# Workflow

- `git pull` `next` and cut a branch from it — one branch per issue, named
  `issue-<N>-<slug>`. Never branch from `main`.
- Do the work as one commit whose title ends with ` (closes #N)`, with the
  `TODO.md` update in that same commit.
- Move Next Step to the top of Completed Steps; move the top item of Future
  Steps into Next Step.
- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
  `main` may not.
- Rebase onto current `next` immediately before pushing — other branches land on
  `next` continuously — and re-run `make check` after resolving, because a clean
  textual merge can still break the build.
- Push the branch and open one PR per issue with base `next`. Never base `main`.
- An independent reviewer who did not write the change gates the merge. On a
  passed review the PR is squash-merged into `next`.
- `next` is the branch for the next milestone. It is kept green and mergeable to
  `main` at any moment, without notice.
- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
  from `main`.

# Status

pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
milestone is in flight on `next`; its `next` -> `main` PR is
[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
`dist/chrome/` and `dist/firefox/`, verified against the build's own receipt to
be exactly what that build emitted with `DEBUG` compiled off.

The backlog lives on the
[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
authoritative; this file does not duplicate it. Full policy file set present.
Real-browser end-to-end suites (`make test-e2e` for Chrome,
`make test-e2e-firefox` for Firefox) sit alongside `make check`, which now does
static analysis as well as formatting, and `.gitea/workflows/e2e.yml` runs both
of them on every push.

# Next Step

Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
input validation) before any 1.0rc tag. Individual filed issues are parts of it,
but the review is broader than any of them.

# Completed Steps

- 2026-08-20: `make build` can no longer hand back a debug build, and
  `script/verify-build` can no longer be satisfied by bytes the build did not
  produce ([#309](https://git.eeqj.de/sneak/AutistMask/issues/309)). The
  verifier used to compute its expectation from `AUTISTMASK_DEBUG` in its own
  environment, so an operator with that exported who ran the release target got
  a debug bundle — every wallet it creates carrying the publicly committed test
  phrase — certified green at exit 0. The expected mode is now the required
  argument `--expect release|debug`, with no default and nothing read from the
  environment, and the `Makefile` scrubs the flag from the verifier while
  deliberately leaving it reaching the compiler, so that shell fails the build
  loudly instead of quietly getting something other than what it asked for.
  Provenance was the other half: the check was a marker grep over a file list
  read back out of `dist/`, so a 26-byte file containing only
  `autistmask-build-debug=off` verified `ok`, `manifest.json` and the content
  script that runs on every page were never read at all, and an entire
  hand-written `dist/` passed. `build.js` now records every file it emits, with
  its sha256 and whether it is one of the bundles containing `constants.js`,
  into a receipt whose path the `Makefile` makes fresh per invocation outside
  the repo and deletes afterwards; `dist/constants-bundles.txt` is gone, and
  `dist/` is cleared before a build so it holds only what that build wrote. The
  standalone `make verify-build` target went with it: re-verifying a `dist/`
  from the `dist/` itself is the thing that was broken. What this establishes is
  narrow and stated as such in README.md — `dist/` is byte for byte the output
  of the `build.js` run that just finished — and it is not signing, which is
  [#310](https://git.eeqj.de/sneak/AutistMask/issues/310).
  `script/test-verify-build` grew from 18 cases to 39, including one per
  demonstrated bypass and the `make -n` read-back that proves the recipes pass
  the mode as an argument.
- 2026-08-20: A hostile ERC-20 symbol no longer renders as live HTML in the
  popup ([#307](https://git.eeqj.de/sneak/AutistMask/issues/307)). A token
  symbol is whatever the contract's `symbol()` returns, the block explorer
  passes it through unfiltered, and `balanceLine()` interpolated it into an
  `innerHTML` string — so a token with the 1,000 holders the spam filter asks
  for, airdropped to the victim, could paint a full-viewport cross-origin iframe
  over the wallet's own UI, on the screens where the user types their password.
  `escapeHtml` moved to `src/shared/html.js` as a pure string replace over `&`,
  `<`, `>`, `"` and `'`: the old implementation round-tripped through a detached
  element's `textContent`, which does not escape quotes, and it was already
  being used inside `data-copy="..."`. Every interpolation into an `innerHTML`
  string across `src/popup/views/` was audited, not just the reported one — the
  transaction lists' direction label, the wallet name and ENS name in the Home
  list, the `href` in the explorer link, and the confirmation screen's warning
  line were all unescaped as well. Both manifests now declare
  `default-src 'self'` with `frame-src 'none'`; the four directives that had to
  stay looser than `'self'` are named and justified in the Content Security
  Policy section of README.md, and `tests/manifest.test.js` pins the whole set
  exactly. A display cap of 12 characters bounds the symbol, matching the bound
  `lookupTokenInfo()` already applied on the contract-read path. Not repurposed
  for any of this: `isSpoofedSymbol()`, which answers a different question and
  would have been the wrong control.
