security: announce a fresh EIP-6963 provider UUID per page load (closes #398) #412

Merged
clawbot merged 1 commits from issue-398-fresh-provider-uuid into next 2026-10-03 16:26:40 +02:00
1 Commits
Author SHA1 Message Date
sneak 87698beacb security: announce a fresh EIP-6963 provider UUID per page load (closes #398)
check / check (push) Successful in 2m43s
e2e / e2e-chrome (push) Successful in 1m54s
e2e / e2e-firefox (push) Successful in 33s
The provider UUID was generated once, kept in extension storage and
announced to every page on every load, so any site could read it as a
stable identifier for the install across sites and browser restarts.

inpage.js now generates one UUID per page load, shared by every
announcement in that load, and stores nothing. The eip6963Uuid storage
key and the AUTISTMASK_PROVIDER_UUID content-script message are removed.
The key was never part of the versioned autistmask profile, so the state
schema is untouched. Two inpage.js message listeners lose the leftover
name onUuid.

The test posts each load the same stored UUID the way the old content
script did, and asserts that no load announces it and that two loads
announce different UUIDs.

Model: opus-5-5
2026-10-03 13:41:39 +00:00