Found by the review of #644, which fixes #641 for every other page.
What happens
Firefox gives extension pages in a private window their own navigator.locks, separate from the background's. A user who allows AutistMask in private windows (Firefox lets them; manifest/firefox.json says nothing about private windows) can open the popup there, and its save can still undo a network switch the background saved during it, as #641 describes. Chrome is not affected as far as checked (its extension pages do not run inside an incognito profile by default); not verified in a browser.
Question
Should AutistMask run in Firefox private windows?
(a) No."incognito": "not_allowed" in manifest/firefox.json: Firefox then never offers to run it there. One line, easy to undo. The wallet cannot be used in a private window.
(b) Yes. A page in a private window hands its save to the background, which does the read, merge and write under its own lock. Keeps private windows working; a moderate change to how pages save.
Recommendation: (a). A wallet gains little from private windows (its records live in extension storage either way), and it closes the gap with one reversible line; (b) can follow later if you want private windows.
Definition of done
No page in a Firefox private window can write the stored record between the background's read and write, by whichever option is chosen.
README says which pages can run in a private window and how their saves are ordered.
Model: opus-5-5
Found by the review of https://git.eeqj.de/sneak/AutistMask/pulls/644, which fixes https://git.eeqj.de/sneak/AutistMask/issues/641 for every other page.
## What happens
Firefox gives extension pages in a private window their own `navigator.locks`, separate from the background's. A user who allows AutistMask in private windows (Firefox lets them; `manifest/firefox.json` says nothing about private windows) can open the popup there, and its save can still undo a network switch the background saved during it, as https://git.eeqj.de/sneak/AutistMask/issues/641 describes. Chrome is not affected as far as checked (its extension pages do not run inside an incognito profile by default); not verified in a browser.
## Question
Should AutistMask run in Firefox private windows?
- **(a) No.** `"incognito": "not_allowed"` in `manifest/firefox.json`: Firefox then never offers to run it there. One line, easy to undo. The wallet cannot be used in a private window.
- **(b) Yes.** A page in a private window hands its save to the background, which does the read, merge and write under its own lock. Keeps private windows working; a moderate change to how pages save.
Recommendation: (a). A wallet gains little from private windows (its records live in extension storage either way), and it closes the gap with one reversible line; (b) can follow later if you want private windows.
## Definition of done
- [ ] No page in a Firefox private window can write the stored record between the background's read and write, by whichever option is chosen.
- [ ] README says which pages can run in a private window and how their saves are ordered.
Model: opus-5-5
sneak
was assigned by clawbot2026-10-20 18:16:25 +02:00
Settled by the standing rule, not sent to sneak: the recommended option (a) is one line and easy to undo, and private-window use is not important for a wallet whose records live in extension storage either way. Build (a): "incognito": "not_allowed" in manifest/firefox.json, and the README line from the definition of done. sneak can reverse it at any time; (b) would follow then.
Model: opus-5-5
Settled by the standing rule, not sent to sneak: the recommended option (a) is one line and easy to undo, and private-window use is not important for a wallet whose records live in extension storage either way. Build (a): `"incognito": "not_allowed"` in `manifest/firefox.json`, and the README line from the definition of done. sneak can reverse it at any time; (b) would follow then.
Model: opus-5-5
sneak
was unassigned by clawbot2026-10-20 19:53:43 +02:00
clawbot
self-assigned this 2026-10-20 19:53:43 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the review of #644, which fixes #641 for every other page.
What happens
Firefox gives extension pages in a private window their own
navigator.locks, separate from the background's. A user who allows AutistMask in private windows (Firefox lets them;manifest/firefox.jsonsays nothing about private windows) can open the popup there, and its save can still undo a network switch the background saved during it, as #641 describes. Chrome is not affected as far as checked (its extension pages do not run inside an incognito profile by default); not verified in a browser.Question
Should AutistMask run in Firefox private windows?
"incognito": "not_allowed"inmanifest/firefox.json: Firefox then never offers to run it there. One line, easy to undo. The wallet cannot be used in a private window.Recommendation: (a). A wallet gains little from private windows (its records live in extension storage either way), and it closes the gap with one reversible line; (b) can follow later if you want private windows.
Definition of done
Model: opus-5-5
Settled by the standing rule, not sent to sneak: the recommended option (a) is one line and easy to undo, and private-window use is not important for a wallet whose records live in extension storage either way. Build (a):
"incognito": "not_allowed"inmanifest/firefox.json, and the README line from the definition of done. sneak can reverse it at any time; (b) would follow then.Model: opus-5-5