- 2026-08-20: A page asking which chain the wallet is on is told the chain the
  user is actually on ([#317](https://git.eeqj.de/sneak/AutistMask/issues/317)).
  `eth_chainId` and `net_version` answered from `currentNetwork()`, which reads
  the module-level `state` singleton that nothing populates at module scope, so
  a service worker revived by the page's own message answered out of
  `DEFAULT_STATE` and reported mainnet `0x1`/`1` to a user on Sepolia — a dApp
  building its interaction for the wrong chain. Both now answer from
  `getState()`, the per-call detached storage read the other read handlers use,
  rather than from the singleton: these two are reachable by any page on every
  provider init, and mutating the shared singleton on that path would detach the
  wallet objects an in-flight `backgroundRefresh()` is mutating. The read side
  of the background was audited with it: the remaining singleton reads are the
  chain switch, the transaction verification path and `backgroundRefresh`, which
  each already load, and everything else answers from storage per call through
  `getState()`. One stale read is left named but unfixed, outside this issue's
  scope: `handleSendTransaction` builds its provider with no network name, so
  `getProvider()` falls back to the same unloaded singleton for ethers' static
  network hint.
- 2026-08-20: The dApp approval screen no longer shows a token transfer it
  cannot scale as `0.0000`
  ([#306](https://git.eeqj.de/sneak/AutistMask/issues/306)). `decodeCalldata`
  read decimals from the 512-entry bundled token list alone and fell back to 18,
  so every token outside it — most of them, including anything the user added by
  contract address — was displayed at the wrong scale: a `transfer` of 5,000
  units of a 6-decimal token read as `0.0000`, and a user who reads zero
  confirms the drain. The new `src/shared/approvalAmount.js` resolves the scale
  from the bundled list, then `state.trackedTokens`, then the decimals the block
  explorer already reported in `addr.tokenBalances`, and refuses one the
  explorer's own entries disagree about. Where no source knows it, the amount
  line is not formatted at all: it shows the base-unit integer and states that
  the scale is unknown, for `approve` as well as `transfer`. An unbounded
  allowance still reads `Unlimited`, which needs no scale.
- 2026-08-20: A web page can no longer switch the wallet's chain, and switching
  no longer destroys the user's endpoints
  ([#308](https://git.eeqj.de/sneak/AutistMask/issues/308)).
  `wallet_switchEthereumChain` was answered for any origin at all, with no
  connection check and no prompt: any page could clear the `[TESTNET]` banner
  under a user who believed they were on Sepolia. It now takes the same
  `allowedSites`/`connectedSites` gate the signing methods take, ahead of the
  same-chain and unsupported-chain answers, and refuses an unconnected origin
  with `4100`. The switch itself also overwrote `state.rpcUrl` and
  `state.blockscoutUrl` with the network defaults, so a user running their own
  node lost that url permanently and silently to a public endpoint that then
  sees every address they hold. Endpoints are now remembered per network in
  `state.networkEndpoints`, snapshotted from the network being left and restored
  for the network being entered; `state.rpcUrl` stays the live value for the
  active network, so no reader changed. A profile written before the map existed
  has its stored pair adopted for the network it was stored under, and loses
  nothing. The handler now loads state before it switches
  ([#316](https://git.eeqj.de/sneak/AutistMask/issues/316)): the service worker
  populates nothing at module scope, so a worker revived by the page's own
  message held `DEFAULT_STATE`, and the switch persisted every field of it —
  wiping every wallet, every site approval and every tracked token from storage
  along with the endpoint.
- 2026-08-20: The wallet's own ERC-20 send signs the amount it displayed
  ([#305](https://git.eeqj.de/sneak/AutistMask/issues/305)). The confirmation
  screen renders from the block explorer's cached decimals; the transfer was
  encoded from `decimals()` read off the contract at signing time, and nothing
  compared the two, so a token whose on-chain scale disagreed — an upgradeable
  or proxy token, a stale explorer entry, a compromised Blockscout — signed an
  amount that was never on screen, off by a power of ten per decimal place of
  disagreement. The scale is now carried forward on the pending transaction from
  the same balance entry the screen's amount, balance and symbol come from, and
  the contract's answer is read at signing time only to be compared with it: a
  disagreement is a refusal naming both numbers, never a preference for either
  (`src/shared/transferAmount.js`, the `confirmTx` counterpart to
  `approvalVerify.js`). The gas estimate encodes from the same carried value and
  no longer reads `decimals()` at all. Nothing in the e2e suite had ever clicked
  `#btn-confirm-send`, which is how this shipped: the popup's own Send →
  ConfirmTx → Sign & Send → WaitTx path now runs end to end to a broadcast, with
  the `transfer()` amount decoded out of the raw signed bytes and asserted
  against what the screen displayed, and a companion case where the contract
  starts answering a different scale after the screen was built and nothing
  reaches the RPC. Reverting only the signing-side comparison turns that second
  case red and leaves the other 53 green.
