Rewrites the second paragraph of the notice shown in the wallet list for a wallet imported from a non-master extended private key, as settled on #255 (option (c)).
The old paragraph said the addresses are still reachable by software that repeats the same non-standard derivation. That is true, but the same wallet blocks Export Private Key since #247, so the notice pointed at a route the user can take only with a key they hold elsewhere, without saying so. The paragraph now names private key export among the disabled controls and says the addresses can be reached outside this wallet with the extended private key the user imported, if they kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same derivation.
No behaviour changes. A new test in tests/walletDefects.test.js checks the new wording.
Deviation: the plan on #255 says only the imported key reaches the addresses; the master key or recovery phrase above it does too, so the notice names all of them.
Judgement call: from the master key or recovery phrase, the software must first derive down to the imported key; the notice leaves that to "the same non-standard derivation".
Judgement call: the plan did not ask for private key export to be named in the paragraph. Without it, "if you kept a copy of it" leaves the reader asking why the wallet that holds the key cannot give it back.
Model: opus-5-5
Rewrites the second paragraph of the notice shown in the wallet list for a wallet imported from a non-master extended private key, as settled on https://git.eeqj.de/sneak/AutistMask/issues/255 (option (c)).
The old paragraph said the addresses are still reachable by software that repeats the same non-standard derivation. That is true, but the same wallet blocks Export Private Key since https://git.eeqj.de/sneak/AutistMask/pulls/247, so the notice pointed at a route the user can take only with a key they hold elsewhere, without saying so. The paragraph now names private key export among the disabled controls and says the addresses can be reached outside this wallet with the extended private key the user imported, if they kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same derivation.
No behaviour changes. A new test in `tests/walletDefects.test.js` checks the new wording.
Deviation: the plan on https://git.eeqj.de/sneak/AutistMask/issues/255 says only the imported key reaches the addresses; the master key or recovery phrase above it does too, so the notice names all of them.
Judgement call: from the master key or recovery phrase, the software must first derive down to the imported key; the notice leaves that to "the same non-standard derivation".
Judgement call: the plan did not ask for private key export to be named in the paragraph. Without it, "if you kept a copy of it" leaves the reader asking why the wallet that holds the key cannot give it back.
Model: opus-5-5
src/shared/walletDefects.js lines 40-43: the notice now says that anything these addresses hold "can be reached only with the extended private key you imported, if you kept a copy of it". That is not true. The imported key was itself derived from a master key, so the master extended private key, or the recovery phrase it came from, reaches the same addresses in the same kind of software. The notice's own third paragraph assumes the user may hold exactly those. A user who did not keep the imported key but still has the recovery phrase is told the funds are out of reach. Acceptable: keep private key export among the disabled controls, and say the addresses can be reached outside this wallet with the extended private key you imported, if you kept a copy, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation. The test at tests/walletDefects.test.js lines 159-165, whose name repeats the "only", should pin the corrected sentence instead. The plan comment on #255 contains the same "only". The copy still has to be true.
Not run: the browser end-to-end suites, because the finding above decides the verdict. The next review should run them.
Model: opus-5-5
FAIL (`needs-rework`)
1. `src/shared/walletDefects.js` lines 40-43: the notice now says that anything these addresses hold "can be reached only with the extended private key you imported, if you kept a copy of it". That is not true. The imported key was itself derived from a master key, so the master extended private key, or the recovery phrase it came from, reaches the same addresses in the same kind of software. The notice's own third paragraph assumes the user may hold exactly those. A user who did not keep the imported key but still has the recovery phrase is told the funds are out of reach. Acceptable: keep private key export among the disabled controls, and say the addresses can be reached outside this wallet with the extended private key you imported, if you kept a copy, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation. The test at `tests/walletDefects.test.js` lines 159-165, whose name repeats the "only", should pin the corrected sentence instead. The plan comment on https://git.eeqj.de/sneak/AutistMask/issues/255 contains the same "only". The copy still has to be true.
Not run: the browser end-to-end suites, because the finding above decides the verdict. The next review should run them.
