clawbot
a08ba6a66d
Some checks failed
check / check (push) Has been cancelled
The persisted view stack was restored verbatim. RESTORABLE_VIEWS stopped the popup opening ONTO a view it will not re-render, but nothing kept such a view out of the stack, so Back could land on a screen whose content was deliberately never restored. No secret leaks -- those views are blank precisely because nothing is restored into them; this is a navigation defect. loadState() now truncates the stored stack at the first entry outside RESTORABLE_VIEWS, dropping it and everything above it. Truncating rather than splicing keeps the result a prefix of what was stored, so every surviving entry keeps the Back target it had; splicing would silently re-point the entry above the hole at a different screen. Filtering on load rather than on save is what makes it retroactive for stacks already in storage, and leaves the live in-session stack whole, which it should be. The general case where Back lands on a blank screen even for restorable views, because goBack() re-renders nothing, is separate and tracked at #268.
277 lines
17 KiB
Markdown
277 lines
17 KiB
Markdown
# Workflow
|
|
|
|
- `git pull` `next` and cut a branch from it — one branch per issue, named
|
|
`issue-<N>-<slug>`. Never branch from `main`.
|
|
- Do the work as one commit whose title ends with ` (closes #N)`, with the
|
|
`TODO.md` update in that same commit.
|
|
- Move Next Step to the top of Completed Steps; move the top item of Future
|
|
Steps into Next Step.
|
|
- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
|
|
`main` may not.
|
|
- Rebase onto current `next` immediately before pushing — other branches land on
|
|
`next` continuously — and re-run `make check` after resolving, because a clean
|
|
textual merge can still break the build.
|
|
- Push the branch and open one PR per issue with base `next`. Never base `main`.
|
|
- An independent reviewer who did not write the change gates the merge. On a
|
|
passed review the PR is squash-merged into `next`.
|
|
- `next` is the branch for the next milestone. It is kept green and mergeable to
|
|
`main` at any moment, without notice.
|
|
- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
|
|
from `main`.
|
|
|
|
# Status
|
|
|
|
pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
|
|
milestone is in flight on `next`; its `next` -> `main` PR is
|
|
[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
|
|
green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
|
|
`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
|
|
compiled off.
|
|
|
|
The backlog lives on the
|
|
[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
|
|
authoritative; this file does not duplicate it. Full policy file set present. A
|
|
real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
|
|
which cannot see a runtime `ReferenceError` in a popup view.
|
|
|
|
# Next Step
|
|
|
|
Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
|
|
`script/lint`. `make check` is `prettier --check` only today and cannot catch
|
|
undefined identifiers, which is how
|
|
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
|
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-12: The restored navigation stack is filtered against
|
|
`RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
|
|
render so that every surviving entry keeps the Back target it had. Back after
|
|
reopening can no longer land on a view the popup declined to restore, such as
|
|
`export-privkey` or `show-phrase`
|
|
([#224](https://git.eeqj.de/sneak/AutistMask/issues/224)). Restorable views in
|
|
the stack are still unhidden without being re-rendered; that is tracked
|
|
separately in ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
|
- 2026-08-12: One wording for a rejected password on every screen that asks for
|
|
one — the send confirmation and the delete-wallet confirmation no longer say
|
|
"Wrong password." (a fragment, which `RULES.md` Language & Labeling forbids)
|
|
and the two reveal screens no longer say "not correct", so all five
|
|
`decryptWithPassword` call sites now show the sentence the dApp approval paths
|
|
introduced. Strings only, no behaviour change, and each error container
|
|
measured at a 360px viewport in the pinned Playwright container
|
|
([#172](https://git.eeqj.de/sneak/AutistMask/issues/172)).
|
|
- 2026-08-12: Closed the empty-array hole in the end-to-end unstubbed-request
|
|
guard. `batch.every()` is vacuously true on `[]`, so a POST with body `[]` was
|
|
answered `200 []` instead of failing the suite; the guard now rejects an empty
|
|
batch, demonstrated green-before/red-after with a throwaway probe. The comment
|
|
claiming `postData()` returns `null` for undecodable bodies was corrected to
|
|
the two real paths — an absent or empty body decodes to `null`, a binary body
|
|
decodes lossily into invalid JSON
|
|
([#187](https://git.eeqj.de/sneak/AutistMask/issues/187)).