- 2026-08-17: The Settings screen is driven in a browser, and every element id
  the popup looks up is checked statically. Nothing exercised Settings in the
  e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups
  in the codebase was unverified at runtime. Seven new cases in
  `tests/e2e/run.js` reach Settings, assert the About well and the wallet list
  were actually written, assert the four Token Spam Protection checkboxes are
  real checkboxes defaulted on, and assert the theme and network selectors offer
  the choices `src/shared/networks.js` and `index.html` define. The selectors
  are then driven to `dark` and `sepolia` — neither is the first `<option>`, so
  neither can be read back from the markup with no JavaScript involved — and
  reasserted after a popup reopen before being restored the same way, and one
  spam filter is toggled off and back on across a reopen each way. Those round
  trips run the change handler, `saveState()`, `loadState()` and the
  `init()`/`show()` assignments rather than just looking at the screen. `show()`
  no longer guards its `settings-network` lookup with `if (networkSelect)`: a
  missing element must fail loudly, which is the whole failure mode this unit
  exists to catch. Each group records a coverage key and a final case demands
  the exact set, so a shortened or skipped section reddens the run instead of
  shrinking it. `tests/popupElementIds.test.js` is the general half and runs in
  `make check` with no browser: every literal id reached through `$()`,
  `document.getElementById()`, `showError()`/`hideError()` and `showView()` must
  exist in `src/popup/index.html`, which no id in `index.html` may define twice.
  Demonstrated on four deliberate breaks — a typo'd id (both halves red), a
  handler bound to the wrong but existing element (only the functional e2e case
  red), a typo in a view no browser suite opens (only the static guard red), and
  the deletion of both persisted-value assignments in `settings.js` (only the
  selector round-trip case red)
  ([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
- 2026-08-17: The phishing blocklist is vendored at build time and censored, and
  the runtime fetch is gone
  ([#219](https://git.eeqj.de/sneak/AutistMask/issues/219)).
  `script/vendor-blocklist` fetches upstream at a pinned commit, verifies the
  sha256 of the bytes it was served, and writes
  `src/shared/phishingBlocklist.json` as truncated sha256 digests rather than
  domain names — which is what removes the competitor's name from a list that
  carried it 6,475 times, without dropping a single one of those domains.
  `script/check-censored` runs in `make check` and again against `dist/` at the
  end of every build, each permitted occurrence scoped to the one path allowed
  to carry it; the name now appears only in the vendoring script, which defines
  it once, in the provider-shim identifiers in `src/content/inpage.js`, and in
  one ERC-20's on-chain name in `src/shared/tokenList.js`. Removing the fetch
  retired the delta, the persistence and the 24-hour alarm from
  [#158](https://git.eeqj.de/sneak/AutistMask/issues/158), and retired alarms
  are now cleared rather than left running on existing installs. Two
  consequences, both deliberate: the list no longer self-updates, so it is as
  fresh as the last vendoring run that was released; and re-vendoring from
  current upstream took it from 231,357 stale entries to 105,721 current ones,
  because upstream prunes and the vendored snapshot never did. `dist/` fell from
  18.9 MB to 8.9 MB. The e2e suite now drives the warning end to end from a real
  blocklisted origin, and its service-worker interception canary has a new
  anchor, because the startup fetch it used to watch for no longer exists.
- 2026-08-17: One wording for an empty password field on every screen that asks
  for one. The private key export screen said "Password is required." where the
  other five say "Please enter your password.", the same one-condition-two-
  wordings split that [#172](https://git.eeqj.de/sneak/AutistMask/issues/172)
  closed for a rejected password. Strings only, no behaviour change.
  `tests/passwordMessages.test.js` now pins the empty-field guard per call site
  as well as the decrypt handler, anchored on the `decryptWithPassword` sites so
  the wallet-creation screen — where an empty field means a password being
  chosen, a different condition — stays out of the set. Every error container
  measured at a 360px viewport in the pinned Playwright container: the export
  screen's container holds at 20px with the following section at the same offset
  for the old string, the new string and the empty reserved state
  ([#265](https://git.eeqj.de/sneak/AutistMask/issues/265)).
- 2026-08-17: One shared extension-API module,
  [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
  the tree that names `browser` or `chrome`. Every call site returns a promise;
  `runtime.lastError` is gone. The same commit gives the Firefox suite the four
  dApp round trips — `eth_requestAccounts`, `personal_sign`,
  `eth_sendTransaction` and a closed approval window rejecting with EIP-1193
  4001 — against a page and a JSON-RPC node served from loopback, which survives
  `--network none`. **The premise of
  [#153](https://git.eeqj.de/sneak/AutistMask/issues/153) does not survive that
  harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
  populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
  all four flows pass against the unconverted code. What landed is a uniformity
  and coverage change, not a repair of a broken target. `storageGet()` and
  `storageSet()` **reject** where `storage.local` is absent rather than
  resolving `{}` and a no-op write — they carry the wallet, and defaulting would
  read an existing wallet back as none. The one caller that genuinely degraded,
  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), took
  `storageLocal()` directly and kept its own null check; it stores nothing at
  all as of [#219](https://git.eeqj.de/sneak/AutistMask/issues/219) above.
- 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
  price. Prices exist for the top 25 tokens only, so the priced-only sum was
  printed as the total and an address holding nothing but unpriced ERC-20s was
  shown as worth nothing — directly under "This address holds a balance." on the
  address-removal confirmation. `getAddressValue()` in `src/shared/prices.js`
  now returns `{ usd, partial }`, keeping worth-zero and worth-an-unknown-amount
  apart the way an absent `holders_count` is kept apart from a count of zero,
  and every screen renders it through the one `formatAddressTotal()`: the figure
  when it covers everything, the figure marked `plus unpriced tokens` when it
  covers part, and `Total: unpriced tokens only` when it would cover nothing.
  Home, AddressDetail and the removal confirmation all read it, and
  `getWalletValue()`/`getTotalValue()` carry `partial` up. Covered by
  `tests/addressValue.test.js` — the only-unpriced, genuinely-zero and
  fully-priced cases at the helper and at both call sites that return their
  markup — demonstrated failing first
  ([#261](https://git.eeqj.de/sneak/AutistMask/issues/261)).
- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
  have. The End-to-End Tests section listed the EIP-1193 code being dropped in
  the last hop into the page as a standing limit of the dApp coverage; that
  stopped being true when
  [#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
  touch the README. The paragraph is deleted and the two remaining limits — the
  stubbed RPC and the unobservable toolbar popup — were checked against the
  current `src/content/inpage.js` and `tests/e2e/` and left as they are
  ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
- 2026-08-17: One transaction approval at a time. Populating in the background
  before the window opens is what makes the displayed object the verified
  object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
  concurrently took the same nonce from a node that had seen neither broadcast,
  and the second could then never be sent, because the only way to give it a
  fresh nonce is to populate it again after the user has read the old one off
  the screen. A second request is now refused with EIP-1193 `-32002` while one
  is unanswered — the slot is taken immediately before population, after the
  authorization checks, so no second nonce is allocated, no second window opens,
  and a page the wallet refuses anyway cannot hold the slot against the
  connected site. The slot is freed at `settleApproval()`, the single point an
  approval is retired, so every path that ends an approval ends the hold with
  it; an approval whose window is gone and whose attempt has failed is settled
  there rather than left waiting on a window that no longer exists, and an
  approval window that could not be opened at all is answered with `-32603`
  instead of holding the page's promise open. Signature approvals are not gated,
  consuming no nonce. A collision that does happen is also reported accurately
  now: a broadcast the node refused for the nonce, and an approval carrying a
  nonce this worker has already broadcast for that address on that chain (caught
  before the node is asked at all), both say the transaction did not reach the
  network and to send it again, instead of warning that it may have sent. The
  record is keyed by chain as well as address, because nonce spaces are per
  chain and low nonces overlap across them. `already known` deliberately keeps
  the ambiguous wording, because a node that says it has the transaction has it
  ([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
- 2026-08-14: The parts of the
  [#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
  [#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
  e2e suite did not cover are asserted. It had only shown that the two screens
  open without throwing. Now: the Add Token round trip leaves the navigation
  stack exactly as it found it, read out of extension storage rather than
  inferred from which screen is up, so an orphaned entry — the second-order
  damage of #150 — is caught where it happens rather than one Back press later;
  a common-token quick-pick puts its contract address in the field; the native
  ETH detail path renders with its own type, value and raw quantity and with the
  token contract row still hidden, against a new `seedNativeTransfer` fixture,
  since the normal-transactions endpoint answered `[]` unconditionally and there
  was no non-ERC-20 row to open; and tapping the token contract address puts it
  on the real clipboard, read back after a sentinel write. Each of the four was
  demonstrated failing against a deliberately broken build
  ([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
- 2026-08-14: `make check` does static analysis. `script/lint` ran
  `prettier --check .`, byte-identical to `script/fmt-check`, so a wallet with
  two shipped used-but-not-imported crashes behind it was green. ESLint is now
  pinned in `package.json` with `@eslint/js` recommended as the base, flat
  config in `eslint.config.js`, `no-undef` and `no-unused-vars` error-level, and
  globals declared per tree — browser for the popup and content scripts, service
  worker for `src/background/` and `src/shared/`, jest for `tests/`, node for
  `build.js`. It found 41 unused bindings and 53 undefined identifiers; all are
  fixed, and dropping a call to an unimported `foo()` into any `src/` file fails
  `make lint`. Linting is also containerized now: `script/lint` builds the
  Dockerfile's new `lint` stage, so the ESLint that decides whether this repo is
  green is the pinned one and not the host's. The lint stage roughly doubles the
  image build, so `script/test`'s hard timeout is now a bound on a hung suite
  rather than a wall-clock budget: 30s on the host, where the suite runs in
  about 8s, and `AUTISTMASK_TEST_TIMEOUT` raises it inside the image, where a
  cold build pays install and contention costs the policy budget never described
  ([#152](https://git.eeqj.de/sneak/AutistMask/issues/152)).
- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
  push, separate from `check`, so `make check` and its 20-second `make test` cap
  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
  gate, the dApp approval round trips — was enforced only when a human
  remembered to run it by hand. The suites could not run on the runner as they
  stood: the runner executes a job in a container against the host's docker
  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
  and the runner image's node cannot install this repo's dependencies. Both
  suites now ship the repo to the daemon as a build context and build the
  extension inside the pinned image, so docker is the only prerequisite on a
  runner or a laptop, and both run the image by ID rather than by tag so
  concurrent clones cannot swap it. The jobs report rather than gate — this repo
  configures no branch protection, and the Chrome suite is measurably flaky
  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
  rather than papered over
  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
- 2026-08-14: A background message handler that throws now rejects the page
  instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
  and `sendResponse` is the only thing that settles the dApp's
  `window.ethereum.request()` promise — so any throw inside `handleRpc` left
  that promise pending forever, with no error and no timeout, indistinguishable
  from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
  internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
  describes "the wallet broke" and none was invented) and logs the method and
  the throw to the background console rather than swallowing them. The two async
  IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
  same shape one level down — every statement inside a `try`, but a throw out of
  a `catch` block escaping unhandled — and each got a last-resort `.catch()`
  settling the approval through `settleApproval()` and answering the popup. The
  transaction one tracks which phase it escaped from and reports that, so an
  escape before `broadcastTransaction()` says the request is gone rather than
  that it may still have reached the network. Every other handler on the path is
  synchronous. All four are driven by real failures — a rejecting storage read,
  and a failure classifier that throws while classifying a genuine verification
  or broadcast failure — and were demonstrated failing first, the RPC one with
  `sendResponse` at zero calls
  ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
- 2026-08-14: Approving a site connection is no longer a race against the popup
  closing. The decision now rides the approval port the popup already holds,
  which is the same channel the close disconnects, so it is delivered ahead of
  that disconnect however fast the teardown is; `windows.onRemoved` no longer
  decides a site approval whose port is connected, since that event is ordered
  against nothing either. Rejecting and closing without deciding both still
  report a rejection, and the popup delays its own close by nothing. The e2e
  harness's deferred-`window.close()` accommodation is gone with it, so the two
  site-prompt tests now drive the shipped decide-then-close in a real Chromium;
  against the unfixed code the approval came back to the page as
  `{"settled":"rejected","code":4001}`
  ([#275](https://git.eeqj.de/sneak/AutistMask/issues/275)).
- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
  rebuilt every failure as `new Error(error.message)`, so the code the
  background produced and the content script relayed intact was dropped in the
  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
  the user deliberately declined was indistinguishable from one that broke. The
  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
  boundary sent one, `data`, passed through verbatim rather than matched against
  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
  here. An error the background sent with no code stays a plain `Error` with no
  `code` property, and `message` is unchanged in every case. All four request
  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
  now requires it on the page's Error as well as on the wire, for all four
  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
  it. A reopened popup renders the wallet list and the one screen it restores
  onto, so every screen further down the stack was still the blank template from
  `index.html`, and Back walked straight onto it — an empty address, no
  balances, no QR code. The Back path now goes through the same per-view
  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
  with `restoreView()`), falling back to Home when the state the target would
  render is gone. It renders only a view this page load has not rendered yet:
  `viewRouter.js` records every view that reaches `showView()`, which is where
  forward navigation and the restore both end, so Back onto a view already on
  the page unhides it and nothing more. That is what keeps a second render from
  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
  a transaction list already loaded. Home is the exception and is always
  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
  and by three end-to-end cases against the real popup, each demonstrated
  failing on the unfixed build
  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
  that bear it, not to one of them. A ticker is not unique: seven of the 512
  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
  share a symbol with another bundled entry at a different real contract, and
  the table, built from the list first-wins, kept only the earlier one. The
  other seven were judged spoofs of their own symbol at their own address and
  hidden from the balance list, the history and the send selector, so a holder
  could not spend them. Both contracts of each pair come from the same CoinGecko
  fetch of 2026-02-27, so neither was stale and neither was dropped.
