Give each provider scope its own message channel

[reneaaron]

Describe the changes you have made in this PR

The inpage providers and their content scripts communicated over window.postMessage on the page window. Everything sent that way — the correlation id, the arguments and the reply — is delivered to every other message listener in the frame, and the first reply carrying a matching id settles the call.

Each scope now gets its own MessageChannel. The content script keeps one end and transfers the other to the inpage world; requests, replies and events travel over that channel rather than the page window.

What changed

• content-script/messagePortServer.js (new) creates the channel and hands the port over. It is called at module top, ahead of the asynchronous should-inject/blocklist decision, which now only gates whether requests get serviced. Requests that arrive before the scope registers a handler are buffered and flushed.
• providers/postMessage.ts requests its port and retries until it arrives — either world can initialise first — then routes replies to the waiting caller by id.
• A reply for an id that has already been settled is logged and dropped rather than applied to the result.
• accountChanged now reaches the providers over the channel instead of being read off the page window.
• The five content scripts (webln, nostr, webbtc, liquid, alby) move to the shared helper, which removes a fair amount of duplicated listener code.

Scope of the change, and what it does not do

The port handover is negotiated with window messages, so the channel is private only from scripts that were not already running when the port was transferred. On MV2 the inpage script is injected inline at document_start and that ordering holds. On MV3 the main-world script is registered separately and the ordering is not guaranteed, so a script that is already running in the frame can still take part in the handover.

Treat this as a narrowing of the shared page-window surface, not as a guarantee that provider results are authenticated to the page. The security boundary remains the extension-rendered confirmation UI, which the page cannot draw. Worth deciding separately (not in this PR):

• whether to make provider results self-verifying where the cryptography allows it — a sendPayment preimage can be checked against the BOLT11 payment hash by the integrator
• whether to pin the provider objects on window. Object.freeze() on the instances is not viable as-is: providerBase assigns this._isEnabled after construction and these are ES modules, so freezing would make enable() / isEnabled() throw. A non-configurable window.webln / window.nostr would prevent replacement but risks breaking coexistence with other WebLN/NIP-07 extensions.

Tests

• providers/__tests__/postMessage.test.ts — a request goes over the port and its reply resolves the call; a reply of the old shape replayed on the page window does not resolve it and the genuine reply still does; a second reply for a settled id does not overwrite the result; errors reject; events arrive over the port and are not picked up from the window.
• content-script/__tests__/messagePortServer.test.ts — a request over the port is serviced and answered on it, requests before a handler are buffered, the port is transferred once, another scope's handshake is ignored, events go over the port.
• JSDOM has no MessageChannel. tests/unit/helpers/fakeMessageChannel.ts supplies a minimal stand-in, installed per test file rather than globally, because msw depends on the real one.

yarn lint, yarn tsc:compile and yarn test:unit pass (77 suites, 179 passed, 2 pre-existing skips), and yarn build:chrome succeeds.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}