clawbot 49a7da87e8 harden: list and end site connections made without Remember in Settings (closes #406) ...

A site allowed without "Remember" lives only in the background's
in-memory connectedSites map. Settings never listed it, and
AUTISTMASK_REMOVE_SITE, sent on every remove, did nothing, so the user
could not end such a connection.

Settings now asks the background for those sites and lists them under
Connected Sites. Removing a site from Allowed Sites or Connected Sites
drops its remembered entry under every address and sends
AUTISTMASK_REMOVE_SITE with the hostname; the background deletes every
matching connectedSites entry and sends accountsChanged with an empty
list to the site's tabs. Only the extension's own pages may send either
message.

Model: opus-5-5

2026-10-04 06:41:39 +02:00

..

e2e

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-10-03 16:26:39 +02:00

support

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

addressValue.test.js

fix: an address holding only unpriced tokens is no longer totalled at $0.00 (closes #261)

2026-08-17 08:38:10 +02:00

addWalletSeparatePassword.test.js

fix: say a second wallet's password is separate when one is chosen (closes #374)

2026-09-21 21:11:09 +02:00

alarms.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

approvalAmount.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

approvalDisplayFloor.test.js

fix: never render a nonzero approval amount as zero (closes #322)

2026-08-23 15:43:04 +02:00

approvalTx.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

approvalVerify.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

backgroundApproval.test.js

harden: list and end site connections made without Remember in Settings (closes #406)

2026-10-04 06:41:39 +02:00

backgroundStateIsolation.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backgroundStateLintRule.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backNavigation.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

balanceLineEscaping.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

buildForbiddenInputs.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

chainSwitchGate.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

coldWorkerChainId.test.js

fix: answer eth_chainId and net_version from loaded state (closes #317)

2026-08-20 13:11:48 +02:00

coldWorkerChainSwitch.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

coldWorkerSendTransaction.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

confirmTxFeeBound.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

constants.test.js

build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

2026-08-10 16:15:22 +02:00

debugBanner.test.js

chore: keep the internal view id out of the release banner (closes #375)

2026-09-22 00:45:06 +02:00

deleteAddress.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

deleteWalletLostPassword.test.js

harden: end a site's unremembered connection when its address or wallet is removed (closes #245)

2026-10-04 04:58:38 +02:00

dustThreshold.test.js

fix: explain a rejected dust threshold instead of silently snapping back (closes #233)

2026-08-12 11:29:09 +02:00

etherscanLabels.test.js

feat: expand confirm-tx warnings — closes #114 (#118)

2026-03-01 19:34:54 +01:00

exportPrivkey.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

extensionId.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

fabricatedDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

holders.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

htmlEscape.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

inpageErrors.test.js

fix: carry EIP-1193 error codes through to the page (closes #274)

2026-08-12 13:47:33 +02:00

inpageProviderUuid.test.js

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-10-03 16:26:39 +02:00

manifest.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

networkEndpoints.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

packaging.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

passwordMessages.test.js

fix: one wording for an empty password field on every screen (closes #265)

2026-08-17 08:59:59 +02:00

persistedEntryFloors.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

persistedFieldContract.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

phishingDomains.test.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

popupElementIds.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

resolveTokenSymbol.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

sendTokenSelect.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

settingsUtcTimestamps.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

showPhrase.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

state.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateMerge.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

stateRecovery.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

stateSchema.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateUnusableRpc.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

symbolSpoof.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transactions.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transferAmount.test.js

fix: sign the ERC-20 amount the confirmation screen displayed (closes #305)

2026-08-20 12:31:28 +02:00

txStatus.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

txValidation.test.js

fix: count the network fee in the confirm-screen balance check (closes #154)

2026-08-11 15:41:37 +02:00

typedDataPermit.test.js

harden: warn for token-permission typed data and show the primary type ethers signs (closes #400)

2026-10-04 02:24:50 +02:00

uniswap.test.js

harden: gate swap amounts on presence, not truthiness, so a figure always matches its token (closes #359)

2026-08-23 20:45:58 +02:00

uniswapTokenOut.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

uniswapUndeterminedTokenIn.test.js

harden: state an undetermined swap input token as undetermined, not as ETH (closes #357)

2026-08-23 20:23:05 +02:00

uniswapUndeterminedTokenOut.test.js

harden: state an undetermined V4 output token as undetermined, not as ETH (closes #353)

2026-08-23 18:13:20 +02:00

uniswapUnknownDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

unknownScaleDisplay.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

unknownScaleSend.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

vault.test.js

test: known-answer coverage for HD derivation and the vault (closes #159)

2026-08-11 15:06:35 +02:00

vaultBackend.test.js

fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00

version.test.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00

wallet.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

walletDefects.test.js

fix: explain a stored non-master xprv wallet instead of throwing at signing time (closes #234)

2026-08-12 10:41:49 +02:00

walletDelete.test.js

feat: remove an address from an HD wallet, behind a confirmation (closes #162)

2026-08-12 11:16:29 +02:00