state.selectedWallet).toBe(1);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(B0);
+        expect(activeAddressChanged).toBe(false);
+    });
+
+    test("removing the selected address falls back to the wallet's first address", () => {
+        const state = makeAddressState({
+            selectedAddress: 1,
+            activeAddress: A1,
+        });
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            0,
+            1,
+        );
+
+        expect(removed).toBe(true);
+        expect(state.wallets[0].addresses.map((a) => a.address)).toEqual([
+            A0,
+            A2,
+        ]);
+        expect(state.selectedWallet).toBe(0);
+        expect(state.selectedAddress).toBe(0);
+        expect(state.activeAddress).toBe(A0);
+        expect(activeAddressChanged).toBe(true);
+    });
+
+    // The active address can be persisted in a different case than the
+    // wallet's copy of it, so the comparison must not be literal.
+    test("the active address is matched case-insensitively", () => {
+        const state = makeAddressState({
+            selectedAddress: 1,
+            activeAddress: A1.toLowerCase(),
+        });
+
+        const { activeAddressChanged } = removeAddressFromState(state, 0, 1);
+
+        expect(state.activeAddress).toBe(A0);
+        expect(activeAddressChanged).toBe(true);
+    });
+
+    test("site permissions are dropped for the removed address only", () => {
+        const state = makeAddressState();
+
+        removeAddressFromState(state, 0, 1);
+
+        expect(state.allowedSites).toEqual({ [A0]: ["a.example"] });
+        expect(state.deniedSites).toEqual({ [B0]: ["e.example"] });
+    });
+
+    // The derivation counter is a high-water mark, never rewound: "+" derives
+    // a fresh index rather than re-deriving the address just removed.
+    test("the wallet's derivation counter is not rewound", () => {
+        const state = makeAddressState();
+
+        removeAddressFromState(state, 0, 1);
+
+        expect(state.wallets[0].nextIndex).toBe(3);
+    });
+
+    test("the last address of a wallet is refused, and nothing changes", () => {
+        const state = makeAddressState({
+            selectedWallet: 1,
+            selectedAddress: 0,
+            activeAddress: B0,
+        });
+
+        const { removed, activeAddressChanged } = removeAddressFromState(
+            state,
+            1,
+            0,
+        );
+
+        expect(removed).toBe(false);
+        expect(activeAddressChanged).toBe(false);
+        expect(state.wallets[1].addresses.map((a) => a.address)).toEqual([B0]);
+        expect(state.activeAddress).toBe(B0);
+        expect(state.hasWallet).toBe(true);
+    });
+
+    // The same refusal reached the other way: an HD wallet worn down to one
+    // address is no more removable than a key wallet.
+    test("an HD wallet down to its last address is refused too", () => {
+        const state = makeAddressState();
+
+        expect(removeAddressFromState(state, 0, 2).removed).toBe(true);
+        expect(removeAddressFromState(state, 0, 1).removed).toBe(true);
+        expect(removeAddressFromState(state, 0, 0).removed).toBe(false);
+        expect(state.wallets[0].addresses.map((a) => a.address)).toEqual([A0]);
+    });
+
+    test("an out-of-range address index is refused", () => {
+        const state = makeAddressState();
+
+        expect(removeAddressFromState(state, 0, 7).removed).toBe(false);
+        expect(removeAddressFromState(state, 7, 0).removed).toBe(false);
+        expect(state.wallets[0].addresses).toHaveLength(3);
+    });
+});
+
+describe("broadcastActiveChanged", () => {
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("sends AUTISTMASK_ACTIVE_CHANGED to the background", () => {
+        const sendMessage = jest.fn();
+        global.chrome = { runtime: { sendMessage } };
+
+        broadcastActiveChanged();
+
+        expect(sendMessage).toHaveBeenCalledWith({
+            type: "AUTISTMASK_ACTIVE_CHANGED",
+        });
+    });
+});

yarn.lock

@@ -2547,6 +2547,11 @@ pkg-dir@^4.2.0:
   dependencies:
     find-up "^4.0.0"
 
+playwright-core@1.56.0:
+  version "1.56.0"
+  resolved "https://registry.yarnpkg.com/playwright-core/-/playwright-core-1.56.0.tgz#14b40ea436551b0bcefe19c5bfb8d1804c83739c"
+  integrity sha512-1SXl7pMfemAMSDn5rkPeZljxOCYAmQnYLBTExuh6E8USHXGSX3dx6lYZN/xPpTz1vimXmPA9CDnILvmJaB8aSQ==
+
 pngjs@^5.0.0:
   version "5.0.0"
   resolved "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz"