feat: v0.3.3 — comprehensive code review, handler split, security hardening

Round 2 code review by 10 parallel Opus agents covering security,
performance, code quality, dead code, documentation, and roadmap.
70 new findings documented in docs/code-review.md.

Key changes: misc-handlers split into activity/profile/publish handlers,
graph.ts private modifiers, NIP-07 input validation, permission cache
test fixes, .js->.ts import standardization, nostr-tools/pure removal,
IDB upgrade deduplication, centralized constants, async-lock extraction.

Author: leonacostaok

CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.3] - 2026-03-13
+
+### Changed
+- **Comprehensive code review (Round 2)** — 10 parallel Opus agents audited the full codebase covering security, performance, code quality, dead code, documentation accuracy, and future enhancements; 70 new findings documented in `docs/code-review.md`
+- **Misc-handlers split** — `misc-handlers.ts` (507 lines) split into `activity-handlers.ts`, `profile-handlers.ts`, `publish-handlers.ts`; original file is now a re-export facade
+- **Graph module hardened** — underscore-prefixed methods replaced with `private` modifier; all 11 internal call sites updated
+- **NIP-07 input validation** — added `event.tags` validation (array of string arrays) and `event.created_at` validation (integer, not >1 hour in future)
+- **signEvent zeroing contract** — comprehensive JSDoc documenting caller responsibility for key zeroing
+- **LNbits HTTP warning** — console.warn added when admin key is sent over non-localhost HTTP
+
+### Fixed
+- **Permission cache test failures** — added `storage.onChanged` support to browser mock so in-memory caches invalidate correctly between tests
+- **Wallet balance assertions** — fixed msats-to-sats conversion in NWC test mocks (values now in millisats, expected results in sats)
+- **Import extensions** — standardized all 17 test files from `.js` to `.ts` import extensions
+- **nostr-tools/pure removal** — replaced `generateSecretKey`/`getPublicKey` imports with own crypto; only `nostr-tools/nip46` remains
+- **IDB upgrade deduplication** — extracted shared `upgradeDatabase()` helper from duplicate `onupgradeneeded` callbacks
+- **NODE_ENV** — changed from `'development'` to `'production'` in vite.config.ts
+
+### Added
+- `lib/constants.ts` — centralized magic numbers (timeouts, rate limits, crypto parameters)
+- `lib/utils/async-lock.ts` — shared async mutex (extracted from duplicated `withStorageLock` pattern)
+- `lib/bg/activity-handlers.ts` — activity log handlers with write buffering
+- `lib/bg/profile-handlers.ts` — profile metadata and mute list handlers
+- `lib/bg/publish-handlers.ts` — event signing, broadcasting, and NIP-46 session handlers
+- `docs/code-review.md` — comprehensive Round 2 audit with 70 findings and prioritized roadmap
+
 ## [0.3.2] - 2026-03-10
 
 ### Changed

background.ts

@@ -13,8 +13,10 @@ import type { ScoringConfig } from './lib/types.ts';
 
 import {
     config, setOracle, resetLocalGraph,
-    PRIVILEGED_METHODS, NIP07_SIGNING_METHODS,
+    NIP07_SIGNING_METHODS,
     checkRateLimit, npubToHex,
+    buildPrivilegedMethods, setPrivilegedMethods,
+    PRIVILEGED_METHODS,
     type HandlerFn,
 } from './lib/bg/state.ts';
 import { handlers as wotHandlers } from './lib/bg/wot-handlers.ts';
@@ -32,27 +34,43 @@ import { handlers as onboardingHandlers } from './lib/bg/onboarding-handlers.ts'
 // ── Assemble handler map ──
 
 const allHandlers = new Map<string, HandlerFn>();
-for (const group of [wotHandlers, miscHandlers, domainHandlers, vaultHandlers, walletHandlers, nip07Handlers, onboardingHandlers]) {
+const handlerGroups = [wotHandlers, miscHandlers, domainHandlers, vaultHandlers, walletHandlers, nip07Handlers, onboardingHandlers];
+for (const group of handlerGroups) {
     for (const [method, fn] of group) {
+        if (allHandlers.has(method)) {
+            console.error(`[BG] Duplicate handler registration: "${method}" — later registration overwrites earlier one`);
+        }
         allHandlers.set(method, fn);
     }
 }
 
 // configUpdated stays here because it calls loadConfig which is local
+let _refreshDebounceTimer: ReturnType<typeof setTimeout> | null = null;
 allHandlers.set('configUpdated', async () => {
     await loadConfig();
-    refreshBadgesOnAllTabs();
+    // Debounce badge refresh — multiple rapid config updates only trigger one refresh
+    if (_refreshDebounceTimer) clearTimeout(_refreshDebounceTimer);
+    _refreshDebounceTimer = setTimeout(() => { refreshBadgesOnAllTabs(); _refreshDebounceTimer = null; }, 500);
     return { ok: true };
 });
 
+// Auto-derive PRIVILEGED_METHODS from all handler maps (no manual allowlist needed)
+const privilegedHandlerGroups = [miscHandlers, domainHandlers, vaultHandlers, walletHandlers, nip07Handlers, onboardingHandlers];
+setPrivilegedMethods(buildPrivilegedMethods(...privilegedHandlerGroups));
+// Also add configUpdated and other locally-defined handlers
+PRIVILEGED_METHODS.add('configUpdated');
+PRIVILEGED_METHODS.add('syncGraph');
+PRIVILEGED_METHODS.add('stopSync');
+PRIVILEGED_METHODS.add('clearGraph');
+
 // ── Config loading ──
 
 async function loadConfig(): Promise<void> {
     const data = await browser.storage.sync.get([
         'mode', 'oracleUrl', 'myPubkey', 'relays', 'scoring'
     ]) as Record<string, unknown>;
 