|
|
- 2026-08-12: The transaction confirmation screen has browser coverage. The
|
|
end-to-end suite reaches ConfirmTx for both the native ETH and the ERC-20 path
|
|
off a funded-balance fixture, and asserts the pending, funded, over-balance
|
|
and estimate-failed states, the fee block quoting the estimate and the reserve
|
|
separately, and a constant view height across every one of those transitions.
|
|
The load-bearing assertion is that the spend gate reads the reserve and not
|
|
the displayed estimate: swapping the two fails the suite
|
|
([#238](https://git.eeqj.de/sneak/AutistMask/issues/238)).
|
|
- 2026-08-12: The dust threshold field now explains a rejection instead of
|
|
snapping back in silence, with the parse in a pure, unit-tested module that
|
|
accepts plain decimal digits only — hex and exponent notation are refused
|
|
rather than read as 16 and 1000
|
|
([#233](https://git.eeqj.de/sneak/AutistMask/issues/233)).
|
|
- 2026-08-12: Approval verification became an allowlist — transaction type
|
|
restricted to 0/1/2 so an EIP-7702 delegation can no longer ride along on an
|
|
approved transfer, every consequential field compared, the artifact
|
|
re-serialized from the checked fields alone and its exact bytes required to be
|
|
the canonical encoding of what was broadcast. One approval now yields at most
|
|
one broadcast, and every path that retires a pending approval — popup close,
|
|
active-address change, a late reject — goes through a single chokepoint that
|
|
refuses to settle an attempt already claimed for signing and broadcast
|
|
([#174](https://git.eeqj.de/sneak/AutistMask/issues/174)).
|
|
- 2026-08-12: An address can be removed from an HD or xprv wallet behind a
|
|
confirmation screen that states nothing is destroyed, sharing the deletion
|
|
state transitions with wallet deletion so the selection, site permissions and
|
|
active-address broadcast follow the same rules
|
|
([#162](https://git.eeqj.de/sneak/AutistMask/issues/162)).
|
|
- 2026-08-12: The known-symbol spoof rule moved into `src/shared/symbolSpoof.js`
|
|
and is now the only copy. The balance list had exempted symbols the token list
|
|
maps to `null` — `"ETH"` alone — so a fake ETH ERC-20 was hidden from the
|
|
transaction history and the Send selector but listed as a holding named ETH. A
|
|
symbol with no legitimate contract may now be borne by no contract on any of
|
|
the three surfaces, and the native exemption is "has no contract address", so
|
|
a second null-mapped symbol needs no call-site change. The user's real ETH
|
|
balance is read over RPC and never passes through the rule
|
|
([#235](https://git.eeqj.de/sneak/AutistMask/issues/235)).
|
|
- 2026-08-12: `script/verify-build`'s failure modes are now a committed target,
|
|
`script/test-verify-build`, run by `make check`. It asserts the exit status
|
|
and the message of every case against a fixture tree in a temp dir, and drops
|
|
privileges (proving the runner against a mode-000 file first) for the cases
|
|
that only mean something when file permissions are in force
|
|
([#227](https://git.eeqj.de/sneak/AutistMask/issues/227)).
|
|
- 2026-08-12: WaitTx lifecycle: a receipt and the 60-second timeout can no
|
|
longer both render on one tick, no timer or in-flight lookup outlives its
|
|
wait, a failed receipt lookup no longer counts as a timeout (but six in a row
|
|
end the wait, reported as an unreachable network rather than as a timeout),
|
|
and the wait now resumes after a popup close
|
|
([#155](https://git.eeqj.de/sneak/AutistMask/issues/155)).
|
|
- 2026-08-12: The private key export screen now wipes the key from the page
|
|
whenever it is left by any route, and a decrypt still in flight when the
|
|
screen is left is discarded instead of written; the same `onViewLeave()`
|
|
cleanup was extended to every other screen holding secret material in the DOM
|
|
(AddWallet, ConfirmTx, DeleteWallet, ApproveTx, ApproveSign)
|
|
([#221](https://git.eeqj.de/sneak/AutistMask/issues/221)).
