feat: release passwordless hierarchical APT v1.2.5

test/extension-contract.test.js

@@ -39,10 +39,11 @@ function makeElement() {
 
 function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null, validServerProof = true } = {}) {
   const elements = Object.fromEntries(
-    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'copyWarning', 'confirmCopy', 'openOptionsBtn']
+    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'openOptionsBtn']
       .map((id) => [id, makeElement()])
   );
   const clipboardWrites = [];
+  const confirmationMessages = [];
   const fetchCalls = [];
   let cookieReads = 0;
   const chromeApi = {
@@ -65,7 +66,7 @@ function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject
     chromeApi,
     documentApi,
     navigatorApi,
-    confirmCopy: () => confirmCopy,
+    confirmCopy: (message) => { confirmationMessages.push(message); return confirmCopy; },
     cryptoApi: crypto.webcrypto,
     fetchImpl: async (...args) => {
       fetchCalls.push(args);
@@ -81,7 +82,7 @@ function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject
       return { ok: true, json: async () => ({ success: true }) };
     }
   });
-  return { controller, elements, clipboardWrites, fetchCalls, get cookieReads() { return cookieReads; } };
+  return { controller, elements, clipboardWrites, confirmationMessages, fetchCalls, get cookieReads() { return cookieReads; } };
 }
 
 test('manifest commits only a public key, stable ID, local storage, and exact loopback host access', () => {
@@ -174,11 +175,11 @@ test('copy cancellation occurs before cookie access and never writes the token',
   assert.match(harness.elements.statusMsg.textContent, /cancelled/i);
 });
 
-test('confirmed copy warns about clipboard history and reports success without exposing token', async () => {
+test('confirmed copy uses one concise prompt and reports success without exposing token', async () => {
   const harness = makePopupHarness({ paired: true, confirmCopy: true });
   await harness.controller.init();
-  assert.match(harness.elements.copyWarning.textContent, /clipboard (?:history|sync)/i);
   await harness.controller.copyToken();
+  assert.deepEqual(harness.confirmationMessages, ['Copy VA token?']);
   assert.deepEqual(harness.clipboardWrites, ['sensitive-va-token']);
   assert.match(harness.elements.statusMsg.textContent, /copied/i);
   assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
@@ -201,6 +202,7 @@ test('options UI stores a validated pairing secret locally and can forget pairin
   const js = read('options.js');
   assert.match(html, /pairingSecret/);
   assert.match(html, /type="password"/);
+  assert.doesNotMatch(html, /treat it like a password|privacy-note/i);
   assert.match(js, /chrome\.storage\.local\.set/);
   assert.match(js, /chrome\.storage\.local\.remove/);
   assert.match(js, /aptPairingSecret/);