-    config.mode = (data.mode as string) || 'hybrid';
+    config.mode = (data.mode as 'local' | 'remote' | 'hybrid') || 'hybrid';
     config.myPubkey = (data.myPubkey as string) || null;
     config.maxHops = 3;
     config.timeout = 5000;
@@ -290,9 +308,7 @@ browser.runtime.onConnect.addListener((port: chrome.runtime.Port) => {
         }
 
         try {
-            console.log('[PORT]', port.name, 'request:', method);
             const result = await handleRequest(request as { method: string; params: Record<string, unknown> });
-            console.log('[PORT]', port.name, 'success:', method);
             try { port.postMessage({ result }); } catch {}
         } catch (error) {
             console.error('[PORT]', port.name, 'error:', method, (error as Error).message);

content.ts

@@ -66,39 +66,99 @@ if (window.__nostrWotContentInjected) {
         return ++wotRequestCount <= WOT_RATE_LIMIT;
     }
 
-    function forwardViaPort(portName: string, responseType: string, id: string, method: string, params: unknown): void {
+    // ── Persistent port management ──
+    // One port per channel (nip07, webln). Requests are serialized per port because
+    // the background handler does not echo request IDs in responses, so we process
+    // one request at a time to match responses unambiguously.
+
+    interface PortRequest {
+        id: string;
+        responseType: string;
+        method: string;
+        params: unknown;
+    }
+
+    interface PortState {
+        port: ReturnType<typeof browser.runtime.connect> | null;
+        queue: PortRequest[];
+        inflight: PortRequest | null;
+    }
+
+    const portStates: Record<string, PortState> = {
+        nip07: { port: null, queue: [], inflight: null },
+        webln: { port: null, queue: [], inflight: null },
+    };
+
+    function postResponse(responseType: string, id: string, result: unknown, error: unknown): void {
+        window.postMessage({ type: responseType, id, result, error }, window.location.origin);
+    }
+
+    function processNextInQueue(portName: string): void {
+        const state = portStates[portName];
+        if (state.inflight || state.queue.length === 0) return;
+
+        const request = state.queue.shift()!;
+        state.inflight = request;
+
+        const port = getOrCreatePort(portName);
+        if (!port) {
+            state.inflight = null;
+            postResponse(request.responseType, request.id, null, 'Extension context invalidated — reload the page');
+            processNextInQueue(portName);
+            return;
+        }
+
         const origin = window.location.hostname;
+        port.postMessage({
+            method: portName + '_' + request.method,
+            params: { ...(request.params as Record<string, unknown>), origin }
+        });
+    }
+
+    function getOrCreatePort(portName: string): ReturnType<typeof browser.runtime.connect> | null {
+        const state = portStates[portName];
+        if (state.port) return state.port;
+
         try {
             const port = browser.runtime.connect({ name: portName });
-            let responded = false;
-
-            const sendResult = (result: unknown, error: unknown) => {
-                if (responded) return;
-                responded = true;
-                window.postMessage({ type: responseType, id, result, error }, window.location.origin);
-            };
 
             port.onMessage.addListener((response: Record<string, unknown>) => {
-                sendResult(response.result, response.error);
-                try { port.disconnect(); } catch {}
+                const request = state.inflight;
+                if (request) {
+                    state.inflight = null;
+                    postResponse(request.responseType, request.id, response.result, response.error);
+                }
+                processNextInQueue(portName);
             });
 
             port.onDisconnect.addListener(() => {
-                sendResult(null, 'Extension context invalidated — reload the page');
+                state.port = null;
+                // Reject the in-flight request if any
+                if (state.inflight) {
+                    postResponse(state.inflight.responseType, state.inflight.id, null, 'Extension context invalidated — reload the page');
+                    state.inflight = null;
+                }
+                // Reject all queued requests
+                for (const req of state.queue) {
+                    postResponse(req.responseType, req.id, null, 'Extension context invalidated — reload the page');
+                }
+                state.queue = [];
             });
 
-            port.postMessage({
-                method: portName + '_' + method,
-                params: { ...(params as Record<string, unknown>), origin }
-            });
-        } catch {
-            window.postMessage({
-                type: responseType, id, result: null,
-                error: 'Extension context invalidated — reload the page'
-            }, window.location.origin);
+            state.port = port;
+            return port;
+        } catch (err) {
+            console.debug(`[nostr-wot] Failed to create port "${portName}":`, err);
+            return null;
         }
     }
 
+    function forwardViaPort(portName: string, responseType: string, id: string, method: string, params: unknown): void {
+        const state = portStates[portName];
+        state.queue.push({ id, responseType, method, params });
+        processNextInQueue(portName);
+    }
+
     // Bridge between page and extension
     window.addEventListener('message', async (event: MessageEvent) => {
         if (event.source !== window) return;
@@ -130,7 +190,8 @@ if (window.__nostrWotContentInjected) {
                     result: response.result,
                     error: response.error
                 }, window.location.origin);
-            } catch {
+            } catch (err) {
+                console.debug('[nostr-wot] WoT request failed:', method, err);
                 window.postMessage({
                     type: 'WOT_RESPONSE', id, result: null,
                     error: 'Extension context invalidated — reload the page'