|
|
- 2026-08-12: An xprv wallet already in storage that was imported from a
|
|
non-master key is detected from the depth of its stored `xpub`, explained in
|
|
the wallet list, and blocked from signing, sending and private-key export
|
|
instead of throwing on the send screen
|
|
([#234](https://git.eeqj.de/sneak/AutistMask/issues/234)).
|
|
- 2026-08-12: An unreported `holders_count` is now parsed as `null` rather than
|
|
`0`, so the low-holder rule declines to judge an unknown count instead of
|
|
hiding a legitimate token as spam, in both the transaction history and the
|
|
Send token selector ([#230](https://git.eeqj.de/sneak/AutistMask/issues/230)).
|
|
- 2026-08-12: Bundled token list documentation no longer states a count. The
|
|
four "top 250" claims in `README.md` and the "roughly 500" claim in
|
|
`docs/README.md` are replaced with a description of how the list is actually
|
|
selected — a point-in-time CoinGecko snapshot of the highest-market-cap
|
|
Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
|
|
the authoritative set
|
|
([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
|
|
- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
|
|
`'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
|
|
fallback at 20x the Argon2id cost, pinned in both directions by
|
|
`tests/manifest.test.js` and observed in the real popup by the e2e suite
|
|
([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
|
|
- 2026-08-11: Known-symbol spoof verification became a Settings toggle
|
|
(`hideSpoofedSymbols`), on by default, governing the transaction-history
|
|
filter and the fraud-contract learning it feeds
|
|
([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)).
|
|
- 2026-08-11: `script/verify-build` now walks `dist/` NUL-delimited and asserts
|
|
`dist/` is a real directory, so a path with a trailing space or a newline can
|
|
no longer carry a debug marker past the unlisted-bundle check
|
|
([#223](https://git.eeqj.de/sneak/AutistMask/issues/223)).
|
|
- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
|
|
into Display, next to the theme selector
|
|
([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
|
|
- 2026-08-11: Network fee counted in the confirmation-screen balance check for
|
|
both ETH and ERC-20 sends, reserving what the node actually charges a type-2
|
|
transaction, with the arithmetic in a pure, unit-tested
|
|
`src/shared/txValidation.js`
|
|
([#154](https://git.eeqj.de/sneak/AutistMask/issues/154)).
|
|
- 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of
|
|
falling back to the 100,000 gwei default, and every address comparison in
|
|
`src/shared/transactions.js` goes through one case-normalising helper so a
|
|
checksummed genuine contract is no longer read as a spoof
|
|
([#179](https://git.eeqj.de/sneak/AutistMask/issues/179)).
|
|
- 2026-08-11: Password-gated recovery phrase display for HD wallets, reached
|
|
from the wallet row in Settings, wiped on leaving the screen and excluded from
|
|
the views the popup can reopen onto
|
|
([#161](https://git.eeqj.de/sneak/AutistMask/issues/161)).
|
|
- 2026-08-11: Extended-key import hardened — the base58 checksum is now enforced
|
|
on every xprv and xpub, and a non-master key is refused with an explanation
|
|
instead of being derived beneath
|
|
([#210](https://git.eeqj.de/sneak/AutistMask/issues/210)).
|
|
- 2026-08-11: the balance refresh and the 24-hour phishing list refresh moved
|
|
from `setInterval` to the extension alarms API, with the phishing delta and
|
|
its fetch timestamps persisted to extension storage, so neither job dies with
|
|
the MV3 service worker. Each job's freshness guard was decoupled from its
|
|
alarm period at the same time — timed to the period, a guard vetoes its own
|
|
scheduled tick and halves the real refresh rate
|
|
([#158](https://git.eeqj.de/sneak/AutistMask/issues/158)).
|
|
- 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
|
|
Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
|
|
the Makefile-only targets documented in the README
|
|
([#166](https://git.eeqj.de/sneak/AutistMask/issues/166)).
|
|
- 2026-08-11: `script/verify-build` diagnostics corrected: the both-markers
|
|
message now states what is and is not proven, an unreadable bundle is
|
|
diagnosed as an I/O fault rather than as changed output, the `*.js` assumption
|
|
lives only in `build.js`, and the unlisted-bundle scan hard-fails when it
|
|
cannot enumerate `dist/`
|
|
([#180](https://git.eeqj.de/sneak/AutistMask/issues/180)).
