harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351) #397

Merged

clawbot merged 1 commits from issue-351-strip-debug-mnemonic into next

2026-09-21 18:29:39 +02:00

Author	SHA1	Message	Date
sneak	84be04d6e9	harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351 ) check / check (push) Failing after 1s Details e2e / e2e-chrome (push) Failing after 1s Details e2e / e2e-firefox (push) Failing after 1s Details The 12-word BIP-39 test phrase survived in every release bundle as dead text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only use of it folds away in a release build, so it could not be tree-shaken. Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold it to null, so no distributed bundle carries it. script/verify-build now fails a release build if the phrase appears in any emitted file, so the fold cannot silently regress; test-verify-build covers both the release failure and the debug allowance. tests/extensionId.test.js now scans the content of every tracked file for a PEM private-key header instead of matching filename extensions alone, so a key committed under an unexpected name is caught. Model: opus-4-8	2026-09-21 07:55:39 +00:00

Author

SHA1

Message

Date

sneak

84be04d6e9

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351 )

check / check (push) Failing after 1s

Details

e2e / e2e-chrome (push) Failing after 1s

Details

e2e / e2e-firefox (push) Failing after 1s

Details

The 12-word BIP-39 test phrase survived in every release bundle as dead
text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only
use of it folds away in a release build, so it could not be tree-shaken.
Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold
it to null, so no distributed bundle carries it. script/verify-build now
fails a release build if the phrase appears in any emitted file, so the fold
cannot silently regress; test-verify-build covers both the release failure
and the debug allowance.

tests/extensionId.test.js now scans the content of every tracked file for a
PEM private-key header instead of matching filename extensions alone, so a
key committed under an unexpected name is caught.

Model: opus-4-8

2026-09-21 07:55:39 +00:00