  `isSpoofedSymbol()` asks set membership instead of equality, which does not
  loosen the rule — a contract outside the set is still a spoof — and a test now
  walks `TOKENS` asserting no bundled token is filtered at its own address,
  which is the walk the suite lacked
  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
- 2026-08-12: The dApp approval round trips are driven end to end in the
  browser. A test page served by the harness speaks EIP-1193 to the real inpage
  provider through the real content script, background worker and approval popup
  for `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
  `eth_sendTransaction`. Every signature is recovered and compared against the
  active address, the transaction is checked against the bytes handed to the
  stubbed RPC, each rejection must reach the page as a rejection, and the
  password must appear in no message the approval window sends — the assertion
  that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
  floor. This does not discharge a real dApp with real funds against mainnet
  ([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
  sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
  character that paints nothing removed (the format and default-ignorable
  characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
  zero-width space, a Hangul filler, a variation selector, a DELETE and a
  fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
  send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
  bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
  in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
  knowingly open and are asserted as open in the suite. No bundled symbol
  contains whitespace or a non-ASCII character, so nothing legitimate is newly
  filtered; the balance list's token-type gate also became case-insensitive,
  which no longer drops a real holding if an explorer writes `erc-20`
  ([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
- 2026-08-12: A containerized Firefox end-to-end harness
  (`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
  build installed as a temporary add-on. Zero npm dependencies — a WebDriver
  client over `fetch` against geckodriver — with `node`, Firefox 153.0.3 and
  geckodriver 0.36.0 all pinned by digest. Uncaught errors are read from the
  privileged console service in Marionette's chrome context, because BiDi
  `log.entryAdded` reports nothing at all for extension pages; each drain reads
  and clears the console in one chrome round trip, so no error is destroyed
  unread by the drain itself, and errors logged during add-on install and
  background startup are folded into step 1 instead of being cleared. The two
  measured limits are documented rather than claimed away: the console ring
  buffer holds 250 messages (a clean run peaks at 4), and the drained window
  ends ≈1.5s after the last step returns. Demonstrated discriminating by exiting
  1 on a `throw` at the top of `src/background/index.js`, on a build with one
  import removed, on a `setTimeout` throw whose UI assertions all pass, on an
  unhandled `Promise.reject` and on an undefined identifier in `home.js`, and 0
  on the branch as it stands
  ([#184](https://git.eeqj.de/sneak/AutistMask/issues/184)).
- 2026-08-12: The transaction a dApp asks for is now populated in the background
  before the approval window opens, so the object the user is shown is the
  object the signed artifact is verified against — nonce, gas limit and every
  fee field are compared exactly instead of being left to the ceilings, which
  stay as a backstop against what a lying RPC node can talk the wallet into
  displaying. The approval also pins the address it was raised for, so an
  address switch between approval and signing refuses rather than signing from
  an account the screen never named, and a request naming an address that is not
  the active one is refused outright. The approval screen now shows the fee, gas
  limit, network and nonce it vouches for
  ([#216](https://git.eeqj.de/sneak/AutistMask/issues/216)).
- 2026-08-12: The restored navigation stack is filtered against
  `RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
  render so that every surviving entry keeps the Back target it had. Back after
  reopening can no longer land on a view the popup declined to restore, such as
  `export-privkey` or `show-phrase`
  ([#224](https://git.eeqj.de/sneak/AutistMask/issues/224)). Restorable views in
  the stack are still unhidden without being re-rendered; that is tracked
  separately in ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
- 2026-08-12: One wording for a rejected password on every screen that asks for
  one — the send confirmation and the delete-wallet confirmation no longer say
  "Wrong password." (a fragment, which `RULES.md` Language & Labeling forbids)
  and the two reveal screens no longer say "not correct", so all five
  `decryptWithPassword` call sites now show the sentence the dApp approval paths
  introduced. Strings only, no behaviour change, and each error container
  measured at a 360px viewport in the pinned Playwright container
  ([#172](https://git.eeqj.de/sneak/AutistMask/issues/172)).
- 2026-08-12: Closed the empty-array hole in the end-to-end unstubbed-request
  guard. `batch.every()` is vacuously true on `[]`, so a POST with body `[]` was
  answered `200 []` instead of failing the suite; the guard now rejects an empty
  batch, demonstrated green-before/red-after with a throwaway probe. The comment
  claiming `postData()` returns `null` for undecodable bodies was corrected to
  the two real paths — an absent or empty body decodes to `null`, a binary body
  decodes lossily into invalid JSON
  ([#187](https://git.eeqj.de/sneak/AutistMask/issues/187)).
- 2026-08-12: The transaction confirmation screen has browser coverage. The
  end-to-end suite reaches ConfirmTx for both the native ETH and the ERC-20 path
  off a funded-balance fixture, and asserts the pending, funded, over-balance
  and estimate-failed states, the fee block quoting the estimate and the reserve
  separately, and a constant view height across every one of those transitions.
  The load-bearing assertion is that the spend gate reads the reserve and not
  the displayed estimate: swapping the two fails the suite
  ([#238](https://git.eeqj.de/sneak/AutistMask/issues/238)).
- 2026-08-12: The dust threshold field now explains a rejection instead of
  snapping back in silence, with the parse in a pure, unit-tested module that
  accepts plain decimal digits only — hex and exponent notation are refused
  rather than read as 16 and 1000
  ([#233](https://git.eeqj.de/sneak/AutistMask/issues/233)).