|
|
- 2026-08-11: Known-answer test coverage for the crypto core — BIP-39/BIP-32
|
|
derivation in `wallet.js` and the Argon2id vault in `vault.js`
|
|
([#159](https://git.eeqj.de/sneak/AutistMask/issues/159)).
|
|
- 2026-08-11: Three `README.md` claims corrected against the code — blocklist
|
|
attribution, token-display rule, navigation model
|
|
([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
|
|
- 2026-08-11: README Screen Map rebuilt from the code — every screen, element
|
|
and transition re-verified against `src/popup/`
|
|
([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).
|
|
- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
|
|
all five network destinations documented, password/Settings/Add Wallet
|
|
sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
|
|
- 2026-08-11: `loadState()` now derives `hasWallet` from the wallet list instead
|
|
of trusting the persisted flag, so a profile already saved inconsistent no
|
|
longer stays broken on every load
|
|
([#195](https://git.eeqj.de/sneak/AutistMask/issues/195)).
|
|
- 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
|
|
remaining wallets, the selection only moves when it was deleted, and the
|
|
active-address change is broadcast to connected sites
|
|
([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
|
|
- 2026-08-11: One row per on-chain value movement in transaction history: the
|
|
merge moved into the pure `mergeTransactions` and the zero-ETH native side of
|
|
a plain ERC-20 transfer absorbed into its token row
|
|
([#177](https://git.eeqj.de/sneak/AutistMask/issues/177)).
|
|
- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
|
|
on `next`, with Status and Next Step refreshed
|
|
([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
|
|
- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
|
|
as the `__BUILD_DEBUG__` esbuild define and turned on with
|
|
`AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
|
|
created wallet the publicly committed test recovery phrase
|
|
([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
|
|
- 2026-08-09: dApp approval signing moved into the popup — the password no
|
|
longer crosses the extension messaging boundary; the background broadcasts and
|
|
resolves approvals only, and verifies the signed artifact against the approval
|
|
it holds (#157).
|
|
- 2026-08-09: Post-build assertion that every emitted bundle containing
|
|
`constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
|
|
`make build` path (#170).
|
|
- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
|
|
`script/test-e2e`) driving the real popup with all network intercepted, plus
|
|
the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
|
|
and TransactionDetail broken for every ERC-20 transfer (#151). Harness
|
|
demonstrated failing before the fixes and passing after (#181). Interception
|
|
covers the MV3 background service worker, not just the popup page, and a
|
|
launch-time canary aborts the suite if worker traffic starts escaping.
|
|
- 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
|
|
(#149-#168).
|
|
- 2026-08-09: Test coverage for the address-poisoning defense in
|
|
`src/shared/transactions.js` (#160)
|
|
- 2026-07-26: About well in settings with build info, repo link and the version
|
|
click easter egg (#145); proper view navigation stack (#146).
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
|
shims, README Entrypoints section (#148)
|
|
- 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
|
|
in approve-tx view (#141).
|
|
- Sepolia testnet support (#137); etherscan links go to token-specific URLs
|
|
(#136).
|
|
- Transaction detail improvements: Type field and on-chain details (#130),
|
|
txid-first reordering (#133), swap display corrections (#128), expanded
|
|
confirm-tx warnings (#118).
|
|
- Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
|
|
timestamps include timezone offset (#120); layout shift audit, reserved space
|
|
for error messages (#124).
|
|
- Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
|
|
duplicate detection (#115).
|
|
- 2026-02-27: v0.1.0 tagged.
|
|
- 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
|
|
ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
|
|
reverse resolution.
|
|
|
|
# Future Steps
|
|
|
|
Only work that has no issue of its own belongs here; everything else is on the
|
|
tracker.
|
|
|
|
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
|
input validation) before any 1.0rc tag. Individual filed issues are parts of
|
|
it, but the review is broader than any of them.
|
|
- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
|
|
workflow. Extending the suite itself is tracked as
|
|
[#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
|
|
[#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
|
|
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
|
|
land.
|