Vest: the relayed login binds itself to an unset Vest firm

A Vest firm's credential is the wallet of the login it trades. It no longer
has to be typed or clicked in: when the extension relays a Vest tab's
session and a Vest firm here has no credential, that wallet is saved as the
credential (lib/vest-wallet.ts), the client starts, and the backup is
pushed.

- A saved wallet is never replaced. When the tab is signed in to another
  login, the firm now says which one and how to switch: sign in as the
  saved wallet, or remove the credential.
- With two logins relayed at once nothing binds itself; the one-click form
  decides.
- Extension 0.17.1 re-posts the session every minute even when it hasn't
  changed. The dashboard holds it in memory only, so a restart there was
  unauthenticated until the tab's next renewal (up to ~15 min); now it is
  back within a minute, and a firm created later binds within a minute too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/README.md

@@ -87,8 +87,9 @@ log in to Vest by itself. The extension relays the browser's session instead:
 
 ```
 vest-relay.js (Vest tab, MAIN world)   keeps the access token the Vest app last renewed
-background.js  relayVestSession        lifts it every 10s, posts it when it changes
-dashboard      POST /api/vest/session  holds it in memory for the firm's Vest client
+background.js  relayVestSession        lifts it every 10s, posts it when it changes (and every minute)
+dashboard      POST /api/vest/session  holds it in memory for the firm's Vest client,
+                                       and binds an unset Vest firm to the login's wallet
 ```
 
 - The hook only reads the Vest app's own `/v3/auth/refresh` and `/register`

extension/background.js

@@ -1208,11 +1208,15 @@ async function tick() {
 const VEST_PATTERN = 'https://next.vestmarkets.com/*';
 const VEST_URL = 'https://next.vestmarkets.com/portfolio';
 const VEST_EVERY_MS = 10_000;
+/** The session is posted again this often even unchanged: the dashboard
+ *  keeps it in memory only, so a restart there needs it back. */
+const VEST_REPOST_MS = 60_000;
 /** A Vest tab opened for the relay isn't opened again for this long. */
 const VEST_REOPEN_MS = 10 * 60_000;
 
 let vestLastCheck = 0;
 let vestLastRelayed = '';
+let vestLastPostAt = 0;
 let vestOpenedAt = 0;
 
 /** Runs in the Vest tab's MAIN world: the session vest-relay.js holds, while
@@ -1276,7 +1280,7 @@ async function relayVestSession(cfg) {
     }
 
     const fingerprint = `${found.expiresAt}:${found.accessToken.length}:${found.accessToken.slice(-16)}`;
-    if (fingerprint === vestLastRelayed) return;
+    if (fingerprint === vestLastRelayed && now - vestLastPostAt < VEST_REPOST_MS) return;
     const res = await fetch(`${cfg.apiBase}/api/vest/session`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -1288,9 +1292,12 @@ async function relayVestSession(cfg) {
     if (res.status === 404) throw new Error('this dashboard is too old for the Vest relay');
     if (!res.ok) throw new Error(`dashboard refused the session: ${body.reason || body.error || `HTTP ${res.status}`}`);
     vestLastRelayed = fingerprint;
+    vestLastPostAt = now;
     const short = `${found.primaryAddr.slice(0, 6)}…${found.primaryAddr.slice(-4)}`;
     const mins = Math.max(0, Math.round((found.expiresAt - Date.now()) / 60000));
-    await setState({ vest: `Relayed ${short}${body.used ? '' : ' (no Vest firm here uses this wallet)'} · good ${mins}m` });
+    const note = Array.isArray(body.bound) && body.bound.length > 0 ? ` · bound to ${body.bound.join(', ')}`
+        : body.used ? '' : ' (no Vest firm here uses this wallet)';
+    await setState({ vest: `Relayed ${short}${note} · good ${mins}m` });
 }
 
 // ── 2FA: the person's authenticator code for the firm site you are on ───────

extension/manifest.json

@@ -1,7 +1,7 @@
 {
     "manifest_version": 3,
     "name": "AutoFirmer Capture",
-    "version": "0.17.0",
+    "version": "0.17.1",
 
     "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxdbOMRR+58a9dHlbIKtlALtS3E4eltBGqfTnUc0lzJuWj5ZA4+5YFSdUnxv5N1ogxwpJUGkUV3MnKJuZnTekCmsNwjCy41a20Xtc7jQLHrIBZkesB6cB+d0l9Vo8M6EC3ZMD8Iv6MdAalU3GZh1Hn9vm24NjJ+xUT1qNIVHEcNUIb9evYobR/XHv+JAp6bOFnaLM+3wpyYKe4efMhsz0F86u9thRNhQnraTqUWfnKNpsHPK2zivaYHrziEEWX7Y3EsMHkf2FRhkUe7IDoxeJM49DBToTo9sAJUkcgLeGCGZLo7H3mcxyn/zERYR+rD3k5xdeBtjoZHXFx2+FanLb9wIDAQAB",
     "update_url": "https://ext.juicerroom.com/updates.xml",