fix: handle non-url origins

[0xEdouardEth]

Explanation

This PR updates the Tron Snap origin formatter to handle the stable wallet-connect origin used by MetaMask Mobile WalletConnect multichain requests.

The change is intentionally limited to display formatting:

• metamask is displayed as MetaMask;
• wallet-connect is displayed as WalletConnect;
• valid HTTP(S) URL origins are displayed as hostnames;
• unknown invalid origins, such as WalletConnect channel IDs, format to an empty string so confirmation UI can avoid showing meaningless identifiers.

This PR no longer changes the Security Alerts / Blockaid request payload or transaction scan flow. Existing scan behavior, including the existing MetaMask origin URL mapping, is preserved.

References

• Related to MetaMask Mobile PR: refactor(walletconnect): use stable origin for Tron snap requests metamask-mobile#32339
• Related Solana Snap PR: fix: handle non-url origins snap-solana-wallet#623

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
  • N/A - no package changelog update needed for this internal behavior fix.
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
  • N/A - this does not introduce a breaking API change.

Validation

yarn workspace @metamask/tron-wallet-snap jest packages/snap/src/utils/formatOrigin.test.ts --runInBand --coverage=false

Result: 1 test suite passed, 6 tests passed.

yarn eslint packages/snap/src/utils/formatOrigin.ts packages/snap/src/utils/formatOrigin.test.ts

Result: passed.

---

Note

Low Risk
Display-only formatting in confirmation UI with no changes to signing, scanning, or security payloads.

Overview
Updates formatOrigin so confirmation UIs can show stable Mobile/WalletConnect origins without surfacing raw channel IDs or invalid strings.

metamask and wallet-connect now resolve to MetaMask and WalletConnect via a case-insensitive lookup table. Valid http(s) URLs still show the hostname; other values (bare hostnames, parse failures, non-http schemes) return '' so {origin ? …} guards omit the origin row instead of echoing meaningless text.

Tests and an Unreleased changelog entry document the new behavior.

^{Reviewed by Cursor Bugbot for commit 497f871. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 548af0c. Configure here.}

[cursor]

Unknown origin shows blank label

Medium Severity

Sign-transaction confirmation sets missing origins to the literal 'Unknown', then runs formatOrigin on that value. After this change, formatOrigin returns an empty string for non-URL strings, so the origin row still renders (the prop is truthy) but the value is blank instead of Unknown.

 

^{Reviewed by Cursor Bugbot for commit 548af0c. Configure here.}