- 2026-08-12: Approval verification became an allowlist — transaction type
  restricted to 0/1/2 so an EIP-7702 delegation can no longer ride along on an
  approved transfer, every consequential field compared, the artifact
  re-serialized from the checked fields alone and its exact bytes required to be
  the canonical encoding of what was broadcast. One approval now yields at most
  one broadcast, and every path that retires a pending approval — popup close,
  active-address change, a late reject — goes through a single chokepoint that
  refuses to settle an attempt already claimed for signing and broadcast
  ([#174](https://git.eeqj.de/sneak/AutistMask/issues/174)).
- 2026-08-12: An address can be removed from an HD or xprv wallet behind a
  confirmation screen that states nothing is destroyed, sharing the deletion
  state transitions with wallet deletion so the selection, site permissions and
  active-address broadcast follow the same rules
  ([#162](https://git.eeqj.de/sneak/AutistMask/issues/162)).
- 2026-08-12: The known-symbol spoof rule moved into `src/shared/symbolSpoof.js`
  and is now the only copy. The balance list had exempted symbols the token list
  maps to `null` — `"ETH"` alone — so a fake ETH ERC-20 was hidden from the
  transaction history and the Send selector but listed as a holding named ETH. A
  symbol with no legitimate contract may now be borne by no contract on any of
  the three surfaces, and the native exemption is "has no contract address", so
  a second null-mapped symbol needs no call-site change. The user's real ETH
  balance is read over RPC and never passes through the rule
  ([#235](https://git.eeqj.de/sneak/AutistMask/issues/235)).
- 2026-08-12: `script/verify-build`'s failure modes are now a committed target,
  `script/test-verify-build`, run by `make check`. It asserts the exit status
  and the message of every case against a fixture tree in a temp dir, and drops
  privileges (proving the runner against a mode-000 file first) for the cases
  that only mean something when file permissions are in force
  ([#227](https://git.eeqj.de/sneak/AutistMask/issues/227)).
- 2026-08-12: WaitTx lifecycle: a receipt and the 60-second timeout can no
  longer both render on one tick, no timer or in-flight lookup outlives its
  wait, a failed receipt lookup no longer counts as a timeout (but six in a row
  end the wait, reported as an unreachable network rather than as a timeout),
  and the wait now resumes after a popup close
  ([#155](https://git.eeqj.de/sneak/AutistMask/issues/155)).
- 2026-08-12: The private key export screen now wipes the key from the page
  whenever it is left by any route, and a decrypt still in flight when the
  screen is left is discarded instead of written; the same `onViewLeave()`
  cleanup was extended to every other screen holding secret material in the DOM
  (AddWallet, ConfirmTx, DeleteWallet, ApproveTx, ApproveSign)
  ([#221](https://git.eeqj.de/sneak/AutistMask/issues/221)).
- 2026-08-12: An xprv wallet already in storage that was imported from a
  non-master key is detected from the depth of its stored `xpub`, explained in
  the wallet list, and blocked from signing, sending and private-key export
  instead of throwing on the send screen
  ([#234](https://git.eeqj.de/sneak/AutistMask/issues/234)).
- 2026-08-12: An unreported `holders_count` is now parsed as `null` rather than
  `0`, so the low-holder rule declines to judge an unknown count instead of
  hiding a legitimate token as spam, in both the transaction history and the
  Send token selector ([#230](https://git.eeqj.de/sneak/AutistMask/issues/230)).
- 2026-08-12: Bundled token list documentation no longer states a count. The
  four "top 250" claims in `README.md` and the "roughly 500" claim in
  `docs/README.md` are replaced with a description of how the list is actually
  selected — a point-in-time CoinGecko snapshot of the highest-market-cap
  Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
  the authoritative set
  ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
  fallback at 20x the Argon2id cost, pinned in both directions by
  `tests/manifest.test.js` and observed in the real popup by the e2e suite
  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
- 2026-08-11: Known-symbol spoof verification became a Settings toggle
  (`hideSpoofedSymbols`), on by default, governing the transaction-history
  filter and the fraud-contract learning it feeds
  ([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)).
- 2026-08-11: `script/verify-build` now walks `dist/` NUL-delimited and asserts
  `dist/` is a real directory, so a path with a trailing space or a newline can
  no longer carry a debug marker past the unlisted-bundle check
  ([#223](https://git.eeqj.de/sneak/AutistMask/issues/223)).
- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
  into Display, next to the theme selector
  ([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
- 2026-08-11: Network fee counted in the confirmation-screen balance check for
  both ETH and ERC-20 sends, reserving what the node actually charges a type-2
  transaction, with the arithmetic in a pure, unit-tested
  `src/shared/txValidation.js`
  ([#154](https://git.eeqj.de/sneak/AutistMask/issues/154)).
