[imblue-dabadee]

Summary

Point the "share on X" link directly at X's current share page and stop the e2e test from depending on the live X site, which is currently failing CI on every PR.

Problem

redirects to X share page when clicked fails in every browser on main, so every PR is red — including #229. The link opened https://twitter.com/intent/tweet?... and the test waited for X's own redirects to land on x.com/intent/post. X now sends that traffic elsewhere, so the popup ends up on one of:

• x.com/intent/tweet?... — X no longer completes the redirect to /intent/post
• x.com/i/jf/onboarding/web?redirect_after_login=...&mode=login — X's login wall
• chrome-error://chromewebdata/ — the request failed on the CI runner

None of these are caused by this repo. The link itself was also stale: it relied on X redirecting the legacy Twitter URL.

Solution

• Link: now points to https://x.com/intent/post with the same pre-filled text. The shared link is now https://metamask.com: metamask.io redirects there and metamask.com is the canonical domain. The ! in the text is percent-encoded as %21, so the URL survives being copied into a shell or other tools; the decoded post is unchanged. target="_blank" and rel="noopener noreferrer" are unchanged.
• Test: stubs https://x.com/** with an empty page via context.route, so it checks only what this page controls: clicking opens a new tab at the exact share URL. It no longer makes any network request to X.
• New security assertions: the test now checks that the link has rel containing noopener, and that the opened tab has no window.opener. A phishing warning page must not let a page it opens navigate it. Both are checked because modern browsers already treat target="_blank" as no-opener, so the window.opener check alone would still pass if rel were removed.
• Reporter: html reporter set to open: 'never'. On a local failure, the default on-failure serves the report on port 9323 and keeps the process running until Ctrl+C, so a failed run looks like a hang. The report is still written to playwright-report/ and can be opened with yarn playwright show-report. CI is unaffected.

The test no longer catches X itself changing or breaking its share endpoint. That's intentional, since it's outside this repo's control.

Risk

• User-facing: the share link URL changes, and the shared MetaMask link is now metamask.com instead of metamask.io. The pre-filled text is identical.
• Local workflow: the HTML report no longer opens automatically after a failed local run.

Verification

• yarn lint passes
• All 72 tests pass locally in Chromium, Google Chrome and Microsoft Edge
• Test fails if rel="noopener noreferrer" is removed from the link
• Test fails if the link is reverted to the legacy twitter.com/intent/tweet URL
• Firefox: could not run locally (browser fails to launch on my machine) — relying on CI
• Manual check: the link opens X's share composer with the pre-filled post and a MetaMask link card
• Logged out, X redirects to login and preserves the full pre-filled post through redirect_after_login

Refs PSAFE-759. Unblocks #229.

[adonesky1]

LGTM