sneak 60d2b24cd1 security: announce a fresh EIP-6963 provider UUID per page load (closes #398) ...

The provider UUID was generated once, stored in extension storage, and
announced verbatim to every page on every load and across restarts, so any
site — connected or not — could read a stable cross-site, cross-session
identifier for the install: a supercookie contradicting the "no tracking"
promise. EIP-6963 wants a fresh UUIDv4 per announcement instead.

inpage.js now announces a per-load crypto.randomUUID() and persists nothing;
the eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script
message are removed. That key was a standalone top-level storage entry, never
part of the versioned autistmask profile, so stateSchema.js and the
persisted-field harness are untouched and no existing profile is affected.

A jest test asserts two loads announce different UUIDv4s and that one load
reuses a single UUID across re-announcements.

Model: opus-4-8

2026-09-21 23:35:57 +00:00

..

firefox

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-09-21 23:35:57 +00:00

Dockerfile

build: run the browser e2e suites in CI (closes #259)

2026-08-17 08:52:26 +02:00

harness.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

network.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

run.js

fix: give every address a row of its own, so none wraps or is shortened (closes #380) (#381)

2026-08-30 05:25:00 +02:00

storagePartition.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00