- 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of
  falling back to the 100,000 gwei default, and every address comparison in
  `src/shared/transactions.js` goes through one case-normalising helper so a
  checksummed genuine contract is no longer read as a spoof
  ([#179](https://git.eeqj.de/sneak/AutistMask/issues/179)).
- 2026-08-11: Password-gated recovery phrase display for HD wallets, reached
  from the wallet row in Settings, wiped on leaving the screen and excluded from
  the views the popup can reopen onto
  ([#161](https://git.eeqj.de/sneak/AutistMask/issues/161)).
- 2026-08-11: Extended-key import hardened — the base58 checksum is now enforced
  on every xprv and xpub, and a non-master key is refused with an explanation
  instead of being derived beneath
  ([#210](https://git.eeqj.de/sneak/AutistMask/issues/210)).
- 2026-08-11: the balance refresh and the 24-hour phishing list refresh moved
  from `setInterval` to the extension alarms API, with the phishing delta and
  its fetch timestamps persisted to extension storage, so neither job dies with
  the MV3 service worker. Each job's freshness guard was decoupled from its
  alarm period at the same time — timed to the period, a guard vetoes its own
  scheduled tick and halves the real refresh rate
  ([#158](https://git.eeqj.de/sneak/AutistMask/issues/158)).
- 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
  Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
  the Makefile-only targets documented in the README
  ([#166](https://git.eeqj.de/sneak/AutistMask/issues/166)).
- 2026-08-11: `script/verify-build` diagnostics corrected: the both-markers
  message now states what is and is not proven, an unreadable bundle is
  diagnosed as an I/O fault rather than as changed output, the `*.js` assumption
  lives only in `build.js`, and the unlisted-bundle scan hard-fails when it
  cannot enumerate `dist/`
  ([#180](https://git.eeqj.de/sneak/AutistMask/issues/180)).
- 2026-08-11: Known-answer test coverage for the crypto core — BIP-39/BIP-32
  derivation in `wallet.js` and the Argon2id vault in `vault.js`
  ([#159](https://git.eeqj.de/sneak/AutistMask/issues/159)).
- 2026-08-11: Three `README.md` claims corrected against the code — blocklist
  attribution, token-display rule, navigation model
  ([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
- 2026-08-11: README Screen Map rebuilt from the code — every screen, element
  and transition re-verified against `src/popup/`
  ([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).
- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
  all five network destinations documented, password/Settings/Add Wallet
  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
- 2026-08-11: `loadState()` now derives `hasWallet` from the wallet list instead
  of trusting the persisted flag, so a profile already saved inconsistent no
  longer stays broken on every load
  ([#195](https://git.eeqj.de/sneak/AutistMask/issues/195)).
- 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
  remaining wallets, the selection only moves when it was deleted, and the
  active-address change is broadcast to connected sites
  ([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
- 2026-08-11: One row per on-chain value movement in transaction history: the
  merge moved into the pure `mergeTransactions` and the zero-ETH native side of
  a plain ERC-20 transfer absorbed into its token row
  ([#177](https://git.eeqj.de/sneak/AutistMask/issues/177)).
- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
  on `next`, with Status and Next Step refreshed
  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
  as the `__BUILD_DEBUG__` esbuild define and turned on with
  `AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
  created wallet the publicly committed test recovery phrase
  ([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
- 2026-08-09: dApp approval signing moved into the popup — the password no
  longer crosses the extension messaging boundary; the background broadcasts and
  resolves approvals only, and verifies the signed artifact against the approval
  it holds (#157).
- 2026-08-09: Post-build assertion that every emitted bundle containing
  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
  `make build` path (#170).
- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
  `script/test-e2e`) driving the real popup with all network intercepted, plus
  the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
  and TransactionDetail broken for every ERC-20 transfer (#151). Harness
  demonstrated failing before the fixes and passing after (#181). Interception
  covers the MV3 background service worker, not just the popup page, and a
  launch-time canary aborts the suite if worker traffic starts escaping.
- 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
  (#149-#168).
- 2026-08-09: Test coverage for the address-poisoning defense in
  `src/shared/transactions.js` (#160)
- 2026-07-26: About well in settings with build info, repo link and the version
  click easter egg (#145); proper view navigation stack (#146).
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
  shims, README Entrypoints section (#148)
- 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
  in approve-tx view (#141).
- Sepolia testnet support (#137); etherscan links go to token-specific URLs
  (#136).
- Transaction detail improvements: Type field and on-chain details (#130),
  txid-first reordering (#133), swap display corrections (#128), expanded
  confirm-tx warnings (#118).
- Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
  timestamps include timezone offset (#120); layout shift audit, reserved space
  for error messages (#124).
- Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
  duplicate detection (#115).
- 2026-02-27: v0.1.0 tagged.
- 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
  ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
  reverse resolution.

# Future Steps

Only work that has no issue of its own belongs here; everything else is on the
tracker.

- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
  land.