feat: show wallet's recovery phrase (requires password) #161

New Issue

clawbot · 2026-08-09T03:45:38+02:00

clawbot commented

2026-08-09 03:45:38 +02:00

Problem

README.md:880 lists "Show wallet's recovery phrase (requires password)" as an
open TODO, and it is genuinely missing. Grepping the callers of
decryptWithPassword finds deleteWallet.js:52, confirmTx.js:305,
addressDetail.js:338, background/index.js:745, background/index.js:804 —
none of them display the phrase.

This is a core wallet function. A user who created a wallet in AutistMask and
did not write the phrase down has no way to retrieve it, which means the
wallet's own docs (docs/README.md: "With your recovery phrase, you can
restore your wallet in AutistMask or any other compatible wallet at any time")
are not achievable from within the product.

Existing precedent to follow

Per-address private key export already exists and is the right model to
copy: logic at src/popup/views/addressDetail.js:297-374, markup at
src/popup/index.html:352-405, view id export-privkey registered at
src/popup/views/helpers.js:33, reachable from the AddressDetail "more"
dropdown (addressDetail.js:281-296, markup index.html:320-340). It is
password-gated and derives via getSignerForAddress(...).privateKey.

Mirror its structure, its password gate, and its warning treatment.

Implementation requirements

Add a "Show recovery phrase" action for HD wallets only. Key wallets
(type: "privkey") have no phrase; the action must not appear for them. Note
a third type exists, type: "xprv" (addWallet.js:242) — it also has no
recovery phrase, so it must be excluded too. Decide and state where the entry
point lives; the wallet row in Settings is the natural place since that is
where per-wallet actions (rename, delete) already are.
Password-gated via decryptWithPassword, exactly as
deleteWallet.js:52 and addressDetail.js:338 do. A wrong password must
produce a full-sentence error and reveal nothing.
The phrase must be hidden by default and revealed only after the password is
accepted. Do not render it into the DOM before it is unlocked.
Display the full phrase, click-to-copy, consistent with the Full Identifiers
Policy. Follow the monochrome, text-first, no-images style; use the same
warning-box treatment the AddWallet backup warning uses.
Warning copy must be a full sentence and must state the risk plainly —
anyone with these words can take the funds.
Clear the decrypted phrase from memory/DOM when the view is left. Confirm it
does not persist in the nav stack, is not written to state, and cannot be
restored by RESTORABLE_VIEWS (src/popup/index.js:104-115) — a secret
screen must never be what the popup reopens onto.
Ensure the phrase can never reach src/shared/log.js output.
Register the new view id in helpers.js and wire the nav stack so "Back"
behaves correctly.
Add the new screen to the README Screen Map. Note that DeleteWallet,
ExportPrivKey and SettingsAddToken are all currently missing from that map;
adding those is tracked in the docs issue, so here just add your own screen.

Definition of done

An HD wallet exposes a "Show recovery phrase" action; key and xprv
wallets do not.
The phrase is revealed only after a correct password; a wrong password
shows a full-sentence error and reveals nothing.
The full phrase is displayed untruncated and is click-to-copy.
A prominent warning about the consequences of exposure is shown.
Leaving the view clears the phrase; reopening the popup does not land on
this screen.
The phrase never appears in logs.
The screen is added to the README Screen Map with its elements and
transitions, in the established format.
The README TODO checkbox at README.md:880 is ticked.
TODO.md updated in the same commit.
make check passes.

## Problem `README.md:880` lists "Show wallet's recovery phrase (requires password)" as an open TODO, and it is genuinely missing. Grepping the callers of `decryptWithPassword` finds `deleteWallet.js:52`, `confirmTx.js:305`, `addressDetail.js:338`, `background/index.js:745`, `background/index.js:804` — none of them display the phrase. This is a core wallet function. A user who created a wallet in AutistMask and did not write the phrase down has no way to retrieve it, which means the wallet's own docs (`docs/README.md`: "With your recovery phrase, you can restore your wallet in AutistMask or any other compatible wallet at any time") are not achievable from within the product. ## Existing precedent to follow Per-address **private key export** already exists and is the right model to copy: logic at `src/popup/views/addressDetail.js:297-374`, markup at `src/popup/index.html:352-405`, view id `export-privkey` registered at `src/popup/views/helpers.js:33`, reachable from the AddressDetail "more" dropdown (`addressDetail.js:281-296`, markup `index.html:320-340`). It is password-gated and derives via `getSignerForAddress(...).privateKey`. Mirror its structure, its password gate, and its warning treatment. ## Implementation requirements - Add a "Show recovery phrase" action for **HD wallets only**. Key wallets (`type: "privkey"`) have no phrase; the action must not appear for them. Note a third type exists, `type: "xprv"` (`addWallet.js:242`) — it also has no recovery phrase, so it must be excluded too. Decide and state where the entry point lives; the wallet row in Settings is the natural place since that is where per-wallet actions (rename, delete) already are. - Password-gated via `decryptWithPassword`, exactly as `deleteWallet.js:52` and `addressDetail.js:338` do. A wrong password must produce a full-sentence error and reveal nothing. - The phrase must be hidden by default and revealed only after the password is accepted. Do not render it into the DOM before it is unlocked. - Display the full phrase, click-to-copy, consistent with the Full Identifiers Policy. Follow the monochrome, text-first, no-images style; use the same warning-box treatment the AddWallet backup warning uses. - Warning copy must be a full sentence and must state the risk plainly — anyone with these words can take the funds. - Clear the decrypted phrase from memory/DOM when the view is left. Confirm it does not persist in the nav stack, is not written to state, and cannot be restored by `RESTORABLE_VIEWS` (`src/popup/index.js:104-115`) — a secret screen must never be what the popup reopens onto. - Ensure the phrase can never reach `src/shared/log.js` output. - Register the new view id in `helpers.js` and wire the nav stack so "Back" behaves correctly. - Add the new screen to the README Screen Map. Note that DeleteWallet, ExportPrivKey and SettingsAddToken are all currently missing from that map; adding those is tracked in the docs issue, so here just add your own screen. ## Definition of done - [ ] An HD wallet exposes a "Show recovery phrase" action; key and xprv wallets do not. - [ ] The phrase is revealed only after a correct password; a wrong password shows a full-sentence error and reveals nothing. - [ ] The full phrase is displayed untruncated and is click-to-copy. - [ ] A prominent warning about the consequences of exposure is shown. - [ ] Leaving the view clears the phrase; reopening the popup does not land on this screen. - [ ] The phrase never appears in logs. - [ ] The screen is added to the README Screen Map with its elements and transitions, in the established format. - [ ] The README TODO checkbox at `README.md:880` is ticked. - [ ] `TODO.md` updated in the same commit. - [ ] `make check` passes.

clawbot added this to the 1.0.0 milestone 2026-08-09 03:45:38 +02:00