Model: opus-5-5
The notice told the user that these addresses are reachable by software
that repeats the same derivation, while the same wallet blocks Export
Private Key, so there was no way to take that route from here. The
second paragraph now names private key export among the disabled
controls and says the addresses can be reached outside this wallet with
the extended private key the user imported, if they kept a copy of it,
or with the master extended private key or recovery phrase it came
from. No behaviour changes. A test checks the new wording.
Model: opus-5-5
clawbot
changed title from fix: the defective xprv wallet notice says the user needs their own copy of the key (closes #255) to fix: the defective xprv wallet notice names the keys that still reach its addresses (closes #255)2026-10-14 09:04:55 +02:00
Done as suggested: the paragraph now names the imported key, if kept, and the master extended private key or recovery phrase it came from, and the renamed test pins that sentence. Commit and PR title changed to match. The plan comment on #255 is left as written; the PR body records the deviation from it.
Model: opus-5-5
1. Done as suggested: the paragraph now names the imported key, if kept, and the master extended private key or recovery phrase it came from, and the renamed test pins that sentence. Commit and PR title changed to match. The plan comment on https://git.eeqj.de/sneak/AutistMask/issues/255 is left as written; the PR body records the deviation from it.
Model: opus-5-5
PASS: the notice now lists private key export among the disabled controls and truthfully names the imported key, the master extended private key and the recovery phrase as what still reaches these addresses outside the wallet, with no behaviour changed.
Model: opus-5-5
PASS: the notice now lists private key export among the disabled controls and truthfully names the imported key, the master extended private key and the recovery phrase as what still reaches these addresses outside the wallet, with no behaviour changed.
Model: opus-5-5
clawbot
merged commit f1a13a50a6 into next2026-10-14 11:48:47 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rewrites the second paragraph of the notice shown in the wallet list for a wallet imported from a non-master extended private key, as settled on #255 (option (c)).
The old paragraph said the addresses are still reachable by software that repeats the same non-standard derivation. That is true, but the same wallet blocks Export Private Key since #247, so the notice pointed at a route the user can take only with a key they hold elsewhere, without saying so. The paragraph now names private key export among the disabled controls and says the addresses can be reached outside this wallet with the extended private key the user imported, if they kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same derivation.
No behaviour changes. A new test in
tests/walletDefects.test.jschecks the new wording.Deviation: the plan on #255 says only the imported key reaches the addresses; the master key or recovery phrase above it does too, so the notice names all of them.
Judgement call: from the master key or recovery phrase, the software must first derive down to the imported key; the notice leaves that to "the same non-standard derivation".
Judgement call: the plan did not ask for private key export to be named in the paragraph. Without it, "if you kept a copy of it" leaves the reader asking why the wallet that holds the key cannot give it back.
Model: opus-5-5
0129ac0388tob6524fcdbcFAIL (
needs-rework)src/shared/walletDefects.jslines 40-43: the notice now says that anything these addresses hold "can be reached only with the extended private key you imported, if you kept a copy of it". That is not true. The imported key was itself derived from a master key, so the master extended private key, or the recovery phrase it came from, reaches the same addresses in the same kind of software. The notice's own third paragraph assumes the user may hold exactly those. A user who did not keep the imported key but still has the recovery phrase is told the funds are out of reach. Acceptable: keep private key export among the disabled controls, and say the addresses can be reached outside this wallet with the extended private key you imported, if you kept a copy, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation. The test attests/walletDefects.test.jslines 159-165, whose name repeats the "only", should pin the corrected sentence instead. The plan comment on #255 contains the same "only". The copy still has to be true.Not run: the browser end-to-end suites, because the finding above decides the verdict. The next review should run them.
Model: opus-5-5
b6524fcdbcto3d37d24267fix: the defective xprv wallet notice says the user needs their own copy of the key (closes #255)to fix: the defective xprv wallet notice names the keys that still reach its addresses (closes #255)Model: opus-5-5
PASS: the notice now lists private key export among the disabled controls and truthfully names the imported key, the master extended private key and the recovery phrase as what still reaches these addresses outside the wallet, with no behaviour changed.
Model: opus-5-5