The next milestone branch. Everything on next since the 1.0.0 batch (#190) landed, each unit squash-merged after an independent review.
On the branch now:
Every address is shown on a row of its own, so none wraps or is shortened (#380).
A transaction response from the popup is honoured only for a transaction approval, so it can no longer retire a signing or connection approval (#262).
The test recovery phrase no longer ships inside release bundles, make build fails a release build that carries it, and the committed-key test matches private keys by content instead of by filename (#351).
The add-wallet screen says, when the profile already holds a wallet, that each wallet has its own password (#374).
The approval and transaction screens name a token the user tracks or the block explorer knows, instead of Unknown token, and still refuse a name that imitates a bundled or native ticker (#323).
The wallet refuses to sign any transaction whose total network fee exceeds 1 ETH, on the dApp path and on its own send; before, a fee of thousands of ETH passed the per-field limits (#399, from the security review #383). The 1 ETH figure is one constant, MAX_TOTAL_FEE in src/shared/approvalVerify.js.
docs/RELEASE.md describes the release procedure from a green main to tagged, packaged artifacts; the per-browser distribution step is written as pending #386 (#387).
The testnet and debug banners no longer show the internal view id in a release build (#375).
Confirm Delete works for a second wallet delete without reopening the popup (#335).
Nothing here changes storage, the manifests or the extension id; a deploy is make build as before. A debug build still carries the test recovery phrase, by design.
CI on this branch is red in all three jobs for a runner-host reason, not a code one: #396. Each unit here was gated by an independent local make check on the rebased tree.
Merging this to main at any time is fine. The remaining milestone 1.0.0 issues land here one by one and are listed on the milestone; this PR is marked merge-ready and assigned to the owner when the milestone is complete, and the version bump (#384) is the last of them.
Model: fable-5-1
The next milestone branch. Everything on `next` since the 1.0.0 batch (https://git.eeqj.de/sneak/AutistMask/pulls/190) landed, each unit squash-merged after an independent review.
On the branch now:
- Every address is shown on a row of its own, so none wraps or is shortened (https://git.eeqj.de/sneak/AutistMask/issues/380).
- A transaction response from the popup is honoured only for a transaction approval, so it can no longer retire a signing or connection approval (https://git.eeqj.de/sneak/AutistMask/issues/262).
- The test recovery phrase no longer ships inside release bundles, `make build` fails a release build that carries it, and the committed-key test matches private keys by content instead of by filename (https://git.eeqj.de/sneak/AutistMask/issues/351).
- The add-wallet screen says, when the profile already holds a wallet, that each wallet has its own password (https://git.eeqj.de/sneak/AutistMask/issues/374).
- The approval and transaction screens name a token the user tracks or the block explorer knows, instead of `Unknown token`, and still refuse a name that imitates a bundled or native ticker (https://git.eeqj.de/sneak/AutistMask/issues/323).
- The wallet refuses to sign any transaction whose total network fee exceeds 1 ETH, on the dApp path and on its own send; before, a fee of thousands of ETH passed the per-field limits (https://git.eeqj.de/sneak/AutistMask/issues/399, from the security review https://git.eeqj.de/sneak/AutistMask/issues/383). The 1 ETH figure is one constant, `MAX_TOTAL_FEE` in `src/shared/approvalVerify.js`.
- `docs/RELEASE.md` describes the release procedure from a green `main` to tagged, packaged artifacts; the per-browser distribution step is written as pending https://git.eeqj.de/sneak/AutistMask/issues/386 (https://git.eeqj.de/sneak/AutistMask/issues/387).
- The testnet and debug banners no longer show the internal view id in a release build (https://git.eeqj.de/sneak/AutistMask/issues/375).
- Confirm Delete works for a second wallet delete without reopening the popup (https://git.eeqj.de/sneak/AutistMask/issues/335).
Nothing here changes storage, the manifests or the extension id; a deploy is `make build` as before. A debug build still carries the test recovery phrase, by design.
CI on this branch is red in all three jobs for a runner-host reason, not a code one: https://git.eeqj.de/sneak/AutistMask/issues/396. Each unit here was gated by an independent local `make check` on the rebased tree.
Merging this to `main` at any time is fine. The remaining milestone 1.0.0 issues land here one by one and are listed on the milestone; this PR is marked `merge-ready` and assigned to the owner when the milestone is complete, and the version bump (https://git.eeqj.de/sneak/AutistMask/issues/384) is the last of them.
Model: fable-5-1
clawbot
added this to the 1.0.0 milestone 2026-09-21 09:20:06 +02:00
The liveness fix this issue describes — settle 4001 on release when the window
a retry would use is gone — already landed with
#271. This completes the rest.
AUTISTMASK_TX_RESPONSE now refuses any approval that is not a transaction
approval, so a reject can no longer retire a sign or connection approval, and a
signed artifact never runs the broadcast path against one — which before only
failed closed by throwing deeper in. Tests pin the site-connection port's
approve, reject and disconnect paths against a transaction approval broadcasting
behind them: each is declined and the dApp still receives its broadcast result.
Model: opus-4-8
The e2e jobs on next are red since 09:32 for a runner-host reason, not a code one: #396 (assigned to the owner). Units landing here meanwhile are gated by independent local make check runs on the rebased tree.
model: claude-fable-5
The e2e jobs on `next` are red since 09:32 for a runner-host reason, not a code one: https://git.eeqj.de/sneak/AutistMask/issues/396 (assigned to the owner). Units landing here meanwhile are gated by independent local `make check` runs on the rebased tree.
model: claude-fable-5
The 12-word BIP-39 test phrase survived in every release bundle as dead
text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only
use of it folds away in a release build, so it could not be tree-shaken.
Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold
it to null, so no distributed bundle carries it. script/verify-build now
fails a release build if the phrase appears in any emitted file, so the fold
cannot silently regress; test-verify-build covers both the release failure
and the debug allowance.
tests/extensionId.test.js now scans the content of every tracked file for a
PEM private-key header instead of matching filename extensions alone, so a
key committed under an unexpected name is caught.
Model: opus-4-8
The add-wallet screen offered only "Choose a password" while each wallet
keeps its own encrypted secret, so a second wallet silently accepted a
password different from the first with nothing marking it as separate. A
note now appears on that screen when the profile already holds a wallet,
saying each wallet has its own password and this one need not match any
already in use. It is shown only then — the first wallet has no other
password to differ from — and is decided on screen entry, so it does not
move the password fields. It promises no recovery or reset, staying
consistent with the no-password-reset design.
Model: opus-4-8
The approval and transaction-status screens read a token's scale from the
bundled list, the tokens the user tracks, then the block explorer, but read
its symbol from the bundled list alone. A token the user added by hand was
scaled correctly yet labelled "Unknown token", and a non-bundled ERC-20 was
carried onto the wait screen as ETH.
resolveTokenSymbol() now draws the symbol through the same sources and
precedence as the scale, and the ERC-20 and Uniswap swap lines both use it. A
tracked or explorer-reported name stays subject to the spoof rule, so it
cannot claim a bundled or native ticker.
Folds in #354.
Model: opus-4-8
Co-authored-by: clawbot <clawbot@noreply.example.org>
The two per-field ceilings in approvalVerify.js were checked independently,
but the fee a validator is paid is gasLimit × fee per gas: a gas limit and a
fee each under their own ceiling still multiply to thousands of ETH, which a
gas-consuming contract really collects. assertWithinCeilings now also bounds
that product against MAX_TOTAL_FEE (1 ETH), so both callers — populating the
dApp transaction and verifying the signed artifact — refuse it with a full
sentence naming the fee and the limit.
The wallet's own send in confirmTx.js pinned no fee fields, so ethers filled
them from the node with no bound; it now populates the transaction and runs the
same check before signing, showing the same error in the confirmation screen's
reserved errors box so nothing on screen moves.
Model: opus-4-8
Add docs/RELEASE.md, linked from README.md's Release Artifacts section, giving
the release procedure as a numbered list: confirm main is green in CI, confirm
the one version in package.json and the two manifests matches the intended tag,
make package from a clean checkout, verify SHA256SUMS, create the annotated tag
vX.Y.Z, then distribute per browser. Each step names who performs it, marks the
owner-only ones, and states the check that it worked. Every repo command cited
(make setup, make check, make package) exists on next; tagging and verification
use standard git and coreutils, and the CRX pack line is README's own.
The per-browser distribution step is written as pending the owner's choice on
issue 386, with the Firefox and Chrome options named but none presented as
settled. Docs only: no code or test changes.
Model: opus-4-8
The debug/testnet banner appended the active view's internal id, so the
user saw text like "[TESTNET] (approve-tx)" — developer vocabulary, and on
the approval screen it sat directly above the carefully worded line stating
what is being authorized. The view id is now gated on the compile-time
DEBUG constant instead of isDebug(), so it survives only in a debug build.
A testnet or the runtime debug toggle still raises the banner, but without
the view id, which is what a release build shows.
Model: opus-4-8
The password route disabled its Confirm Delete button before the decrypt
and never re-enabled it on success, so a second delete in the same popup
session found a dead button until the popup was closed and reopened. The
lost-password route re-enabled its own button in its leave hook, so the
two screens on the one screen behaved differently.
Both routes now reset the button through the shared finishDelete(), the
one path they both take, and the lost-password leave hook no longer
handles it separately. Tests drive a password-route delete and a second
delete in the same session; they fail against the prior head, where the
button stays disabled after the first delete.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The next milestone branch. Everything on
nextsince the 1.0.0 batch (#190) landed, each unit squash-merged after an independent review.On the branch now:
make buildfails a release build that carries it, and the committed-key test matches private keys by content instead of by filename (#351).Unknown token, and still refuse a name that imitates a bundled or native ticker (#323).MAX_TOTAL_FEEinsrc/shared/approvalVerify.js.docs/RELEASE.mddescribes the release procedure from a greenmainto tagged, packaged artifacts; the per-browser distribution step is written as pending #386 (#387).Nothing here changes storage, the manifests or the extension id; a deploy is
make buildas before. A debug build still carries the test recovery phrase, by design.CI on this branch is red in all three jobs for a runner-host reason, not a code one: #396. Each unit here was gated by an independent local
make checkon the rebased tree.Merging this to
mainat any time is fine. The remaining milestone 1.0.0 issues land here one by one and are listed on the milestone; this PR is markedmerge-readyand assigned to the owner when the milestone is complete, and the version bump (#384) is the last of them.Model: fable-5-1
The e2e jobs on
nextare red since 09:32 for a runner-host reason, not a code one: #396 (assigned to the owner). Units landing here meanwhile are gated by independent localmake checkruns on the rebased tree.model: claude-fable-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.