.gitea/workflows/e2e.yml

@@ -22,11 +22,10 @@ on: [push]
 # These jobs REPORT, they do not gate. Whether a check blocks a merge is
 # Gitea branch protection, which this repo does not configure, so a failure
 # here is a red mark a reviewer has to account for rather than a hard
-# block. Making e2e-chrome a required check is blocked on the measured
+# block. Making e2e-chrome a required check is blocked while reports of the
-# flake in the dApp signing wait -- two of six runs of unmutated code on a
+# Chrome suite failing under load are still open; the "In CI" section of
-# loaded machine -- tracked as
+# README.md names them. A gate that fails at random teaches people to merge
-# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
+# past red.
-# random teaches people to merge past red.
 #
 # Nothing here may pass vacuously. There is no continue-on-error and no
 # `|| true`. Both scripts exit non-zero when docker is missing, when the

README.md

@@ -619,13 +619,14 @@ The jobs **report, they do not gate.** A failure is a red mark against the
 commit that a reviewer has to account for, not a hard block: whether a check
 blocks a merge is Gitea branch protection, which this repo does not configure.
 
-That is not only a statement about configuration. The Chrome suite is
+That is not only a statement about configuration. Reports of the Chrome suite
-**measurably flaky under load** — two of six runs of unmutated code on a busy
+**failing under load** are still open, among them
-machine lost the approval popup out from under the dApp signing wait, always in
+[#290](https://git.eeqj.de/sneak/AutistMask/issues/290), runs on a busy machine
-the `#183` section, tracked as
+failing with `the extension opened no approval window within 30000ms`, and
-[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
+[#446](https://git.eeqj.de/sneak/AutistMask/issues/446), the Settings round trip
-has to be read before it is believed, and that flake is the blocker to ever
+closing the popup before its network switch is saved. So a red `e2e-chrome` has
-making this a required check. Do not answer it with a retry wrapper: a suite
+to be read before it is believed, and those failures are the blocker to ever
+making this a required check. Do not answer them with a retry wrapper: a suite
 that reruns until it is green stops being evidence.
 
 Nothing in either job can pass vacuously. There is no `continue-on-error` and no

TODO.md

@@ -45,6 +45,21 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-05: The extension no longer opens a window for a site-connection
+  prompt already answered
+  ([#287](https://git.eeqj.de/sneak/AutistMask/issues/287)). When the prompt was
+  decided before the toolbar popup raised for it had loaded, that popup was torn
+  down, `chrome.action.openPopup()` rejected, and the background opened its
+  fallback window for the answered approval and then removed it. In the Chrome
+  end-to-end suite the next test could take that window for its own prompt and
+  lose it under its wait. `openApprovalWindow()` now opens nothing for an
+  approval that is no longer pending. The blocklist test's Reject, whose window
+  closes itself, is clicked as the other site Reject is, with the click
+  witnessed. Making `e2e-chrome` a required check is still blocked: other
+  reports of the Chrome suite failing under load are open, among them
+  [#290](https://git.eeqj.de/sneak/AutistMask/issues/290) and
+  [#446](https://git.eeqj.de/sneak/AutistMask/issues/446), as `README.md` says.
+
 - 2026-10-05: The lost-password delete confirmation refuses an empty field and
   ignores characters that paint nothing
   ([#336](https://git.eeqj.de/sneak/AutistMask/issues/336)). A wallet named only

src/background/index.js

@@ -413,7 +413,7 @@ function releaseApproval(approval) {
     }
 }
 
-// Open approval in a separate popup window.
+// Open approval in a separate popup window, unless it is no longer pending.
 // This is the primary mechanism for tx/sign approvals (triggered programmatically,
 // not from a user gesture) and the fallback for site-connection approvals.
 // Never rejects. Its callers raise it from inside a Promise executor and drop
@@ -446,6 +446,10 @@ async function openApprovalWindow(id) {
         );
     }
 
+    // Already answered: a site-connection prompt decided before the toolbar
+    // popup raised for it had loaded, whose openPopup() rejects only now.
+    if (!pendingApprovals[id]) return;
+
     let win = null;
     try {
         win = await windowsCreate(opts);

tests/backgroundApproval.test.js

@@ -2235,6 +2235,27 @@ describe("a site connection decided as the popup closes", () => {
         });
     });
 
+    // The prompt is decided before the toolbar popup raised for it has
+    // loaded; that popup is torn down and openPopup() rejects only after.
+    test("a toolbar prompt already decided opens no window when openPopup() rejects", async () => {
+        const bg = loadBackground({ actionPopup: true });
+        const opening = deferred();
+        bg.openPopup.mockImplementation(() => opening.promise);
+        const pending = bg.requestSite();
+        await settle();
+
+        const port = bg.connectApproval(pending.id());
+        port.decide(true, false);
+        port.disconnect();
+        await settle();
+        expect(pending.result()).toEqual({ result: [signer.address] });
+
+        opening.reject(new Error("the toolbar popup closed before it loaded"));
+        await settle();
+
+        expect(bg.created).toHaveLength(0);
+    });
+
     // The port carries a decision now, so it carries the sender check the
     // one-off message used to carry. A content script that guessed an
     // approval id must not be able to connect the site it is running on.

tests/e2e/run.js

@@ -2738,7 +2738,7 @@ async function closeApprovalPages(ctx) {
 //   #btn-reject on the site prompt — NOT self-proving. A page that went away
 //     without the click landing disconnects the approval port, the background
 //     settles that as 4001, and 4001 is exactly what assertUserRejection
-//     accepts. That call site arms the click trace below and asserts it.
+//     accepts. Both call sites arm the click trace below and assert it.
 //
 // A button that is missing or unclickable raises a different error, which is
 // rethrown.
@@ -3124,7 +3124,9 @@ test("a connect request from a blocklisted site is flagged (#219)", async (env)
             // Not remembered: a remembered decision for this origin would
             // outlive the test.
             await popup.uncheck("#approve-remember");
-            await popup.click("#btn-reject");
+            await armClickTrace(env, popup, "#btn-reject");
+            await clickAndClose(popup, "#btn-reject");
+            await assertClickLanded(env, "#btn-reject");
 
             await assertUserRejection(
                 phishingDapp,