fix: phase-one wallet hardening integration

[thomas-kroes]

Summary

• Integrate the reviewed side-panel/default-lock hardening from feat: popup / side panel display mode toggle #51 with the public fee-estimation work from Feat/public fee estimation #52.
• Default every missing display-mode preference, including upgrades from versions that did not store the key, to the side panel; preserve every explicit stored preference thereafter.
• Default every missing auto-lock preference to 10 minutes, including upgrades; preserve an explicitly stored 0 as Never.
• Restore serializable approval state safely across service-worker restarts while excluding raw WASM requests, promoting queued requests, and revalidating origin/account/liveness before approval.
• Keep dApp-supplied fees exact. Treat wallet-generated fees as advisory, explicitly disclose that they may change, and retry an underfunded advisory build once with the remaining locally available notes.
• Reconcile note reservations, wallet history, fee, and change to the inputs and fee WASM actually built.
• Bind raw-transaction approval and post-sign verification to a stable witnessless transaction-intent hash. The raw transaction ID is still checked before signing, but is not incorrectly expected to remain unchanged after witness signatures are attached.

Review scope

This is the phase-one release integration artifact and supersedes merging #51 and #52 independently. It is intentionally a draft: do not merge before the planned human review and cross-repository release ordering are complete.

Validation

• npm run format:check
• npm run typecheck
• npm test — 24 tests, including approval restoration/invalidation and advisory-fee retry/reconciliation coverage
• npm run build
• production dependency audit — zero findings

The transaction-intent invariant is also covered in nockbox/iris-rs#29: signing preserves the witnessless spends hash while legitimately changing the raw transaction ID.

Manual acceptance checklist

• Existing install with no display-mode key upgrades to side panel; switching to popup persists across worker/extension restarts
• Missing auto-lock preference defaults to 10 minutes; explicitly selecting Never persists
• Estimated-fee approval clearly states that the final network fee may differ
• Advisory fee drift can reserve additional local notes and rebuild once; exact-fee requests never retry or change fee
• Retry failure releases all reservations, and successful retry records only the inputs WASM actually used
• Raw signing approval succeeds when only witness signatures change and rejects any changed transaction intent
• Existing vault upgrade, keyfile export/import, seed copy, and HTTP/HTTPS dApp flows remain functional

[thomas-kroes]

@greptile-apps

[greptile-apps]

Greptile Summary

This PR integrates wallet hardening and fee-estimation behavior across the extension.

• Defaults missing display-mode preferences to the side panel and missing auto-lock preferences to ten minutes while preserving explicit settings.
• Adds restart-safe approval snapshots, requester/account validation, and side-panel approval routing.
• Adds advisory fee estimation, one-time underfunded-build retry, and reconciliation against the transaction actually built.
• Verifies raw-transaction approvals with stable witnessless transaction-intent hashes.
• Expands CI and automated coverage for approval restoration, side-panel behavior, RPC methods, and fee reconciliation.

Confidence Score: 5/5

The PR appears safe to merge from the reviewed code, with no concrete blocking or independently actionable non-blocking defect identified.

The changed approval, transaction-building, reservation-cleanup, origin-validation, and settings-migration paths retain their required guards and reconcile persisted state with the transaction actually built.

Important Files Changed

Filename	Overview
extension/background/index.ts	Integrates display-mode routing, approval persistence and validation, advisory-fee handling, and hardened raw-transaction approval.
extension/shared/vault.ts	Adds transaction-intent verification and reconciles reservations, fees, inputs, change, and history with the transaction produced by WASM.
extension/shared/transaction-fee.ts	Introduces bounded advisory-fee retry and strict reconciliation helpers for built transaction inputs and amounts.
extension/shared/pending-approval-state.ts	Adds serializable pending-approval snapshots with filtering, expiration handling, and queue promotion.
extension/content/index.ts	Hardens the page-to-extension message envelope and supplies authoritative extension-side display context.
extension/popup/hooks/useApprovalDetection.ts	Updates approval discovery and routing to support both popup and side-panel surfaces.
extension/shared/constants.ts	Defines display-mode, auto-lock, runtime-message, and approval-related constants used by the integrated hardening flow.
package.json	Adds the Vitest-based test command and development dependency.
.github/workflows/ci.yml	Runs the test suite as part of the required CI workflow.

Sequence Diagram

sequenceDiagram
    participant D as dApp
    participant B as Background worker
    participant U as Approval UI
    participant V as Vault/WASM
    participant N as Network
    D->>B: Provider transaction request
    B->>V: Estimate advisory fee when omitted
    B->>U: Display approval request
    U->>B: Approve
    B->>B: Revalidate origin, account, and requester
    B->>V: Reserve notes and build transaction
    alt Advisory fee is underfunded
        B->>V: Reserve remaining available notes
        B->>V: Retry build once
    end
    V-->>B: Actual inputs, fee, and change
    B->>N: Broadcast built transaction
    B->>V: Reconcile reservations and history
    B-->>D: Transaction result

Loading

_{Reviews (1): Last reviewed commit: "fix: harden advisory fees and raw signin..." | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9a62b42ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bypass SDK mapping for the locally added fee method

When a dApp calls nock_estimateTransactionFee without an api field—the supported default-provider request shape—resolveSourceApiVersion treats it as API 0 and this classification sends it through mapRpcRequest from @nockbox/iris-sdk 0.2.0. That SDK predates this locally added method, so the request is rejected before reaching the new switch handler; the outgoing bridge repeats the same unsupported mapping. Special-case this method as a pass-through, or provide explicit request/response mappings until the SDK is upgraded.

Useful? React with 👍 / 👎.